{ "Event": { "published": true, "date": "2025-08-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-08-20", "timestamp": 1755734581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e2826669-b9bf-43a5-a2cb-6177431e39c7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa01ee93-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721599, "uuid": "b11e857e-f268-4534-974f-5b3f4689681e", "comment": "Malware payload (Mirai)", "value": "430fc89b558c53124487da51710c48ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721599, "uuid": "a4524aba-6ea2-458e-8ef7-e59e932ee482", "comment": "Malware payload (Mirai)", "value": "003e401e83c07d3db27fd1e45b6427feb207c8acce615127275520aee3fe4060", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721599, "uuid": "c1975575-c6fc-4965-a67a-629781093074", "comment": "Malware payload (Mirai)", "value": "8f50b520c2f665df427b46bc17c1c82ee442233b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721599, "uuid": "b9eae078-7fcc-412f-9143-ee66c857a80d", "comment": "Malware payload (Mirai)", "value": "67a91f27a0ad4d8376a0c0bca6f88429705e487596aa906d5ead6148ede1e78d52b6122c2381a4f83a6913a4645788f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721599, "uuid": "c7162e74-2015-42d8-9d2f-3174652ab976", "value": "T14C530A85B8819A25C6D113BBFE1F018E3316975CE2DE73128D145F647BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721599, "uuid": "22db6b2c-d3ac-4ec8-ad35-5b9c539f340c", "value": "1536:YdnWpBh3cLDNoATqHjjO5yAMQ1fonWmLdI8niD7noKWp:lH3+po+qHe4XQtom7noKWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721599, "uuid": "7bf39c19-ac5e-4f68-86fd-3b135d9fdb50", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721599, "uuid": "533d5ec6-f838-4be6-972e-da097f1f6cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721599, "uuid": "29f9d0c4-72d4-4296-ac66-f8bf7e81192d", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a8b003-7daf-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1755685294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685294, "uuid": "f15f14ee-afea-4dea-adac-f5c2fb80fb61", "comment": "Malware payload (SalatStealer)", "value": "38bcadaf1d101f3109fc9c5ff4b50a37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685294, "uuid": "1ee2f153-8170-4631-aa36-252f0c34a0bd", "comment": "Malware payload (SalatStealer)", "value": "0088a0a60aa92323cd52b2c1a5b68f5a53f9c95a52e3652cdf22c32667d66229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685294, "uuid": "74eafd3f-cc1f-4a4f-a6b0-f73c202bb6b8", "comment": "Malware payload (SalatStealer)", "value": "b30bd827257183174986f79ab43b1a3ce73eac1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685294, "uuid": "9bb36b2e-0baa-4b4b-a25d-8aca8cc0801f", "comment": "Malware payload (SalatStealer)", "value": "10fa8f3d7cfc80c69c8d46c711fab6a4df224ee874d396084e635dfd26ebc363bce3a4fda4d7074ac85d40f936836413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685294, "uuid": "a5d57e67-d3bb-4d88-8871-58a65922d048", "value": "T173E53384A7906F23CE1BC67D08DFCCF51D119B00AD2975F1B960DB59B088CB1996DACE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685294, "uuid": "30315b20-b78b-486e-90a2-79e95744d327", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685294, "uuid": "a6a38e2f-26d7-4b8a-af54-1917fe2d8c75", "value": "98304:6ozU43Lnfu+H6+4q4vw0goMAVq4qp82Sp:zZ7nfuKF4/wJsqjO2Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685294, "uuid": "80b45a2a-5b20-4e2f-9d8d-8afb3d89915c", "value": 3287040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685294, "uuid": "efd0725f-28c5-4049-ae25-1e32fabc9565", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685294, "uuid": "6069daf6-4109-465f-a034-dbf5f054fc61", "value": "Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c634ec3d-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755704332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704332, "uuid": "f990a871-b21f-4218-93b7-753a84561f03", "comment": "Malware payload (Mirai)", "value": "53078e7fa894bc77f949ec789244ffc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704332, "uuid": "8aaf8f24-66e3-4677-ac35-43433ca3d2b1", "comment": "Malware payload (Mirai)", "value": "01c8c95df3b339fb67a58b5dd5710bd13eec6415e11f130f938473535a50c922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704332, "uuid": "0b0051ec-7775-4cdc-ae12-8cf41ce504f9", "comment": "Malware payload (Mirai)", "value": "064a24287a57a513bedccdd365a995b0ee3fc83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704332, "uuid": "fad87bd5-88bc-453f-b821-b75a7b08559a", "comment": "Malware payload (Mirai)", "value": "4f2808cd4fbcb5031b35efea2d64096c5e5eef37343017f4b183b05437971fe64a1f0b6686d974fd8e121a56872434db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704332, "uuid": "7f0e98ec-ff03-4407-8ef7-1b10494a7ba7", "value": "T161E31A45FC909F26C6D622BBFF4E428D372A1768D3EE720389255F24378A95B0E77142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704332, "uuid": "95987514-c75e-40e7-a97e-5d0c96827ea2", "value": "1536:gclzTSDOofd0Kxgkhyf/SonDIj7rfPEKEWADrkWTDbzpkfVOlwtWWRNXil9Fwyws:lTXofdQIYZK7bVAsWTzWhY6RcIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704332, "uuid": "020a57bc-b9aa-48a0-acf4-52c3fca5b709", "value": 154272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704332, "uuid": "31fea637-5d20-48d3-a4b3-9ea81317f99c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704332, "uuid": "f4b7b9f8-7100-4735-8d56-6c2eb8692b06", "value": "garm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ab93bb-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686374, "uuid": "ac93b3a7-2db5-4286-9847-824150809899", "comment": "Malware payload", "value": "32481702c53b0f908516cc9ee79181a3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686374, "uuid": "c6767433-4509-46b8-aee9-2ef2223b142d", "comment": "Malware payload", "value": "020a1ae4cf3a27f755e18912d8dc869864778eaeb595dd18c44b182337aa99a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686374, "uuid": "1c2675a7-1537-409b-a0a4-2c9bb4787af5", "comment": "Malware payload", "value": "35892aa9f89c561d4e6f5c72db9c984449efd804", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686374, "uuid": "58f759c0-defa-4567-9dfc-05668d25dac7", "comment": "Malware payload", "value": "1f4181351fefb083a2cba1da432a428e9171aa0e251282f0784871274d9ac48eed1d2d914f830e74e27c08571cf8436a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686374, "uuid": "f8c63112-49dd-4a22-9fef-1b6af33eabd8", "value": "T140627350A541C6765D3342E1A36DB826F7AA0007B238E190F4EF9B012F35AA79177FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686374, "uuid": "467616ce-ea88-459f-beeb-e12bd49f5cf2", "value": "192:q2lqbWoBij9wKm1poB6ZK/MMnNEEWlx/ycO9r0aDqiZsrkMrZcf+SS:q2sZ4RzhIX0ihUAGekD+SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686374, "uuid": "2baf9d7b-1c00-4541-8441-2c928d0ac92a", "value": 15188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686374, "uuid": "8fac4b6d-7511-4587-8b1e-3fc9b1c21b44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686374, "uuid": "3cba1873-5dbb-48ae-82f9-1c793b666872", "value": "020a1ae4cf3a27f755e18912d8dc869864778eaeb595dd18c44b182337aa99a9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb011254-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686382, "uuid": "c1fc052c-dc60-4f82-9036-29aa52146361", "comment": "Malware payload", "value": "478134cf400d68d573fb32ebc481dc2a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686382, "uuid": "bbd1d650-4ea1-4080-ad94-0482b5493f81", "comment": "Malware payload", "value": "0250456ebe27e5b3ccd93bf7fecff8382c7fc809feb5ab5b7d0e2b1b822c4614", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686382, "uuid": "82d108fb-33f5-458c-aecb-647fa906b1c3", "comment": "Malware payload", "value": "b3b7af371889a59a22e61ce7c47b8c1ac4077a36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686382, "uuid": "47dd317d-1ea3-419a-8942-73756ff4b89f", "comment": "Malware payload", "value": "614eb31b75946fef7db7629bd49aaa50cb674cd3489a2201b7da90705ca83464464d24ff7db8cf3170a1ab2a6d24f077", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686382, "uuid": "5cfd5089-c985-4058-af72-48ea1db82048", "value": "T166A279428D0785E259324260A77AF0B1E6B64373F3E8D052B0FE5B049B64D917E7EAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686382, "uuid": "94c531d7-3649-4490-ad99-789654a01740", "value": "384:sZDzM+b5YNY7YIEgMgZnawlwu6Dam5eO75gdCiIk141LHAv3cBc8+la:L+maI2cMvKacee6dCsiAv3DFla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686382, "uuid": "459029d0-0839-4d97-9593-addf26b12bc1", "value": 23170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686382, "uuid": "66a00a31-eec8-4029-a5fa-6f4a5d42e713", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686382, "uuid": "6da7f252-8638-4398-8703-17a5f8e16c02", "value": "0250456ebe27e5b3ccd93bf7fecff8382c7fc809feb5ab5b7d0e2b1b822c4614.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8899f9a3-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698645, "uuid": "d294379a-9d0c-4c71-8233-64ad4bdd0d3f", "comment": "Malware payload", "value": "6ac3b5796f8a6d750da6422ebe76e8b8", "object_relation": "md5", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698645, "uuid": "63ad63b5-09ed-4b3d-8a32-c0c80b47d37f", "comment": "Malware payload", "value": "02f0ecb223134f59bbfbb08bc5400b7a223d817bc8e9b4e9aefee5cad4c34f94", "object_relation": "sha256", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698645, "uuid": "aec296ae-2693-4260-83b4-87100840ebf0", "comment": "Malware payload", "value": "5e80c161a2970c65bd6cd3631f608f10c3e6f02a", "object_relation": "sha1", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698645, "uuid": "7ea436a3-35aa-4711-9b8e-5399d44966dc", "comment": "Malware payload", "value": "15578c386ed8f2658041a1e8aa5f6545c7c424157d95d152b4186248270bbfd5609753b4fbf4f02eee2a7c93d3569f6f", "object_relation": "sha3-384", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698645, "uuid": "9ee24401-19fd-4cb6-b073-6b009e567710", "value": "T187B423D176DAC96FBA4080E60B45B5283A1F93D89DEC233C933634B755B09635F3A5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698645, "uuid": "c4a1993e-7bf8-4e8f-b25a-20ceb3d939ab", "value": "12288:v/sS6vZE3lmAdm+fVHKXkUJWIaUqRmmONajylY7899cBjW43LkKCHYHk:Hsju3sAEmKXkUJWh5RmRajyOBW47C4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698645, "uuid": "06d7ee2f-b33a-42f3-9a7b-219f9825f906", "value": 537562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698645, "uuid": "2e864722-eeef-4fac-867a-d10ba5d841a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698645, "uuid": "0ab62fc9-34ab-488c-9b00-539642dbe894", "value": "02f0ecb223134f59bbfbb08bc5400b7a223d817bc8e9b4e9aefee5cad4c34f94.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa00b8c9-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679508, "uuid": "b04b25eb-d938-4f5d-a928-68afc998ae27", "comment": "Malware payload", "value": "d8b77953408d657fbdc6182e0ce5452a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679508, "uuid": "fe322bfb-266b-4550-8379-f469e2693c1d", "comment": "Malware payload", "value": "030a23e124abcdcd557eb76636b9eea92dd1ffb1bb6c2dba802c7e397c72a383", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679508, "uuid": "452c943c-2776-4d50-9096-006bc2d58320", "comment": "Malware payload", "value": "bdc3dcd1df786e6548565df2fba371a3860c50d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679508, "uuid": "bacc383d-f0ae-4fce-99d7-5a4faa04e4e5", "comment": "Malware payload", "value": "2d517b5234f3e630afb86e96cd4e6000667a21e905d6b9a02b5c10053e3d9efdb54a85210e78ec64d5ec0be42005d65f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679508, "uuid": "6f2e4ba7-0986-4826-b952-d37572c0d4c5", "value": "T1BD51001A53E84A6BE4774B31ADF3472637B4F8209F73531E59C04258ACA07645E31FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679508, "uuid": "693a7bf7-099f-4271-bb7d-e59519646e7f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679508, "uuid": "30cd9c3f-1eed-4127-ae01-aea6c63ffabd", "value": "24:etGSwPBe5ekKC8oMv6uQYUaetkZfs7zZ0WI+ycuZhNoakS0PNnq:6/skuoMi2PRJs7zZX1uloa3Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679508, "uuid": "c4a6c86c-e19d-48bc-a23e-68fc56312c3f", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679508, "uuid": "e9e2d22c-03cb-46a8-9218-c01b3e7411c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679508, "uuid": "3ff2d3e5-cf16-4c01-88d7-49460d71f0cb", "value": "030a23e124abcdcd557eb76636b9eea92dd1ffb1bb6c2dba802c7e397c72a383.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d973e8a-7d89-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755669045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669045, "uuid": "0d3f63c6-cae5-429f-bfc4-7fde019895ad", "comment": "Malware payload (QuasarRAT)", "value": "371b681804c2ba15fa089cc9d30708f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669045, "uuid": "f21e534d-256f-4a43-b5b6-c52f8c6e9b51", "comment": "Malware payload (QuasarRAT)", "value": "03b68c79abd2161bbf2cba071d5777bd827362695f5d1a088740a239d256c45f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669045, "uuid": "52a108d6-2c8a-4f7e-afb2-b8f7617652a1", "comment": "Malware payload (QuasarRAT)", "value": "ee5b7e5cb7830be39d581ca861e9689cc9611557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669045, "uuid": "98381927-4bcb-4cdd-99da-9ce559662a38", "comment": "Malware payload (QuasarRAT)", "value": "8259109487597055991aef5c346b460cff398afc93dd853630a1ae7b2bab59332772d28d20a3f12b9de4c0e634066ab4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669045, "uuid": "c7c4f4b6-6d10-4f0e-9b0c-170386941e8b", "value": "T17007AE02ABE88F2AD0BE47B1A47150145BF1EC966756DA49358CF1BA2B337007B1637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669045, "uuid": "76b4b320-5335-45e7-afbf-c96c4d70c782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669045, "uuid": "27f1e815-7813-4009-811f-36e71281e70e", "value": "196608:efgZ6VZYY6QqOyjr2LF3Ye6YmnwqdU142Ua4jzy8DLt:2TVZYY1cjSLFoBYmn5U1P+TDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755669045, "uuid": "bc821f45-d367-4084-b0f9-96d09ce69e14", "value": 18224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755669045, "uuid": "aa7ad50c-c789-4adf-824e-79d2ff574b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669045, "uuid": "e7d1b1eb-2a13-4bc8-9ae4-525b1165d5e1", "value": "free bobux 100_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581685d5-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755703288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703288, "uuid": "faf01989-a947-4462-84b3-71c80363f1e1", "comment": "Malware payload", "value": "f612992dcf273feba592ebe231ddb9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703288, "uuid": "b2d9e4f7-778a-4f53-a312-d48612634ed2", "comment": "Malware payload", "value": "040570be620da2c9a902e03b11de64c75d85ffd37ee6ae1d504e6144d6ade483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703288, "uuid": "c0601b1e-6d2d-4e60-bbdb-9fb75f600ae8", "comment": "Malware payload", "value": "2e2f1b6b4d0bb83578f42db737c3ed86e01ce9c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703288, "uuid": "532ab2e2-ab90-4bd9-8467-001a90f60819", "comment": "Malware payload", "value": "d6f100a3b659980ca6d59e4cbdb0e96ef214c7041580f1c1ec6d08b796be0ea5c20d333438d913557274861de05d706a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703288, "uuid": "7f5659d9-f78b-4405-93bf-ef9d3ee6441c", "value": "T116452242B1C390B3F99B20702778D7398D3DF9629B604DEB51A8967947B1AD01336B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703288, "uuid": "08c1c399-5f6a-4579-80a1-4d7d73c23508", "value": "3c7d0a90ea0533d0f2b017cc2c74a94e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703288, "uuid": "2ce2c686-29b1-4d5b-8c20-0a5d82613af5", "value": "24576:vrqlEB5IOR8Wf3pEwv3OxvyyFX4wanu8U7CKratIt:jtyWf3SVd4wau8wxaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703288, "uuid": "4d07c07e-205a-4ae9-b9ea-0b8aef890f2c", "value": 1248808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703288, "uuid": "375a3ece-6a9d-4a2e-a511-88f6e8484a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703288, "uuid": "a75cf8e2-aa42-4258-800c-5cc7ff2b6132", "value": "AUjCn3t.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac98b63e-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723187, "uuid": "937bc4a8-c90c-4d61-82b1-d1cb88211b22", "comment": "Malware payload", "value": "78835454537e7cfa97c58e51aff33c26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723187, "uuid": "aff30070-ee58-427a-82ca-241a30e59abc", "comment": "Malware payload", "value": "0409cb65962392238b90956141b4147fbfc8eccd6dca0243d52a9a14dc823016", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723187, "uuid": "bf7729ab-d6ac-4b2f-b123-a581acedc648", "comment": "Malware payload", "value": "42a18bff9a013249a2977cb65981d6947c7e03ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723187, "uuid": "e42b3a78-5c8e-4286-9fdb-2909691cbc3f", "comment": "Malware payload", "value": "ae17e82bd9df9309f71b30313d7ea3f5aa0f714fa9344af4503bcf2ebe463eabe3a4d799a4cc940f9d793a1cc3fbf662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723187, "uuid": "8b5c7d71-5a15-422c-91bb-47cc0766adc7", "value": "T1D2D59E1EA5A705A8C5B2D93C813A9357E371B00D1B7486F732D845A92EA3DEC5F39F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723187, "uuid": "84c18bdc-44cf-46c8-a1ae-2e1db8dc3e17", "value": "61a3e7f4e4bc592c2a7decc9b09ec7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723187, "uuid": "391f0b16-790a-4993-9301-d41f836b272e", "value": "49152:gqid3yxF8mahs31jMEf1KTuU11G0V6Nu2uc+60mS55znvF1zdbFf4wQfz72I6:ik8BhkYV6Nu2uc+60mS59F1zdbZ4fv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723187, "uuid": "50633d4c-742e-4665-b7d1-32589c0e97e4", "value": 2914304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723187, "uuid": "19d46c00-81b2-4cf9-9f44-2899b48f4ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723187, "uuid": "0ed82d47-b1e3-4ab3-8338-c89bddabae17", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d34be1-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755703179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703179, "uuid": "4c0ae182-a190-4db6-8af3-099f83bb9cbd", "comment": "Malware payload (GCleaner)", "value": "cc36da35f070a8d624b1dee90fd38046", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703179, "uuid": "6bfc925e-00ac-4021-990c-157abe62da53", "comment": "Malware payload (GCleaner)", "value": "04651b5ea2f5abd76dfffd4630d54ca23bf2a3c30f53e4ccc213f0f669b7e834", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703179, "uuid": "2c3db494-3d47-41fe-9a4f-f09cafae3553", "comment": "Malware payload (GCleaner)", "value": "ae5e74a6edac95b1249a53d7508a9d5bce89175d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703179, "uuid": "a664c2b4-f2b7-4977-9769-4e2c4b48a82d", "comment": "Malware payload (GCleaner)", "value": "8fbf8a60193c94660fd23282127774d2503539fac914992886257ae0160a8761672ffc01750f91457d9fcbf59a966b84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703179, "uuid": "fffe8ff1-c730-4b9a-9c6a-7d867088370d", "value": "T18E06F166F25044BFE80141FEFD7BCAA2E1E254A1AB07394D2BB81FDC932831D7C59256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703179, "uuid": "c121a53d-0789-46e9-850b-cf0898e4fe56", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703179, "uuid": "707a4f00-99f3-46cb-a5b0-3c5bf7c6d209", "value": "98304:WMUQpJsCj75u9OLIqH+5k2eacdxftFE3tdoeC04:W4sid+5k3ftUnC04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703179, "uuid": "a71aacc8-9efc-439c-a373-1db1110c65af", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703179, "uuid": "5187c254-e7cc-4b60-9763-656f4f1459fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703179, "uuid": "23c7f201-63b1-4bd9-ade0-0920ba3bad66", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.12995.14474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e8c07e-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755692608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692608, "uuid": "335e46a4-cf7d-4b58-b804-0c55d37be463", "comment": "Malware payload (GCleaner)", "value": "ada31b3b06c23a13f9e5d6f520b1b539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692608, "uuid": "546ce9df-6cca-49c5-b8d0-905096f678d3", "comment": "Malware payload (GCleaner)", "value": "050f2713c672fef785c006ad7243e5ed913fa5a396cb2739f0ceaf1ddadadaa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692608, "uuid": "76ec7313-4b91-4dd5-9864-7d36de214990", "comment": "Malware payload (GCleaner)", "value": "3a854191c03120d862714f6458910fa25c892c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692608, "uuid": "bc317244-396c-423c-9a95-8d96699e2ba1", "comment": "Malware payload (GCleaner)", "value": "f94def970d159fcfde4a92fc601efc7be9a827402bbf2c1d524f87cc1ae80dadf10f9fcab9eba4f6313206d4bf2e8c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692608, "uuid": "ca76a64f-f7ce-4237-a787-a3a1850841d6", "value": "T16E06F1251169023AC2652E36DCB583289AF4352FA8E7E64D8784CF073FD923D796D27C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692608, "uuid": "f4d8dfbc-a71a-4596-b5ce-3ace0a2fb720", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692608, "uuid": "fa9518a2-fd42-4216-98a5-c643363a3049", "value": "49152:rME5gKdKXyw6CZP5fAAz5yQPyV/fEtyfa+hatTLpS1dStNr2tY5uOPenR0O9H:rMULNpCZdA267iTw1KD69H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692608, "uuid": "45686e7f-ac2b-41b3-bc5a-f4abda7c12d1", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692608, "uuid": "b50fca19-2ffc-408f-9d08-18f6a254e449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692608, "uuid": "7b617d9e-d316-4d12-9fa7-a054fade72c8", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.10945.8420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a984acb-7dcd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755698085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698085, "uuid": "065e5fb0-1310-4cae-b728-556e0a242f24", "comment": "Malware payload (Mirai)", "value": "5c96719e2277e45c51ff7e0391fc1bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698085, "uuid": "03e7264e-5ce2-45a1-a591-053b96d880e3", "comment": "Malware payload (Mirai)", "value": "051a9dfe1c2b39dd6bc50c861875c4b772177e5298642c823cd90c28c2c7ca3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698085, "uuid": "8a3d05c4-2b8c-4346-8d9d-80950cf1286a", "comment": "Malware payload (Mirai)", "value": "7e8c4b7568b802cfdb01dfd047a8e2ce84615d0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698085, "uuid": "9a6c1636-bd7f-4d0a-946d-17572e41978d", "comment": "Malware payload (Mirai)", "value": "43a180fe3787902dfc5ec718ee81561db6e8b399c1f8d42792175b215e6e3bb1e0445164777fd01f87f3b7b9aa6867c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698085, "uuid": "24bb915e-9bef-4c81-9df2-990014284a66", "value": "T1CCB34AB7CC25AF98C115D0B4B0B18FB91F53A59582872FBE55A2C3B64083D8DF605BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698085, "uuid": "ec988d90-021b-41e3-88d6-a7a279ced004", "value": "1536:YaomQ6IS/QBAlLo9CErpxCiKtE0Fk6+XzQgKWxDUBbBsnys:YmQnSpL7Cpx0tj+XlKW5UBbEys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698085, "uuid": "64845480-7401-4aa5-a425-c0c197cf64f8", "value": 117536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698085, "uuid": "d0244d47-8ba3-4a63-a729-6d3562509917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698085, "uuid": "2d7528c0-b050-4ef5-9c76-541187d25943", "value": ".klogd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccff514d-7db0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1755685875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685875, "uuid": "4310cd42-d180-4bc3-9259-ffad037c9c4d", "comment": "Malware payload (Stealc)", "value": "bc71158a26b9d8ffbdb33209d067652f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685875, "uuid": "ecd8c141-cdac-4776-8f22-c219da6319cd", "comment": "Malware payload (Stealc)", "value": "06485fcb5de0e4c125f1fcefc0dc6d4a0ddb41058c85393e7ee39bb6fbb35a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685875, "uuid": "a02c85ce-dd28-4244-85be-017e69ec8752", "comment": "Malware payload (Stealc)", "value": "7a02150f92cf23a8aa51441c360d23c7f28b1c58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685875, "uuid": "9cc10843-3b96-4878-8272-9fd965d33fba", "comment": "Malware payload (Stealc)", "value": "7585f3003205a65b024140d1213c724671bdaef0ce925725522923494b0637b7f0a1eae0aca1b6d0f9cce640fa29f5b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685875, "uuid": "2da959de-9453-4414-a088-876ff478522c", "value": "T161168EF2764BF2DBC28E88B8D4018D239128BBF3DA04C41FEB1D3D694A17E91558AF55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685875, "uuid": "3c097abc-4411-4f51-8eec-35db3ee77b85", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685875, "uuid": "afdaf39b-b3f9-47a7-af2d-0bd06a14d7d6", "value": "98304:1ots9swSOY9zEZmd5W4m7Fx7+W42epoDW4SPbinJaWazlMm:15swCEgd5W4SiWlQgKzuaWmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685875, "uuid": "ef4800a0-fec0-4e33-b715-800260704902", "value": 4051848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685875, "uuid": "83a5e5d8-b9bf-4fe4-9c7d-c0cb9e620fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685875, "uuid": "8b679a79-af01-4461-b8ce-2ae74977898a", "value": "ssym0ukul7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef501231-7db2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755686792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686792, "uuid": "1582ba59-29fe-4560-882f-cb62c6a1fbf2", "comment": "Malware payload (RemcosRAT)", "value": "7bdbd1ba44f184c9c152d99fdbfcb3df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686792, "uuid": "0506af35-c3c6-4f21-8d83-33d6e6868435", "comment": "Malware payload (RemcosRAT)", "value": "0651046c1ed3b1ddf848ab8930a04465eb9d2dfd24f7e4922dd06737d5b3ecbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686792, "uuid": "53fa4535-e68a-4c17-8b5f-9b96e5910c70", "comment": "Malware payload (RemcosRAT)", "value": "99bc942bde6bd75001665d396ac13a3353a16d93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686792, "uuid": "ae5a5fed-337b-47fd-aef2-1d79e0a35f91", "comment": "Malware payload (RemcosRAT)", "value": "b15a5892507aab7b9fde41a7b36ece3edbc29c5877f831d1f363b55bff6df333c709747c2bd23b724ad61e6a95719415", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686792, "uuid": "0a15dc1c-d324-4877-b179-c70d24beb13b", "value": "T12894400A6F1560A057F7A31ABE29C204E531331FA452462739FED6446F72CC4D7BAEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686792, "uuid": "4246266b-99ab-4d6e-a611-febc8ebe9fed", "value": "768:CLvTcobxKUCzY7VjJ4VlpdCAoLvTcobxKUCzY7VjJ4VlpX:odxKwjadqdxKwjaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686792, "uuid": "fbc797fd-9c43-4515-b5bd-05eea9713b4b", "value": 410981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686792, "uuid": "1d008a55-eb8b-48e3-9a8a-593e9bd299fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686792, "uuid": "5e5a01f4-1f59-463c-ab91-6d98c126ca85", "value": "0651046c1ed3b1ddf848ab8930a04465eb9d2dfd24f7e4922dd06737d5b3ecbf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c29ab5-7dc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755696525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696525, "uuid": "40b24f31-6e62-4b59-9951-18cec873af48", "comment": "Malware payload (Mirai)", "value": "1cc29790251f272e00bd2d7a29f699f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696525, "uuid": "0a1f40a5-8a2f-4003-b909-10fbf1bedad3", "comment": "Malware payload (Mirai)", "value": "06af5011038ac1d5a9211510a799fa9973bcd7f1204e6a89dbc9b98a0f9fc674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696525, "uuid": "1d23cef7-3370-44ec-8e5c-38e7049eb969", "comment": "Malware payload (Mirai)", "value": "54dbd8f736fb142fe920552aae9315072e9f8429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696525, "uuid": "905c694a-567d-4933-b5cb-c589ea1b93db", "comment": "Malware payload (Mirai)", "value": "6d3400394fce2a6c00a8f81531cec49c2752ec585368b6fc321a341849462b7cd95d3ab034383e99e62c470a370a35c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696525, "uuid": "131c7f43-ac59-4a58-821a-2446b641a4a1", "value": "T19F8302F043BD78D380A8687EC1E9C0CEB902435690BFAB6372955F75AE609C67274792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696525, "uuid": "44ccfe13-09ad-47bc-8870-e24e4186deb1", "value": "1536:QA/gpqqSrU8k51eUte2GqfeBgHb9GldQ9EqUw6OqLVzqFkCcRzWpnJq28I:fIpq7ox9Gqfxb9GzY8NOqL5qNAWpJq1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696525, "uuid": "e62b65ae-03ce-4115-9bb0-0256a074587b", "value": 85620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696525, "uuid": "2eb27310-715d-497a-b972-54e7ac5f7568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696525, "uuid": "6c2b2ddb-5c16-40f2-bd9e-3d8bbe7db8f6", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf5c80d-7d7c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755663405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663405, "uuid": "a963174a-86c3-4529-bdbf-e37623a68ff7", "comment": "Malware payload", "value": "5719b6a3b859f3aee3ff4b652b77896f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663405, "uuid": "57468697-8046-469d-8db8-abba52196619", "comment": "Malware payload", "value": "07671011ce4938a96d3a3c14d1f525734548f7fa7815199f6b30ac6fbdeb99fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663405, "uuid": "45f38bc7-1d46-4ed3-bfe0-a174afde62e3", "comment": "Malware payload", "value": "34da9f58f574742c5f8cd0fa99f99a055d8bd228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663405, "uuid": "860a714d-8d0c-4122-ba24-9beb4540c8f0", "comment": "Malware payload", "value": "06257c08b713c4c2b4d65328172dcc0818c0333934fe2f3712c2838600e3b34cebd2332eb1150e0dd1ded16526d0c655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663405, "uuid": "e2fd6416-8ade-4cc6-8c1f-f28d483a6a33", "value": "T15FB3039D36E071DECB67D8729F986C6CEA557477831B4203A02306ADDA0D887CF643B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663405, "uuid": "0425344f-6a99-4947-81ca-953abc687d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663405, "uuid": "d1ab35d7-e465-409e-8990-373a5a92eb44", "value": "3072:Cweoe4gBj1bMvD2noO7ImVmJVQzpzHvmLv:EggXbkD2noO7ImVmJVQzpzHvmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755663405, "uuid": "ab99338d-801b-4416-bd26-a9f724893fc2", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755663405, "uuid": "a76dfe49-9a8a-4d81-a33e-922dd28f129f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663405, "uuid": "e6071a5b-b192-4a21-883d-eb3cafd039d9", "value": "SecuriteInfo.com.Win32.MalwareX-gen.24849246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb154e4-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755648726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648726, "uuid": "d2c252f6-381e-49d4-8b37-ebf527de72dc", "comment": "Malware payload (LummaStealer)", "value": "47028aec0695b58dab7666eaabeb3f2a", "object_relation": "md5", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648726, "uuid": "79d73d4d-6c5b-4e62-a8ba-a5ec02bdfa1d", "comment": "Malware payload (LummaStealer)", "value": "081859209bc53ea77b8cabc3723c30933dc66dc9034fe513917477256d55e0f0", "object_relation": "sha256", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648726, "uuid": "d8c3289a-d22f-41ef-99a7-9b216dbb8cc3", "comment": "Malware payload (LummaStealer)", "value": "cd847c608cdd3e294bfdb6c35e8679e35987bfd4", "object_relation": "sha1", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648726, "uuid": "1a04d8ea-200a-4d5c-ab22-7590ba3f611d", "comment": "Malware payload (LummaStealer)", "value": "e75e3f01b1c982deac742d2564db5edd9b2bccfcbca8a2be8f22a225161630c72edb0843ec7a72546921442efe1f5dc8", "object_relation": "sha3-384", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648726, "uuid": "4261b648-1c26-44d0-9deb-bd63ad5d391d", "value": "T1D745C014E839B0DAFCD74071AF765201F8327D7F4F242A9B51D896B01A5AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648726, "uuid": "1805840e-5a14-4ec9-8cf4-bfc3805bbb3a", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648726, "uuid": "9923b24a-ee3f-4e29-a0c7-3dd078d778c1", "value": "24576:6qHhP0Hccxas/JLDB5/DsWyR9kUVuG9l/v:bHhMHccxrjsRzkEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648726, "uuid": "cc15713e-da2e-4470-bd3a-24661db0533c", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648726, "uuid": "8ae0a00a-f2b1-4534-b855-e0fe2ae67305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648726, "uuid": "8e061fde-84bc-4f53-a200-38853e2f5d74", "value": "081859209bc53ea77b8cabc3723c30933dc66dc9034fe513917477256d55e0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7027928-7d84-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755666994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666994, "uuid": "565c59cd-2abb-4ccf-b595-e9fea9bfd004", "comment": "Malware payload (CoinMiner)", "value": "4a6cdce6c6fefd4cf7bee1a490812cab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666994, "uuid": "7d483dda-45d6-49ce-b5cd-f9d25bba61b0", "comment": "Malware payload (CoinMiner)", "value": "088bb775f612dbdc5d5e499fb3862e4434a01624a911e55bfaefd4ca7f654663", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666994, "uuid": "fbad8931-5428-4ab7-82fa-75f687a967e3", "comment": "Malware payload (CoinMiner)", "value": "c182d147be7a9b8a3ebbf3b8a53bba85203db07c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666994, "uuid": "20e25236-110d-43c4-a606-2db5b1453e88", "comment": "Malware payload (CoinMiner)", "value": "465ef7b69ab900d49cf1df3c501f250606ea5638e65fcf665136781d1bc924114a77497aabb0c6e138121edf2a253254", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666994, "uuid": "3e6daf98-39df-4ab4-9727-322aa8374006", "value": "T16266233008A3659EE06892FD4FD231AD7AC641DCABFC8642E1196D741CFEB3AB4C95C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666994, "uuid": "fc0d8e14-8ce5-4bd4-9217-75decc883a2b", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666994, "uuid": "88161b59-6c39-4be3-ae7d-08bb0a242770", "value": "196608:Sp0wpNIURfaa1FHWYcNmmU+7z6nMAU7Map:Sp0wpNIUvW9PCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755666994, "uuid": "4a0adb0a-0c2f-4b90-afa2-e2e4c1f5f78b", "value": 6803472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755666994, "uuid": "68447c2a-e11d-4fe3-9fde-a734acbe0eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666994, "uuid": "603e4804-e7ba-41fb-9cd8-64ae6cc9b174", "value": "SecuriteInfo.com.Win64.MalwareX-gen.97735685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289f3778-7e09-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723824, "uuid": "93aca2f8-2d7f-4175-85c0-0c636f813244", "comment": "Malware payload", "value": "118333f0f9750c0978461bf971a75890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723824, "uuid": "e1d17add-5169-421a-899c-9c8e672b30d3", "comment": "Malware payload", "value": "089cefc34e6ca65dd817e4b7933c735f640fcf8bd02f843b64d555b587db7d33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723824, "uuid": "4a3c5b9e-d329-43f1-8a30-a09457eca63a", "comment": "Malware payload", "value": "ef081e3315be3eb401999457f6863a9d5cc09511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723824, "uuid": "a8d7d674-eebe-4522-b239-7f35413dce57", "comment": "Malware payload", "value": "7668d16d8b2c4e35bedd4f8a6dd6c1c2798f6d497d4b5f03969f8a54fc3e9dbf20eb0b6b9c033e85ae326f804594df8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723824, "uuid": "f935ea25-0742-438f-9187-b6ba52ef8c78", "value": "T112834A43BB61AFF9C154323002F74656A2AA26431AE393C7D318DD16B69031CAC5FEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723824, "uuid": "9c6e23d2-1161-4e37-8066-bad871869d83", "value": "1536:YFOFVQiaN/e0+aJdv54IjUQ+2wkS4k0/+EBtLHGuMCVvk5FLPfAlGeIjl3zI65ox:LQ5t40nrG8lk5Fkl0zIN0GuPnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723824, "uuid": "653e55ab-7acf-4f87-80d8-b801a74f9315", "value": 83612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723824, "uuid": "b7871955-b418-447f-bb18-c6282ca9dab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723824, "uuid": "a5d2d281-e3d4-49f0-a5bb-2c2ce2ccd00c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514e59cc-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1755683091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683091, "uuid": "6564ee3b-faf8-45bf-ae8d-ed2a40814a29", "comment": "Malware payload (Meterpreter)", "value": "7d469e0a5291bdbf56194a0d1d12c4c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683091, "uuid": "42010b8c-cd07-4054-bc2d-bfc9087368b0", "comment": "Malware payload (Meterpreter)", "value": "08f880ac3b7285c5600f2eab065c5a426cc2bb2528231be2e792f6e0a4ca1d03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683091, "uuid": "694a9868-ccf5-4783-b4c6-ecbb2d559518", "comment": "Malware payload (Meterpreter)", "value": "841efd1b85afec3de199fb9728a554d08ca6e3c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683091, "uuid": "a285d923-9cb6-4bb0-acc7-32dd10aa3797", "comment": "Malware payload (Meterpreter)", "value": "50344cbec37bf86a4f4418579d97994e4350987799a5a358367c60e2d9647bc8a726ffcd4609a7264a5065be1a6874cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683091, "uuid": "9d2cb32a-9dad-44e5-a0fe-3b4779cff05e", "value": "T15D245C5632A410BAE973913CC6934B1BE7B2B45A03A197CF036483BEAF1B7D1653D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683091, "uuid": "b5dd18cd-472e-4dda-b053-0acfc37a2774", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683091, "uuid": "c52de946-010f-49af-986d-409e4a056c35", "value": "3072:MzbPxvf4OWGKQ2x66J5MhlzBzWTFkWUdunnf29bSgyEM4/TGX6yjdwVoRR0+dm8c:MzpQhQpY5QBSTO1un+9bXyEhejGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683091, "uuid": "08fdd649-eef5-4bd4-84ca-abc641ce4c03", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683091, "uuid": "bd9542c1-33b6-484e-8039-8c20fb1678a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683091, "uuid": "544c406d-3bee-4ebf-94b6-8e3b3bc84877", "value": "x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e082a4fc-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698793, "uuid": "bfc0156d-38bb-4a41-8d15-4189fec216a7", "comment": "Malware payload", "value": "7f05f9a0801d9b71eac7aca2f688180d", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698793, "uuid": "a25da3c2-4121-4441-ad39-a904b357e53c", "comment": "Malware payload", "value": "09030a7eabea507a30b3f491876eadfc7995324764804d19351a13e3b03c0705", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698793, "uuid": "952439f2-6b0d-4058-a00e-b2157dbda8a8", "comment": "Malware payload", "value": "a7c3db7117df3df9861ab956d852d0d3f6e5a836", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698793, "uuid": "2ca15b41-6520-445b-b580-565fce5ce0a3", "comment": "Malware payload", "value": "0cce59966509228b2fdaa99dfbe13713150744b6e28865b65925652298bb8a8194cf4a40c96219d79f38d0992b2b7f9b", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698793, "uuid": "70b98c1a-c89b-4244-84f0-1125124273e5", "value": "T105C5F619FFDAAC3DF49CA478658CC130845FAE2415D28462EDCFAE5BF720A8049F195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698793, "uuid": "32de17a0-d589-465f-903f-00c8cee1b9e9", "value": "5316646cb658259867ef69d100f31589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698793, "uuid": "5b784301-c103-47cc-a490-f8d5f877c462", "value": "1536:yG84rkObizHl6KWGY5AesAnoT6K/PJ1ThMR/QVZ771tsWacd6qHoaNMeBzxTHo7j:6o9KOGY5Q6K/P7dM67t6haNMgxTHo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698793, "uuid": "8242d181-2174-4f9f-a67a-fd21456ce88d", "value": 2717792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698793, "uuid": "df740267-15fe-4c66-a4ba-86d48f295769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698793, "uuid": "f8159bff-eb47-4ffd-9046-e9c16343b25f", "value": "09030a7eabea507a30b3f491876eadfc7995324764804d19351a13e3b03c0705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6edb48-7de5-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1755708616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708616, "uuid": "1f912ae4-e9f5-4717-a483-5bd915297a92", "comment": "Malware payload (DCRat)", "value": "fe0d7a6aab8f8b99b6ade0e2a31e1796", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708616, "uuid": "08d1ae13-ba9a-4b8b-970d-906afee599fb", "comment": "Malware payload (DCRat)", "value": "09336f9e01cf88ff44bf3c9a1b54e6d69f6b4e3a390bc42e8cbe0510ee23b72c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708616, "uuid": "db5ccf36-31b5-4f8d-ae2a-f06168a94685", "comment": "Malware payload (DCRat)", "value": "5547844fa8a3a8693172e39a86d0ab60cd1a5654", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708616, "uuid": "15b25df8-b4f3-436c-862d-f1934006de59", "comment": "Malware payload (DCRat)", "value": "195da458881fb2c673831157350ccc67d3602b6b447f8ee93804f00b01a7939a20015f68831a4fe080c7e0d3e005b62b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708616, "uuid": "edaa0ed7-9646-4e0b-b0fa-b0ecc2ba5662", "value": "T1BB1533035DDB1463D9D588B5886B467BF5E9568300C6068F98CDE086FA2F61BAC7FB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708616, "uuid": "fec729b9-efb0-432d-841f-c0caef19c489", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708616, "uuid": "dd752007-ac9d-4b44-8cf6-ed719d35a453", "value": "24576:EIY/Fzp2fJdtCPR68Csb0k+0EMVC3fjqz7X:EICzkfJdtqzlIkGWYwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755708616, "uuid": "7a778d30-8474-4c40-915d-e5d48f81cee5", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755708616, "uuid": "99e6175d-aba4-49bb-8d08-d7e78060f369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708616, "uuid": "d2e4dda1-cacd-4516-90b0-febbfc09563d", "value": "fe0d7a6aab8f8b99b6ade0e2a31e1796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7759b2f0-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692603, "uuid": "7ecaa816-119e-4800-9749-36f91f51e898", "comment": "Malware payload (LummaStealer)", "value": "8693d73ec0b1ba1619b74e8936842123", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692603, "uuid": "620b252c-2a06-4804-bd49-2f1f7ed9957f", "comment": "Malware payload (LummaStealer)", "value": "099250469c23007b02b117b43e6a1b29d24944eebb4c12b0cdc553556d414ca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692603, "uuid": "9c4f9b4e-8ccb-45f8-98cc-8688e7be4671", "comment": "Malware payload (LummaStealer)", "value": "a98c63ecfaac224f1fa73bfd6081f9ed27426f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692603, "uuid": "2efe596b-a6ef-4d21-bfb4-39cba4bbb56e", "comment": "Malware payload (LummaStealer)", "value": "755daf8a693b020e3b5f6c9e743b442febc17094a58ab6b8001d067a8b0ee73761fb151afcda09fe30ff8db2c1d3d8ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692603, "uuid": "dde098b1-eb91-44ca-8997-5d978afc1e2e", "value": "T1AF45C014E839B0DAFCD74075AF765201F8327D7F4F242A9B51D896B01A1AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692603, "uuid": "c6166953-0d19-4092-9ef7-1f853a3db745", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692603, "uuid": "dc967e88-84da-4c96-81a8-437c8d917dd9", "value": "24576:6qHhP0Hccxas/JLDB5/DsWyR9kUVuG9b/v:bHhMHccxrjsRzkEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692603, "uuid": "9a9fde86-c101-4e73-96c9-d2b4083e7b2c", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692603, "uuid": "98b5e4f6-3c49-4af3-b959-f3c4d7522a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692603, "uuid": "14ec7a18-ec69-4a2d-bb65-08947ba8ab75", "value": "SecuriteInfo.com.Win64.MalwareX-gen.36134814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df82bd33-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701797, "uuid": "df2159a3-36bc-46ed-97aa-e5b1534c65cd", "comment": "Malware payload (Mirai)", "value": "c24955ed6a128ef8a81af064659cf146", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701797, "uuid": "8525216c-32a1-4caf-94b4-4b3477cbcb50", "comment": "Malware payload (Mirai)", "value": "0a31a2b27d64ebb90bd4da3d559f15d2063bded6e3a483c0ca5992e668701040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701797, "uuid": "93633545-9f68-4f82-8127-2cf0ca58fb17", "comment": "Malware payload (Mirai)", "value": "8c054d9a496ed3d0609e363be5e892eedb8382b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701797, "uuid": "9266659c-1ad5-4881-9197-772f5f228a17", "comment": "Malware payload (Mirai)", "value": "ce6c0a5991669448073a5adc40a488f322d7c3a329e70bfa3819fa9a498e020a152fc00db15ddc4086554ff724fdf5f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701797, "uuid": "8fc3e488-f347-4d86-93cd-4d730ca4d2ee", "value": "T15D230271850E8DF125303C76EAD9A39376F129B1C6673113D6290A382FB87132E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701797, "uuid": "f6cb4822-388a-403d-929d-555b7ed39b5d", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3399q3UELbUXfi6nVMQHI4vcGpvE:DECFd+A6YHAxgLRQZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701797, "uuid": "d2ca0994-9c8c-4bf6-b08e-f86620fa2927", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701797, "uuid": "29797d62-23ca-4292-9794-64889db1cd13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701797, "uuid": "b2533a13-806c-403d-9a90-fc5713099fb3", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62555f6d-7de1-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755706741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706741, "uuid": "864458ad-4e7e-4867-8767-cb379ffeeef3", "comment": "Malware payload (CoinMiner)", "value": "479ff24bdff9c00dc2f7b5f29d9f8c94", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706741, "uuid": "1b80b732-8b96-40cc-bad6-55af22052430", "comment": "Malware payload (CoinMiner)", "value": "0a78b0f552adf13c61e36acafd7f492a1bbcbd2d8414e348477ebdc5839f3333", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706741, "uuid": "920cd99d-0f29-4480-81bd-1308094be758", "comment": "Malware payload (CoinMiner)", "value": "10fce63cd8f97d27402f127d2b28fd81ef2c865c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706741, "uuid": "d3d096fb-675a-45ca-bb3e-165c3a0d304b", "comment": "Malware payload (CoinMiner)", "value": "f8cb12e5719a3afb87f3b90f27b368ccd065ebd308b6750b44731d9368c92620013e0ff96baaea36f1b380c6f8b417c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706741, "uuid": "4da5ba08-2242-461e-a71f-228d8d64bc9c", "value": "T14075F118A86990DAFCD340746F759251F433BD3BDF385A9B00E89B601657EED0A3E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706741, "uuid": "1380df67-867c-4801-a09e-dd4fdb03a329", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706741, "uuid": "84899499-ded5-438f-8464-3612618a61f7", "value": "24576:YAgGqsICddG7l/zd8UoA1deThPa7hcfQ+Avw57zOn5U3ZULVj9ifSyCxnWV:H7qpCddClkGDcfQ+A07zOmSxxiKyCxWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706741, "uuid": "3db4bddc-5fe5-4ec1-9750-43e99958d1f9", "value": 1644544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706741, "uuid": "d6823bb6-e318-48cc-90fa-d4180a5233cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706741, "uuid": "257d6dc2-a8d2-40fd-9b44-6883f575f706", "value": "SecuriteInfo.com.Win64.MalwareX-gen.34516424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355fd353-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755704089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704089, "uuid": "85e9446a-5fd5-4f83-9066-dbc7824771b7", "comment": "Malware payload", "value": "c1bf4448941fb8d246ce0c08bf61148d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704089, "uuid": "7e8206d8-57ee-44f4-991b-1ffee08b5096", "comment": "Malware payload", "value": "0a7ba70fd8044c4aaaf56a2b5507344af69385b864aea40c20432bdddc73e4ae", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704089, "uuid": "e2aa314a-16dc-4221-9d5e-532a8b092374", "comment": "Malware payload", "value": "1f35bdeee75c2829961dce5bd42413363b2d5cbf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704089, "uuid": "5149386f-9700-4ba0-8498-3570da2ce17b", "comment": "Malware payload", "value": "fb4399d10e0539788ea7efaedc28503fe217831996d4abc0c6ae5d5092d8c75e9298e3c8dfde68791965783d051716bd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704089, "uuid": "8a985951-d715-42b3-a365-6b61f4d6ddc4", "value": "T1F341E6DF5001E4626939D92FF772AFD82860CEEB3152DBD38D4D4535C68D61C7836A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704089, "uuid": "e89f05a6-5eb1-4b90-9c75-d894757b2d60", "value": "48:SnJMUnHBncynDlnlrnOwncy1n3QoHn4uN5n9+3onZUCDnOAn1/o:SphphBNz1HxYY5DpFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704089, "uuid": "864510a7-4082-4182-bdea-54c34761c055", "value": 1979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704089, "uuid": "39688c13-223d-475a-b2df-a587495c27dc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704089, "uuid": "933da6d1-9cdd-43df-9858-a67453f8a2b2", "value": "IGz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d61a303-7e13-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755728154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728154, "uuid": "0c873fbd-3f83-431a-934c-a86013d0e666", "comment": "Malware payload (XWorm)", "value": "08bbc4e8f62ba5ad38b19e139662d020", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728154, "uuid": "7a14436f-923a-4a4a-8664-52fa00558ae1", "comment": "Malware payload (XWorm)", "value": "0a828bf2b53b2d455c262ca18b32af12a94d7eee5c30be56f762505d27166e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728154, "uuid": "5f8232a4-0503-4b0c-bfdd-f0c22d190b81", "comment": "Malware payload (XWorm)", "value": "f6322f45e91442575ab9b6a149d287623efe3138", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728154, "uuid": "d323d6fb-6767-47af-8b63-3c4939bd5d13", "comment": "Malware payload (XWorm)", "value": "5b5d521ca7e6467195ea007bfb4daa2aa9f52126286b3f8960d3c9af30450d3e8a865198e3c682016442d41e73ca197c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728154, "uuid": "a2338c79-353d-461d-821d-935d2e7e29a9", "value": "T177E24C4877A48337D6FE2BF56CF291050279E1178923DF5E58D889EE7B63AC246013E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728154, "uuid": "94e69a96-771e-40ba-a4e4-8e742b1b6086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728154, "uuid": "d76010ff-4919-45cc-a468-4ad66eb2bce0", "value": "384:Z/8WqVDweYXS3ghk3wcD6LxNUiYnM2M4dm5wR+ptFFBLTiZw/W+UvK9Ikn1If4xt:RiedxNUdnM2M4o2cFz9LvOjhuZ/lv5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755728154, "uuid": "8561f86e-a99f-4d96-830d-ac66e0f8982a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755728154, "uuid": "8d6f99cb-3532-4de3-a40f-fe0f67a8f57b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728154, "uuid": "3d10b45b-be4a-4739-86cc-5e504ead68d5", "value": "08bbc4e8f62ba5ad38b19e139662d020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c869f2-7d93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755673189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673189, "uuid": "8f84ec1d-4d15-44a2-bb3d-772dc3934f79", "comment": "Malware payload (Mirai)", "value": "377f618c7459dfb7959b999ab2cec657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673189, "uuid": "46ee7cea-5776-44de-96c7-5ce5325ad1b9", "comment": "Malware payload (Mirai)", "value": "0b3d3e000092dbb340e3fbd79be11c8cdc501f11e77c517e689218b8255371de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673189, "uuid": "185edb82-15b8-4482-a842-d4ee0dc2897c", "comment": "Malware payload (Mirai)", "value": "1ea7922b0daa71cb4e481e4b8c5003cab92a959f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673189, "uuid": "20e041c1-f38d-4c68-a624-dcc4ae75451d", "comment": "Malware payload (Mirai)", "value": "53981034817cf2e0104b51235d4a9176553aa300adde059672712bea4f8f9c56ebd10f0e5cc4496a2872e7f01b989dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673189, "uuid": "d59b4f9e-b637-4955-b308-845808b8b111", "value": "T14BB34A86E713D4B2C8920BB002EB97764631FDB30766CD1AE75CFFB45A22581B05A72D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673189, "uuid": "23155da1-ea48-4941-bf67-8936d918c65d", "value": "1536:7VLDP59aTyXRzbtQoVQWKS2oBufGhHjUY31AYxzqVgIAU3frMtWUqXs3k:N3XRzba0QSBuf0KUkPAU3TM8Xs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755673189, "uuid": "237cccd4-af92-4584-ba09-01ee5773ad15", "value": 116935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755673189, "uuid": "8d38cb35-c980-418e-b648-711fd4c08bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673189, "uuid": "8377dae5-c73d-4cab-bf2f-62000c09caa2", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a47168a-7e13-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755728149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728149, "uuid": "26bc4770-7d04-4931-9006-a7e441e5d435", "comment": "Malware payload (Gafgyt)", "value": "f8a462668fd12a3d47cd7a8ec000d439", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728149, "uuid": "194e7629-8b92-496d-bbf8-7b19a07bee0e", "comment": "Malware payload (Gafgyt)", "value": "0c21ff32037f1cbc57ddd022751a7a7eda4ab8ee4bdd7897314d3943938c24d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728149, "uuid": "fb24dd7f-d36a-4119-94ac-6ed6f9946ad5", "comment": "Malware payload (Gafgyt)", "value": "a4c62e38a17aec299fba689b43c0598b135e805a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728149, "uuid": "b725cf2c-544b-4ac8-a2f8-cafd8b5c9237", "comment": "Malware payload (Gafgyt)", "value": "844d1022c85aae56fc42d1252ae37c211216e989350743e24cd2c56dd7b18bbe9500d7d4fe62ec9049039395641fef02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728149, "uuid": "7b51040a-0c16-44c1-b38f-b9eac54ae7b8", "value": "T16383A70E2E618FBDF66CC73447B74E31A75933D622E1C685E29CD6011E6034E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728149, "uuid": "5ba3beec-d2d2-4aef-a346-4d4fe32181f0", "value": "1536:cBDcuVShvtYcRzZD2HjYNZkr/RsgluQCIxkE68Pq+f:cBDozZD2HY0squM68Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755728149, "uuid": "fb801038-c418-4e34-a39b-6596c2264950", "value": 85144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755728149, "uuid": "8152d098-f479-4eaa-9c8d-a055d22d9440", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728149, "uuid": "d8154bcc-eb0a-40fc-8ea1-353532991c38", "value": "SecuriteInfo.com.ELF.Mirai-AJJ.59962544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d949cd-7d64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653008, "uuid": "742bc614-1ee2-4045-a0fe-ac38c67ee55d", "comment": "Malware payload (Mirai)", "value": "44a0e367d3c9e81ae444bcfd1851322d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653008, "uuid": "88483723-794e-4874-bca2-e6e1e45b73ec", "comment": "Malware payload (Mirai)", "value": "0d7cec7cf889cf4a38f437c481f43d64e76125833f32d1ef454c013716499b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653008, "uuid": "d8e379f0-c4d5-4839-a9ae-5fd6b3b2ffe8", "comment": "Malware payload (Mirai)", "value": "460e90b8be06e20e0d2816aea87eb7282c12fa4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653008, "uuid": "041cac43-5af7-4a8c-a21e-b7710213a239", "comment": "Malware payload (Mirai)", "value": "e3d9c7a4fdc57e56120925ea1d39c1c3006ce9e89f5b27dd72f478f6f59f613d8658c19d1f017efb9f06983366b30656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653008, "uuid": "6b9dcd72-8322-4b05-bc83-0da443e4777d", "value": "T13FE37C73E8266E98C161D470B029AFB41F5391D492875FBA69F682B05083CCDF915FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653008, "uuid": "003d4309-0211-4132-a578-ad4707089a94", "value": "3072:dXG5wXrVIJkW1nweWcAVEH/HpmHgGFWchgAXX6hh1KU+w:ddrVUPnwYAVE/mwcRXfU+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653008, "uuid": "3beca02f-92fa-4288-8dd9-02722165c994", "value": 151680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653008, "uuid": "90d1937d-7870-4b72-b24c-3ddc275e2900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653008, "uuid": "1b73ecab-49fb-41c8-bc03-d96f9efa4775", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a06eb6-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1755692835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692835, "uuid": "26c6c18b-349c-411e-a65b-2253e34dc0d1", "comment": "Malware payload (ACRStealer)", "value": "660c60f574f2e68984e20077e984a7ac", "object_relation": "md5", "Tag": [ { "name": "185-76-243-64", "colour": "#4462AF", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692835, "uuid": "eacd8ff7-4602-4f4e-8ba5-b107a21dd968", "comment": "Malware payload (ACRStealer)", "value": "0d90f202ef35a1fbe048e79eb219f9f94cb02d9f2c500eff1ed08accc9c8949c", "object_relation": "sha256", "Tag": [ { "name": "185-76-243-64", "colour": "#4462AF", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692835, "uuid": "8d806b7c-68c8-41f4-a4a4-6771a7b3fbdc", "comment": "Malware payload (ACRStealer)", "value": "9068a353ffdaff81ebbcc2976913a0555de826aa", "object_relation": "sha1", "Tag": [ { "name": "185-76-243-64", "colour": "#4462AF", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692835, "uuid": "9e1c07e7-d06e-4f52-b519-16adc5420a2b", "comment": "Malware payload (ACRStealer)", "value": "d5b8dc446cb1aac85834bcba1229c5e0c151e5681a1444d81e770e4f2d19b57a165e7beccd65e198dc0ea76aaa0a8b52", "object_relation": "sha3-384", "Tag": [ { "name": "185-76-243-64", "colour": "#4462AF", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692835, "uuid": "afeb0bd9-5db8-49ad-8094-1cecca6bd3e8", "value": "T11E56335D87D26F0EB8CCB721C1D13A2816A3722F89D0C45F6A5A74B3B8C4D4B1A6DE1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692835, "uuid": "5733ea76-f233-4e92-b972-43429cb6b103", "value": "196608:UQ0hVDx6XI3WG9e7NdO3NC7WfHkzO6Jp7QwoK:TMDx6XI3WrBqWMEzuwoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692835, "uuid": "96478f93-55f5-4ad5-93f9-feb5a1288641", "value": 6311097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692835, "uuid": "120aae52-583c-432d-9c94-a05296151cca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692835, "uuid": "ac274b1f-f345-4134-97c9-82b36b1ecad3", "value": "Setup$.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c85b12-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652599, "uuid": "8c240a44-f403-492f-8d53-cb5ae11febed", "comment": "Malware payload (Mirai)", "value": "68a0862a5383f109dd680d58ba55bba0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652599, "uuid": "a0ccea40-bf64-47fc-8f70-a03dc1215287", "comment": "Malware payload (Mirai)", "value": "0e26b1ca261552770fb6318a4813246cb678ceef63367ba616f002743af2b9a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652599, "uuid": "c97f9f19-5f6f-4b20-a847-0286af41d566", "comment": "Malware payload (Mirai)", "value": "f553dbb0f88079f488f10f7af1847aed37593729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652599, "uuid": "a51f4c33-d6cb-4884-b914-92de81d087ea", "comment": "Malware payload (Mirai)", "value": "183627bb9190d16b9f7722ee3fbc233642f6a5e84a382411469034925ef62275edd7d5569cf994227d5e25ab4be4ff4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652599, "uuid": "4073d19f-eb13-4ba0-a352-fcbd5e08e152", "value": "T1D2933B56F9818B21D6D112BAFA1E118E3313177CE2EE7212DD146F6077CB96B0E7B802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652599, "uuid": "f38c6bb0-b1b8-4f85-904d-7f086137bc66", "value": "1536:4nsnAO0Y+Y2KHICj2XrMDFmJZt0au5x8WCBD1iVfhGSgVA7pR5bY1g9N:4fOxtoI2XWyZt0aunfhGSgVAdR9dN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652599, "uuid": "56bd9c56-2544-40c5-a924-9e4f245f2689", "value": 97464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652599, "uuid": "8d0e84a9-7d8b-418a-bde2-ae076eee32a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652599, "uuid": "69e0ead1-c213-49df-8ae0-197f97caef4c", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efd6889-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755680053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680053, "uuid": "41a81dff-bbbc-4ad3-97a8-b8980518a4da", "comment": "Malware payload (DonutLoader)", "value": "8cb0b52f0ec798211c1cf9e107f648e4", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680053, "uuid": "1011f2d5-201e-4b69-a484-4d223aa472dc", "comment": "Malware payload (DonutLoader)", "value": "0efbdde038afba6085a4b7e6cb5a21b4debfaf56ffc504b8c6233d2f84fce55c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680053, "uuid": "b0ddfebd-75c3-446c-bcef-5e103cdeb57e", "comment": "Malware payload (DonutLoader)", "value": "ff82a490a5886787548abecb875c833c7fdaa1cb", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680053, "uuid": "8e4df2c4-8d19-4c25-bcf5-aa70a9a4df8a", "comment": "Malware payload (DonutLoader)", "value": "63c5d7bdecbf09befffd78e85241a26abd823bbcc6af921659812481d6322ca088d3b7e3a88557e64b01acf69c13bed6", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680053, "uuid": "d14fae0a-bec4-47f6-8d9a-f70048b77974", "value": "T129B533107F497E6E019C0329746E5A2D07688EFC549CA7DFEBF62C870A07F81C5578AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680053, "uuid": "6575782b-ed63-4f8a-9ed8-d50362833f38", "value": "24576:pPyEVAbdiXFjpfL0nY537tgnCh3b6nSpjPXhvWdxwggf8so+/10YHJz89eBSIx8Q:idcDes4o3R0iflndqirC3pq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680053, "uuid": "d4fbc652-2be0-426f-bd9a-0acc8ba6ba1e", "value": 2290183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680053, "uuid": "4831b09b-72d9-4d5e-9ab9-8d057658106d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680053, "uuid": "346bb73f-e680-4502-9ba4-b23e7ed324e8", "value": "0efbdde038afba6085a4b7e6cb5a21b4debfaf56ffc504b8c6233d2f84fce55c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877b4fd0-7def-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755712817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712817, "uuid": "03f655d8-384f-4c3c-ac65-f83c5ebd5bd2", "comment": "Malware payload (QuasarRAT)", "value": "93a36d790099b091d3865e9d58dbd5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712817, "uuid": "bc877fc1-7950-4d1b-ab83-76d31cb61480", "comment": "Malware payload (QuasarRAT)", "value": "0f05542493a3e82975a3a353d054dc66a3c4b8de9bb7eed12e3b53de5614171c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712817, "uuid": "ec2dd3eb-daad-4e15-a184-ca3ae0ec1b46", "comment": "Malware payload (QuasarRAT)", "value": "161709824c79798948eec218417b11c92c7c2b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712817, "uuid": "778066ac-4236-4b6c-b242-b10d871d03d2", "comment": "Malware payload (QuasarRAT)", "value": "06e31dfa69515bec155f73a3457bb8f8a106ab0a406398a6358a538eec6f2e480d4aa424e045addac8b6d74f515650e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712817, "uuid": "ae53596c-5c40-4456-845e-e7c89572bdcd", "value": "T1ADE56B0437F85E72E16BE6B7D5B1501263F0F82AF363EB1B6581A77A1C53B4088426B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712817, "uuid": "74ac999b-725e-4b48-8349-b8a97a3fb28b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712817, "uuid": "864f8e4a-47b8-45b7-8b31-f2644880add3", "value": "49152:2vkt62XlaSFNWPjljiFa2RoUYIuEi8oGd7OOPTHHB72eh2NT:2v462XlaSFNWPjljiFXRoUYIuEHrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712817, "uuid": "79c9a476-2d9e-4618-9e51-f2a7cbce3063", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712817, "uuid": "42a91e64-1127-43e3-8a50-bf34979a463a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712817, "uuid": "28a812d0-378c-4d79-800d-4d5337bfb18e", "value": "Info.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c729ad95-7d9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677275, "uuid": "35c9f407-d0a8-4b69-b49a-163156692666", "comment": "Malware payload (Mirai)", "value": "2bb1408f6cd053afb17a550946097a20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677275, "uuid": "d3d3cd61-13ac-4370-8aa9-b2369f44af56", "comment": "Malware payload (Mirai)", "value": "0f2a99cd60f151bf72ef0d29830de90affebf31bc422b48332fd5ef7e4b27fa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677275, "uuid": "c290d29a-8f9b-4971-8a9f-d0b1b2a46b4a", "comment": "Malware payload (Mirai)", "value": "ad259e7d9754ca3dd47119906e7226db86633459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677275, "uuid": "4febdd57-e81b-462c-bd5c-6f16bc17c522", "comment": "Malware payload (Mirai)", "value": "67f663729f37b3a9fb5e6f682a75476e770a21db1432f15824de3a90dd4207944d9889460e2981795adc83d93b3c6ed0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677275, "uuid": "82539510-4881-4eaf-89db-a969d2ab1b38", "value": "T156F34C46EB814A13C0D1177ABAEF42453332A76493DB73069D28BFB43F46B9E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677275, "uuid": "a6d2329b-a87b-4c84-a207-ff36b653721d", "value": "3072:B1IXufZd6NHK2PleaOxBW/L70eSRy6UD+RyxtZymGrSFAuZM/9oUSoVxIVE8W:B1ISZd6NHn9eaOxBW/UeSREayxtZymGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677275, "uuid": "b43a832d-5ea7-49ed-82f5-f10401447837", "value": 168155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677275, "uuid": "e885805c-0f62-41f7-8606-37e254625028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677275, "uuid": "d6ef1254-7a8b-43a9-85cd-51cafcc9f32a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0f7d10-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (OdysseyStealer)", "timestamp": 1755695480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695480, "uuid": "6b9f8be3-589c-4885-b38d-abbb991da5fe", "comment": "Malware payload (OdysseyStealer)", "value": "857a0c3544e1215a76271b8dc393ead3", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695480, "uuid": "2c7aa4f7-b1ed-4dd9-ae45-3e68b52312e9", "comment": "Malware payload (OdysseyStealer)", "value": "0f66ab3281d4e92f3b85e839b1f3065e7f4117f15b2feba087504350865dae88", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695480, "uuid": "2e717521-8a75-4bcd-90b9-c25ea5cdcf41", "comment": "Malware payload (OdysseyStealer)", "value": "80ac743349afc71c1ccce5a931d9698fb9af80cf", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695480, "uuid": "5ee79792-0b11-4002-b464-db4f66a8c88e", "comment": "Malware payload (OdysseyStealer)", "value": "3350c22038dc08d50b93615c9bb63a12b8f8511bc6969af5ef615a2e762abc37029ba18b78f61dbd168836dfa0b71600", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695480, "uuid": "7cc46cab-ffe6-4b54-8232-29bc70187683", "value": "T192F3F862D7881110C13DA37D6A97AB09E172FA52D394E2B2F735504DDFB52336A23EE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695480, "uuid": "07f18a81-30d6-4fcc-b6db-3569cde37f08", "value": "3072:6v63WRp/12DtfCCgTzevaIr+Td3sJ1UWIp4y:ynsJKWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695480, "uuid": "8a929014-2486-4b6b-afb1-bea06188d7dc", "value": 160080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695480, "uuid": "e6b45ef0-94a9-4680-aebd-5e71a6607885", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695480, "uuid": "02ab6c89-b629-474d-b08a-fbfc907f09f1", "value": "Ledger Live", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff979e8d-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1755693261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693261, "uuid": "ef5df255-b8aa-447b-b4a5-8fefe547fc21", "comment": "Malware payload (Formbook)", "value": "9ac6847453af1e7ae25c2356e17ee0df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693261, "uuid": "f1caada9-7380-4f88-8d44-9a951468cc50", "comment": "Malware payload (Formbook)", "value": "0faf94a24b00a7dca3cb0e26b29b0c3f72f66e2f968d997ad45e74620efeb11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693261, "uuid": "f1a0d1e9-0168-4f3b-93d0-24067f44f1b6", "comment": "Malware payload (Formbook)", "value": "4f1a7e7d55aa5c309f95fce6b5630c275a44d82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693261, "uuid": "ea889719-73fb-4166-84a7-82e2752f754b", "comment": "Malware payload (Formbook)", "value": "9d473a84ce418937f0b49115beb120aef0a0a161618521773e787a8822cd1f0fa39e3784a79f9eb6d6369c6720380c21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693261, "uuid": "dd48d7b9-9cc4-487e-ba7e-276ea886c178", "value": "T1EA45BF027391D062FF9B92334B5AF6115BBC79260123A62F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693261, "uuid": "bbf18da1-3fae-4450-bbc6-810d0d203896", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693261, "uuid": "3b3ab553-389e-44ea-bad6-ec06858db8b8", "value": "24576:25EmXFtKaL4/oFe5T9yyXYfP1ijXdaqJi8KBFjFnej/z4gjwxLdk/:2PVt/LZeJbInQRaqJi8KBbejvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693261, "uuid": "ec1b4485-b1ba-4120-88e0-ad1eb3c5961b", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693261, "uuid": "b4316b39-a3fc-4a86-aed4-d3444585eef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693261, "uuid": "4fb20c4f-1f87-4a9a-8a86-33054ff7557c", "value": "order107.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a5968c-7de1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706591, "uuid": "5f0d56f5-545d-4a23-9801-b437fca43ce9", "comment": "Malware payload", "value": "3445d04091fae031ec283a70613fb0df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706591, "uuid": "4c96aebb-9734-4655-b4c0-f8f432398b14", "comment": "Malware payload", "value": "10145c553c7193e61e8909c1f3c569d08422cd31d30b2f0a50475139b2a1d05c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706591, "uuid": "720c744f-94e5-448d-bf59-306894a881a8", "comment": "Malware payload", "value": "1a322aa41744179c419f2e0b26d2904140dbe6bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706591, "uuid": "f4a7da4e-2b22-4fe5-b1ad-804facfc2521", "comment": "Malware payload", "value": "bfd385d0c8672c909027b1e949d6935064a66e4d9a35ab89fe14bc1511516f79b27871b055038bb1ad62e71da4a6802a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706591, "uuid": "737c623d-5d2f-4ac7-a3ee-3ccf9e712f9a", "value": "T1F93549ED32C27369D2C8C93296FBEE370B14483542CD5B5EE9691BDA4C62F19C393099", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706591, "uuid": "2aa80858-c651-40d8-a6c1-2da170dba3d2", "value": "f62446195b92b4d12089a2ee58e20ffa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706591, "uuid": "73943b52-c1e1-4b4d-b194-f00dc260479e", "value": "24576:DR66T4WQyhBqPqoc+d/ZWoR9HkmjwrsZ07H262ooa7q4F31LT//m31gwW36OHH06:DJJiEP2dNex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706591, "uuid": "17d405f9-0cc6-4df4-8477-b0df26f29ee4", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706591, "uuid": "a2d2e69a-36a3-4ead-8e6d-40bbe6b81cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706591, "uuid": "416b1489-d696-43ea-80a3-6dcd37ecece0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fce7c64-7dbb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755690389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690389, "uuid": "dab00d65-533b-4a7f-8008-b0b28b8c913f", "comment": "Malware payload", "value": "1ded71930d997de43a68e098d232e2e5", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690389, "uuid": "8d80fedb-4f41-4f9c-a0bc-12de13c9a0f9", "comment": "Malware payload", "value": "10b54abba525686869c9da223250f70270a742b1a056424c943cfc438c40cc50", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690389, "uuid": "509f2618-399e-4359-adf8-44f6c4d7e872", "comment": "Malware payload", "value": "8cbd09508dd727ba27fe6ba56be1b81fae03ec4b", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690389, "uuid": "dc45435e-4609-4550-b8b7-22464a8b9aac", "comment": "Malware payload", "value": "048c0bcefba2b1a4812ad5514fcc29a83f2ececb1bc6e4adb5148de4780064f3d11130a23004613e450ec1bb33ae2271", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "desktop", "colour": "#940FE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690389, "uuid": "8f3426cd-7cc1-4da3-84e9-ce2b58501f8e", "value": "T1DA5412D03A7478C9919C4F53E9AFFB2C97160FA3054A7A9F429C61C307E6B4126A7C4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690389, "uuid": "d1083a4d-775d-482e-8f0f-626107fef369", "value": "6144:1BGMNfaVgahUovlKEREZUq764UqGOkQaKeIs0Wypo:xNchQNU8NJRI05o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755690389, "uuid": "88f4c0dd-728b-4c6e-88e2-e24a52024104", "value": 284727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755690389, "uuid": "1d94116b-42cc-497e-81ae-d8bd85353ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690389, "uuid": "43ea595a-e49a-43a4-b3b5-312c391d025d", "value": "Meeting_Notice_dtd_20_Aug.desktop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c4291a-7d64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653142, "uuid": "09a6910b-22d5-4966-9384-0a7fbfe6b3b8", "comment": "Malware payload (Mirai)", "value": "df624fa0286f5af38bc5adc1aa0d5182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653142, "uuid": "0481dd24-d34f-497e-bd5a-728e1279b45c", "comment": "Malware payload (Mirai)", "value": "1112d1e433a2b844d31ec9aefdb8b22419b8269bce3dfc08ec8f14390d6aa82c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653142, "uuid": "9b852fc5-3ce4-4849-ba50-52c706bb4d38", "comment": "Malware payload (Mirai)", "value": "f63633dbb47dfe7c95be61c4dc8d858c4abd6ee3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653142, "uuid": "69d17e71-7b52-408f-9955-ef073c20f239", "comment": "Malware payload (Mirai)", "value": "eea405103c6931ea9e86fb58a35826a2427795636fc57c2c07bcaae379a29c1e9ed2fa6ba9c4d749996d80c0f73b3f50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653142, "uuid": "06cfaaae-d1ac-4768-bae2-43c3897fb22b", "value": "T1C4530205DBAEE4B1CA5015318CA1DC8F4DC11FB8516DE0BF1269C23865EEE4A7AB48CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653142, "uuid": "cebad502-6da0-46dd-a946-df5702a26253", "value": "1536:54lYNnEkvHHglP7/rCwOowdzOPnbNwlayrxYeLH:CepEgglDjCbzwb2a4eeLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653142, "uuid": "ce08117f-6c08-42dd-b823-9f662ec805fe", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653142, "uuid": "1b764fbd-9881-4535-802d-b1650b0be022", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653142, "uuid": "3f006dff-9e9a-4afd-83b4-6429d8a49bf2", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bb0a32-7de9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1755710314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710314, "uuid": "866d6593-975e-4a9e-a16a-0434271992d8", "comment": "Malware payload (Vidar)", "value": "a8c0577adcd8c7ab40fb874bc4912871", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710314, "uuid": "8b023416-3c51-4c86-a515-5bdfe0f6fb17", "comment": "Malware payload (Vidar)", "value": "117878d8455c2d293489729062fbd796b28601d11e484d916ec974cacd8bb443", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710314, "uuid": "e225f2f3-36b8-46f6-8264-11d29788a088", "comment": "Malware payload (Vidar)", "value": "4b605c1a5f4e81700f1e76d624b2e0bf8733aca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710314, "uuid": "d027270d-68b6-4457-8c22-bb918fa51e5d", "comment": "Malware payload (Vidar)", "value": "db0bfecce066d141e17d91ecf08ad5f8b9e1589b3300b1956f4cbd64a518565d8df19475eda92c1ccbb36c1fea27b0ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710314, "uuid": "82d05704-bdd9-46c2-a1b8-b79dd96706f2", "value": "T14655D008A87890DAFCD340746F759251E433BD6B8F346A9B41F89B601656EED0A3F336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710314, "uuid": "1a926724-b259-4f8e-9f23-af747516bc55", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710314, "uuid": "4399abf0-5b20-4d74-b2c9-14d8e5264409", "value": "24576:cAgGqsICddG7l/zd8UoA1deThPoN7ssL04jMORJ4FR0oS2/f7j:T7qpCddClkG3sfoMO0T/p/f7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755710314, "uuid": "74b32578-ec8d-48ba-af4d-361048722c4e", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755710314, "uuid": "be3c7afa-e3f7-428b-a3f4-35caa7b2a4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710314, "uuid": "9f40e4b1-698f-4b27-abce-d2d1dd57da32", "value": "SecuriteInfo.com.Win64.MalwareX-gen.98858168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ad0ee0-7d94-11f0-91c6-42010a9c0006", "comment": "Malware payload (BQTLock)", "timestamp": 1755673614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673614, "uuid": "a7978d85-8ffa-4f7c-a2ab-e2c2cad33058", "comment": "Malware payload (BQTLock)", "value": "7170292337a894ce9a58f5b2176dfefc", "object_relation": "md5", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673614, "uuid": "0678c442-0897-4502-9aa7-b78d9b2c343c", "comment": "Malware payload (BQTLock)", "value": "11affbeb18f4d6edcc9a4be5a82f8e23dfc31178887e97119faa5ddc75990494", "object_relation": "sha256", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673614, "uuid": "3f395c28-3c62-4510-8820-f89b909ef936", "comment": "Malware payload (BQTLock)", "value": "3c8d106f63d1ed921f9b8c7d103d73cd591fe19c", "object_relation": "sha1", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673614, "uuid": "573f8fa3-75fe-4233-b4ca-ce183b3f6185", "comment": "Malware payload (BQTLock)", "value": "79942ee101f2dad72ab89b6575cb052763c881c84cbda67fe9de0ab971d1e3409404efdc7cf7cb05becce450acf36fba", "object_relation": "sha3-384", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673614, "uuid": "34a4f1b5-21fc-4218-a5ca-4b43f839830d", "value": "T12E865B7BE16710D8C5ABC174C25BB371BD30B46500347E6E2E60D7B2AF62E601E6EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673614, "uuid": "10464147-63d9-43b4-988f-183d33f5bbfa", "value": "a9276a18450928da465c2885169fcd01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673614, "uuid": "5bbe4f4f-256b-4b71-b8fd-2d27063962b5", "value": "98304:oy/aSvCkDo0fBbz6enYrqrnHKwIe1EbzcGWFxBuFEd+fB9uL:onSakkHeNXBWASU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755673614, "uuid": "46a86ce6-a860-4400-aa3c-c685ece79967", "value": 8510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755673614, "uuid": "df05593b-6f46-4444-9df1-c51b59efbadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673614, "uuid": "e0ab45da-e9fe-4695-abf3-7f95a468e219", "value": "11affbeb18f4d6edcc9a4be5a82f8e23dfc31178887e97119faa5ddc75990494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021ce988-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702285, "uuid": "1723bd64-da76-4407-b49b-0199f576716c", "comment": "Malware payload (Mirai)", "value": "c3dd5c85325bcec4070e1f8c38592385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702285, "uuid": "9da7b654-96e3-437f-a8c2-bc40dd55cdc0", "comment": "Malware payload (Mirai)", "value": "11bc0fa333db7e15b69b3c0710c753021dd6665593de2397c23c9faae6e7fa24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702285, "uuid": "ea9ca615-37e7-49f7-86f7-2b5fad712954", "comment": "Malware payload (Mirai)", "value": "8abaa3943283b4509c42339a64775a7eeb2b7ec8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702285, "uuid": "29470fa3-e308-4099-a145-7ba83524f924", "comment": "Malware payload (Mirai)", "value": "b8ccef367cf7227044fbf28f5c0092789938e187d823e278c52a8e74c6df0f2b1a585ad3d12141a08cb3462d40ae8310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702285, "uuid": "aeb9e8e2-bc12-4e3d-8d73-e03c1c1967f7", "value": "T187D2E1D486020DF9ED35C5F643FB8B102A324FD69117EE4A1276AF57CE484A97C43AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702285, "uuid": "03dd0a77-894e-4b76-a860-117fd90114e3", "value": "768:/sndLdQJm52kuN83gYh7vRUc8TSRQAeRfS+AJgGlzDpbuR1JN:0dB4mkkuN8QYh7v+4R+JSpVJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702285, "uuid": "3fb0dc3f-c56f-4dd8-aa31-052ec592f9dc", "value": 30816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702285, "uuid": "bb9fae70-c9e9-4e17-8cec-57d84bf98a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702285, "uuid": "a2a8ee1c-b7e2-4bb5-8ff9-afa556257737", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be017a57-7dc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755696587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696587, "uuid": "5290eacd-270b-42ce-876a-8f564aa458e0", "comment": "Malware payload (Mirai)", "value": "45c40e7feee1740e573b32b3ead49415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696587, "uuid": "9fe3c825-bd19-4620-b780-866e525e534b", "comment": "Malware payload (Mirai)", "value": "125ffb83bd6a0f86c251765b91f683e4fba45833de363b2f3d51d4d9a13d7ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696587, "uuid": "3ca72866-cf44-4bfc-ac0c-6bbdb52e3e3a", "comment": "Malware payload (Mirai)", "value": "a45c98b8b3e42c1f16aedfe2979d68a9f2c5416b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696587, "uuid": "9651f958-9304-42aa-b419-4c9e56502715", "comment": "Malware payload (Mirai)", "value": "11ba8149068bea7790ccbf2d2937048922c184adb464bc95d2a9bf5b83e404810c426977ea3da6a3b2b70f4367c0070e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696587, "uuid": "6e7e3102-a379-416f-aa32-1b8f2a1d404d", "value": "T162344B42EA414F13C0D717B9F69F5246333397A593D77306AA24AFB43B8679E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696587, "uuid": "4f5b023c-5503-4ade-959c-83f347322c17", "value": "6144:o/o2n+W4tEGl5PSB5/lyaa6Vc181BvzZZWcdB7/8DhM/RpIm32Wdac3f:Eo6+W4tEGlgrlyaaIc181B1VdBgDK/f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696587, "uuid": "47e97c6d-48a7-4950-a74f-28ad328a88b7", "value": 245312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696587, "uuid": "cbea6509-c98e-4a01-b9ec-6bca3ff3da58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696587, "uuid": "6acdc6af-e6f8-4783-9a01-3661a99d0d0b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a17853d-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755693064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693064, "uuid": "30cefbab-9f82-45cd-9ff6-f8ca519585c9", "comment": "Malware payload (XWorm)", "value": "34876a9697f92cc1c159053d5a670e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693064, "uuid": "c57eec05-7d77-4074-bf9f-855b45181f4a", "comment": "Malware payload (XWorm)", "value": "14e1e45700c823b5b6ee2d45bafb8a4c57a79cdd115199592894ed3b88b21fed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693064, "uuid": "c59895eb-0d57-4d8c-b538-276f054be033", "comment": "Malware payload (XWorm)", "value": "2b4fc28b2083396cd61ed0b46cb10f25b448dcbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693064, "uuid": "06ae469e-e85a-4959-b402-0f95d0a31eb6", "comment": "Malware payload (XWorm)", "value": "e504edc6e5112a21eb7f74d2a9ee98518a9f727101afd86a1f64c8cc94877768a183500b71ef04e4525b67911e74523c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693064, "uuid": "ff307701-7ff7-48d8-8b11-c59907212f1b", "value": "T104C412601116EA05C4AB2BB048B2C3F9937D9ED96511D3179FFDBDFB7C26713A8012A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693064, "uuid": "087b388f-2329-4291-a070-22422c1a57a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693064, "uuid": "7c81eb86-2ccf-4caf-a152-f94fe3c02408", "value": "12288:wTFvGz8han23hPKOWqbqNCQz/SSkjwzSKzYqX1QS04YeRc74ucMLNMK4:+phPTrBKB/SMz1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693064, "uuid": "ea2ad459-e933-4b97-9e1d-34429887175d", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693064, "uuid": "8006ee42-a251-4f00-8243-937dc95ac069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693064, "uuid": "d4de19d9-f5a0-4cae-a752-faf786d2c548", "value": "DXWA09875678900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63bf620-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698802, "uuid": "67b1eac0-2ad3-48f0-8a40-7c0e86ff2f4d", "comment": "Malware payload", "value": "b6d15337ec0e1a82472aa45f7cd57f4f", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698802, "uuid": "e341be4f-997c-43e2-a656-c1522cd1ce0a", "comment": "Malware payload", "value": "14ebd6375740693cbbb96e4c0abb24129c6caea780acda633dc0e51715767c26", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698802, "uuid": "07c70b94-058b-49de-adfd-8b244356888d", "comment": "Malware payload", "value": "9a76bb522b6e43d78a5b6481a6705c9c02d43132", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698802, "uuid": "35fbe58f-b2a1-4dba-a2c7-ee4a74bf7b66", "comment": "Malware payload", "value": "05ada8b0fa46084af4dced57004881f556f95b33b092ee24ed3a29c3120bc1f42a2cd08477b44f628ec74cc4cef7f6f3", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698802, "uuid": "e878886c-1c56-4cbd-81fb-2495552b225d", "value": "T1C9B5E6D2B4888951FD2844374096F9FDEB169CDC98B89109B2C47EFB74B2D721227F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698802, "uuid": "2fb5f08a-b223-4d00-bbf3-fd0930e089fa", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698802, "uuid": "0a7c4a7d-b130-4626-8aad-648a8e831e0f", "value": "3072:rGOfZMRnxR9y7b7Vj/9jRZ5vca3PNEAYe111MEvd:Jf4nvAbPVjvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698802, "uuid": "4c2d8a83-44fb-4262-8bac-5124e9ff7723", "value": 2380800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698802, "uuid": "c74efe0e-6796-46c9-8414-f174397d754a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698802, "uuid": "4d63e2ee-5a92-466f-8ea7-58fb9ea737a8", "value": "14ebd6375740693cbbb96e4c0abb24129c6caea780acda633dc0e51715767c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8238b1-7dc5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755694655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694655, "uuid": "1bb7fe2c-b743-440d-b082-239a65bf02bc", "comment": "Malware payload", "value": "d635711cd9f676dc8f536f42ab9dc47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694655, "uuid": "29a17abb-fa3c-4755-ae60-dc5beb9d5ca5", "comment": "Malware payload", "value": "15156ce2fb2390b93482d9d60f671d55cb3b4a92745ef3aca2c88d0b325c0e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694655, "uuid": "202abd95-be9b-472c-b756-9c560ce70bcb", "comment": "Malware payload", "value": "18a26ede8714ddb4778e4a2cb740faa604e8f734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694655, "uuid": "7782efe2-c12d-49a7-a054-c2813c80efdf", "comment": "Malware payload", "value": "6896259947324e85d8ad9fb72da1e3995285b0d41e6d33b0d8ad9f5f82bf1f2bb32b0b00e188db645070ab0baed0a62c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694655, "uuid": "dd0781cd-2f18-4ec1-ba78-daad53e35f60", "value": "T1182512582689EA02E5F97BB818B0E23457FE6E9D3522C30A9ED57CEF3C2171069417D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694655, "uuid": "135fd427-3c4b-4f79-947f-13861b6d7076", "value": "24576:buuJKLRmjbUQ1Ugi5Oi3I4+YivYxJkePTyYJ:buVkXYg6Oi3Uv0Jke7vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694655, "uuid": "efefa4bb-c7e4-462e-b39c-d6e4d6224f48", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694655, "uuid": "48e1ddef-184b-44ba-a2a1-3b86f5844e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694655, "uuid": "218c9fd2-0353-4bba-8cca-f7ddbf0b7bcb", "value": "SOA 6107952048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e11106e-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699057, "uuid": "d70d1e2e-a01d-4872-aef0-9e92ca875946", "comment": "Malware payload", "value": "f900e64c09c1c54326835bb8f3890828", "object_relation": "md5", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699057, "uuid": "bff0326b-bee5-4610-b98a-5faac95a9d8a", "comment": "Malware payload", "value": "154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41", "object_relation": "sha256", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699057, "uuid": "de1f3aec-ff86-42ba-aa18-9deae23ffbba", "comment": "Malware payload", "value": "6e537e7fe39856101213e84e5a76a058392b3649", "object_relation": "sha1", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699057, "uuid": "2af0e4a1-0d98-4866-acdb-dda9c6654a8f", "comment": "Malware payload", "value": "b5bb8429fcaebf8e4f51a22959f04ef03598276e4b368baf84d023d1197fe9fc26a6fd7a29e4c24a778e08d02cd9dfd5", "object_relation": "sha3-384", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699057, "uuid": "a943c20e-6307-4efe-877b-c9e6d793a42f", "value": "T1474506D3B8888951FD2844375097BDFDEB169CCC9CB8910AB24472F954B2D72223BF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699057, "uuid": "e761e138-07d1-4ebd-939c-ee9fe2f76f8d", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699057, "uuid": "c5ea165e-defb-4fd0-8147-ac0cd8d6b1b9", "value": "3072:f5vlPRcFK2you7hL/97RZ5vEUa3rNEAYe111MovdNE:RvDc0UubmrPvdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699057, "uuid": "9e92e95f-5212-4cee-aa84-1dc70df8b24d", "value": 1215128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699057, "uuid": "854060d2-8348-4d7d-a44a-0a74df8f26fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699057, "uuid": "60d525c0-3e6d-4a85-9847-dd2c9a6bece5", "value": "154e800ed1719dbdcb188c00d5822444717c2a89017f2d12b8511eeeda0c2f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01f9a03-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723300, "uuid": "6baf2348-ca0e-4956-a620-4fe447ba29cc", "comment": "Malware payload", "value": "c6637d68cd042d4c92e5e02bde07db15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723300, "uuid": "5ee6863e-216b-4e3f-b559-20e4c48b8887", "comment": "Malware payload", "value": "156fe559007592497bba31a92e719fcab78ec7c4c8a186e639ae4ee78eecee9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723300, "uuid": "08205a94-dd96-414e-acf3-b83a16691703", "comment": "Malware payload", "value": "b5e85e87c28f28a16f490265236a76f38f31f27e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723300, "uuid": "a5e36cc5-d3a1-4319-9961-7657511764fd", "comment": "Malware payload", "value": "54aec5523f5a4520e7f1552d2b06dfd4d17f1bd2a6f09642a2112198d79eeb5e3f441ee11b24e971c98e28456716c61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723300, "uuid": "b28cc332-fb69-446c-a396-c99f680eac3f", "value": "T18D46AD19A3A905B4D53BDA38C616C333DAB179525731C20F095DEA0A2F73AA08F7F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723300, "uuid": "b28629d7-c132-4310-9ab3-27088329d7a7", "value": "200cb43e92237b491e84594e3a573446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723300, "uuid": "b02881ba-99c7-4da6-93cb-13acd785f147", "value": "49152:CGrMcdXV83LeMUFrCKhCwC1uqPpldntq4fi9++rvBB1gvS0ry07G0iIx7BkzxitN:4h3LWrmuqPdtq4cLgeDxs/Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723300, "uuid": "74bb93e1-e1d9-4bac-b2ab-ae4dff367d64", "value": 5388800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723300, "uuid": "3cef1679-0583-46f8-aa18-fca26b615d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723300, "uuid": "b8e2e36c-dde7-466f-9db0-c88fca0c55ca", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead6338a-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698810, "uuid": "2bf68acf-9e27-4ae9-b1e0-0e184850027d", "comment": "Malware payload", "value": "bd27efa3f25d41ab4f8b723a6fb4d9f2", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698810, "uuid": "a0e59c7d-97ef-411c-919f-7bd8dba7fd17", "comment": "Malware payload", "value": "16120954391baf5fbf965bf19933ebc6a07cc4c22931c645a31779c7aa734785", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698810, "uuid": "fe4c570e-3406-4d64-85f5-e021db1d6fc8", "comment": "Malware payload", "value": "67b89fc86a1f50957bd4398d3960b8ec9aafb4e9", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698810, "uuid": "4acb13b1-740e-4d9a-93c9-930d1f0fccdc", "comment": "Malware payload", "value": "80d78028762bea47f5da3adb6ada8c12720a5e539e6497b0c8e337add548f3b6f68d071a3eebde3709ba898ca82f5380", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698810, "uuid": "743a325f-e805-4b76-88fb-e887c99f717b", "value": "T18F4528D3B8888951FD2844375097BDFDEB169DCC9CB8910AB24472F954B2D72223BF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698810, "uuid": "b3e39686-5801-4a64-95dc-86150c520942", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698810, "uuid": "b317d470-8519-49a6-a66c-b81e6701302c", "value": "3072:xvWkLLRi2p9yzT7rL/9JRZ5vta3rNEAYe111Me6vdM7s0K3:okhiyYThEj6vdMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698810, "uuid": "ece94d06-286e-483f-a3c0-3d86f17be414", "value": 1235728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698810, "uuid": "33896eba-b296-4844-8360-698fb981d69c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698810, "uuid": "fe1b58df-b8d1-465c-853c-12463199ff48", "value": "16120954391baf5fbf965bf19933ebc6a07cc4c22931c645a31779c7aa734785", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4c2413-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755701847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701847, "uuid": "64f52a3c-b9ec-4bc5-a8fe-28b6ed519d59", "comment": "Malware payload", "value": "7e997ee4e7fc71fc9e5b2c54972420b1", "object_relation": "md5", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701847, "uuid": "2103576d-39e3-408c-810b-96dbf27af9ea", "comment": "Malware payload", "value": "1681c3b88ed315543ac1bf07d258d560cf2f85bfd26c10471d71700eaeb57fb3", "object_relation": "sha256", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701847, "uuid": "a47c5846-cbe0-49a4-b1de-f7635d385c0f", "comment": "Malware payload", "value": "fb4e3f70b932cd83676ce9a383a7e72ecc9536d8", "object_relation": "sha1", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701847, "uuid": "70000dd2-8692-4ba5-b21a-d4e11c911cc0", "comment": "Malware payload", "value": "2f26f482823a80e7b5b5d89bca7e884c1feca5a6c785824073ea21813cc4d3bdc749fa681007be1fead1d6ceb7291489", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701847, "uuid": "da814ece-afff-4b0b-8991-dc45d7dccdf0", "value": "T12CB762B03128658A898F4F0529A5D9C36D87FBFB4B7455C43EB6C8F424761B8E2E5B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701847, "uuid": "f5cc22d4-7e3c-4b06-8fe7-b8e9de03208f", "value": "49152:OwI7z/XIRv/tpoXVu+dy09yLQ0vFApmbqNXB/nWnTCa:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701847, "uuid": "ad240e8f-1f52-45e3-9ddc-4470ac3ac23d", "value": 48840378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701847, "uuid": "b5343fdd-8e11-4163-9029-98ca1dcd0bcb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701847, "uuid": "6f1d909b-07ad-48b6-b47c-7bfaa7f2a264", "value": "1681c3b88ed315543ac1bf07d258d560cf2f85bfd26c10471d71700eaeb57fb3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f21baa-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755702156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702156, "uuid": "d67810de-0c4a-4ab5-adf4-a12267485e18", "comment": "Malware payload", "value": "a77522fcddd2b67efbc64deb3279a674", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702156, "uuid": "05fb2519-631e-4076-b94b-64388c1f05a5", "comment": "Malware payload", "value": "17355179730a16c9a1e4e81b747ae084618c2210c11dcb78b291ca757dacc853", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702156, "uuid": "bde9c2bd-c7c2-4112-be19-0ea34f835d3d", "comment": "Malware payload", "value": "8aa4b0fb8d6256dae8a9426722a5bb7865a3d6b1", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702156, "uuid": "21bc19b9-2526-49a9-a4ea-9108aceb315a", "comment": "Malware payload", "value": "644e2694c3512492adf06c915bc26fac18619f709b5024866635c9bf3adbdd5cf6a0297e6625ecfcd44dea622baf51ad", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "TamperedChef", "colour": "#60A32A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702156, "uuid": "55473c28-c48b-435f-9a27-41841d8c0f34", "value": "T1ACB533ED9E0290D03A6BC72C3070108124299F65F5276E2A3A947FDE5BC1A265D73FD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702156, "uuid": "9b6f57fa-4a7e-490d-a990-963371c69e92", "value": "49152:dISMOznnAs/VWo2y/Yj/mayzMAOTO67Ov2Int6BQWP516QRY25dU:dIQD5/cRVOxM7Ov22sBz16QK25dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702156, "uuid": "7b2ee2fc-c313-40d2-b979-edd94329c518", "value": 2320857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702156, "uuid": "5f1de6c8-ad0d-4c86-a735-3e1d26f67926", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702156, "uuid": "2b82f248-f19a-4320-8196-b24653314b54", "value": "AppSuite-PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cd0908-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702283, "uuid": "f45c0233-350e-4f6c-99c0-4b32362dc1d3", "comment": "Malware payload (Mirai)", "value": "e15d454f488a510aae1b6459926787c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702283, "uuid": "f47e005a-dc1c-4bb9-85c5-a7dd2251c93e", "comment": "Malware payload (Mirai)", "value": "173763398c3424bf39d4931f89e8588169ca15a1f71ee9deee2c7954c6a83364", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702283, "uuid": "153d09f8-9133-409f-811b-866ddbd6cba2", "comment": "Malware payload (Mirai)", "value": "80e2a06cdc1d744fc256255406adafcf2bdfa142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702283, "uuid": "c6113ac2-b363-4785-99e4-53964ddf6f92", "comment": "Malware payload (Mirai)", "value": "a7edbcc5a5bbafe944ffa2020b9bd0683c244dc592adf3196e3f8051ed405bdc4082cddc9467af81a49f4dc84a2e8b39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702283, "uuid": "bfebfbbf-9d00-4785-ad54-208e92b4a53f", "value": "T1682349C5F88786F8D50709B090A7B3BF97B1DAA80171D2EACF59EF35DE236424612349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702283, "uuid": "44b1d3bd-f7ba-4f0b-8411-4aa5188d865c", "value": "768:6PuzvT3C90kqVQlnqJv/9N70KurL0LcBxQgyAqePH1EvBFP:zzr3FmlnkvL0rnhBxLyAdP14BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702283, "uuid": "0f0efc77-ee2e-4287-9a1f-1209a6135591", "value": 46480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702283, "uuid": "cfb4fd6a-aba4-43e2-8f2c-f5d0066aa9a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702283, "uuid": "47323881-df89-4ddd-81fc-5131f3e67437", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afaad59-7d7c-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1755663404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663404, "uuid": "2e1bc776-c01b-4192-8fb1-efa79d124159", "comment": "Malware payload (SnakeKeylogger)", "value": "de48ade00bb2de26fc68adb60e122ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663404, "uuid": "681bd6a8-3d04-4884-b1c7-4967929101c4", "comment": "Malware payload (SnakeKeylogger)", "value": "17e0c7518d7529f547024299249ba52280ef8832a59065b51084d2363735f0c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663404, "uuid": "18a411b1-338c-4948-8805-53ae99ba91c3", "comment": "Malware payload (SnakeKeylogger)", "value": "27f2d87c4a5ec808ab2d52ec81e41e90cef4e1ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663404, "uuid": "247ab918-58dd-461e-b62d-ab24ae82b687", "comment": "Malware payload (SnakeKeylogger)", "value": "1613b88395554be54ad3b67529d65ff5ab0643bf849a7ea57f5f66fbed2ee3b0ca19bf76d34fe889b5206177be222959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663404, "uuid": "7ceb3149-6de9-4375-86b0-b2981d748307", "value": "T107F402996698EB01E2FA2BF40871E3B053FA7D9E6421D3164FDA6CDF3C257406A40793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663404, "uuid": "d922c8ad-a000-45b3-91db-37a10a552782", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663404, "uuid": "d0e4b5c2-8ee8-42f2-96a5-cbd6f7f3e6cb", "value": "12288:xJqow0sq7Z+54F6I8u2C63RKJXlriAdFpc3501FlnETK5rmYq2aSM96TnXUqYhaQ:u+FQ4S063RKKapcJYFlnEO5r0fX+Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755663404, "uuid": "4325b328-389a-438b-a3dd-0b694b887cc8", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755663404, "uuid": "fc6e18ea-8f14-4b90-882c-9fc545ebcc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663404, "uuid": "359f839d-5e57-4320-a1a8-bf2b242df265", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.25319.4862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308fd9f-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686368, "uuid": "4cf67220-77dc-4404-9aae-cc8f60862950", "comment": "Malware payload", "value": "c42253b866320abadd51fbe459a8d102", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686368, "uuid": "71e1c745-eda8-4801-add0-f24decbd59e0", "comment": "Malware payload", "value": "187828a00996d7ead3e9df61e380a85e0532ecc58774e3da055b58337fbbd523", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686368, "uuid": "d25dec2c-d214-430f-a232-bc7f20d862a4", "comment": "Malware payload", "value": "8fe0d626192066a773614c514b12f98c8b83c6db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686368, "uuid": "9888aa33-bbae-4507-9b70-0cdeefdd3655", "comment": "Malware payload", "value": "c7d1b814b7d186bef4b141ebb210cf1e965c495fe2c8945057cec285bd14c67adaa30fb31d33f5ee3e20b1c2e4abd0be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686368, "uuid": "d94024d5-7ab9-4ff7-8820-f6dcc926890f", "value": "T19E2381105D02C8F00932D3D06FC9B5B1FA3E641A0AA9DA61F98FFB250B257554BA6FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686368, "uuid": "c17f11f4-1d21-40af-a872-a39c45887f9d", "value": "768:U+mai6elFHrrFlGZgcSzrrQNllyqOWf4LDM/jRBw+qGt:U+m8cVPFlGZdy4NBOWI8B9Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686368, "uuid": "9fc660d4-e970-4610-b90c-f8a178a4dd05", "value": 45939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686368, "uuid": "9f52dc01-a387-4e7c-bb7c-d9919271d649", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686368, "uuid": "3096ceb1-5b77-47df-859d-0f6227740997", "value": "187828a00996d7ead3e9df61e380a85e0532ecc58774e3da055b58337fbbd523.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd27710-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695567, "uuid": "2a44b307-c308-405e-aeab-d7d86ab16581", "comment": "Malware payload (Mirai)", "value": "b3e542366a7abce965530e00e1c385a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695567, "uuid": "61d6cf11-62aa-428c-abe2-aeb5d3f8eeb7", "comment": "Malware payload (Mirai)", "value": "18b96b83d4df831e07ea392d8912e0db350f69fdf277ba1b52545067a142c019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695567, "uuid": "03e95a4e-7693-4723-9548-a20af3b7b77f", "comment": "Malware payload (Mirai)", "value": "96068a8278b21cf16647f7f555b5ce743e18a589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695567, "uuid": "a360616d-2d3c-4c3c-ac60-6b5cbc6c375a", "comment": "Malware payload (Mirai)", "value": "3c5bce6c9b38bba39e118ea84573f57977587d7df7187d752d6720c3202870e8c79d86bc7205de5b8d34faeeeaa2bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695567, "uuid": "d12a8486-9e0d-475e-a1ec-bfd8ceb33bd7", "value": "T1D9530236489EB9D0DAB9177737A84383CCA8EDB4CD754058341062E0AF4B6D3A5EB60F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695567, "uuid": "41faac92-0761-4261-964b-b740305541c6", "value": "1536:63PRaDHv3twyCF61joSRM7CTNMmxt7/As5SzJ1zJ3I6P/jLC:kPRYFhCAoC4YNMmfJeJNjLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695567, "uuid": "51e2f43c-0b50-4925-9ad1-adb3a1d6ae0f", "value": 66392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695567, "uuid": "2b18d270-a713-49a0-bbf0-96484938f37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695567, "uuid": "5f73dab5-18ac-4ba9-9592-ca6747faf05b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a384cb5-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755695990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695990, "uuid": "4c2eba83-c6e4-4524-9005-9a2344b1d897", "comment": "Malware payload (GCleaner)", "value": "0ade37df44fc167eb53b80ef66bb02b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695990, "uuid": "8b3056d6-851f-4d54-a5ea-9de2cd23d798", "comment": "Malware payload (GCleaner)", "value": "1a3a2be484d8f6e4a3458ef3c259f13497fc5c10062458c6b2c4373005a3d7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695990, "uuid": "1aa88c98-bcfe-49bf-9900-202901ca9761", "comment": "Malware payload (GCleaner)", "value": "1a50b1a8a3db87102adb18e36ca5fb0342b6df8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695990, "uuid": "f1fbaba0-605f-4431-afa5-68f2f397fcba", "comment": "Malware payload (GCleaner)", "value": "0d1a0b8df8c9b0d4a0953b525080ff3cb0ca2ad0af3ac3bc5ce053c77aea2486fc24b1d23a20446cdd74363e48f2ffb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695990, "uuid": "16e6c46c-9253-483e-99df-b3df396053c5", "value": "T1BB06E0629EE044F4FA1E2339EC155179CDCF2E13FA26C88A7AE42F04AF74512B665353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695990, "uuid": "8a83d1c7-eba4-4b81-a7ed-a5f4a03130a5", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695990, "uuid": "9bc001eb-8b51-4001-89c8-27d92c828a4d", "value": "49152:/ME5gouW3ynrtBSFtqZd0YfNWBTrp55MBC1EGXwLQfEDLeaUHtY6uq:/MUNuey6TSd0YVWhrp55Mc1nW6/YG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695990, "uuid": "9ff7376e-f0c9-401b-a26a-c92c9265c512", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695990, "uuid": "d8107fbe-cf06-4d49-905c-4e45e9dc04f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695990, "uuid": "612cf968-88f1-4484-899c-68ced2e91c85", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.21195.26852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706a7b81-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755680136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680136, "uuid": "c22cb774-39b5-4323-aa33-31ed74450877", "comment": "Malware payload (DonutLoader)", "value": "bf943099ce63650294f8ef774c0b6ccb", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680136, "uuid": "2d457afb-b21f-4e77-847d-4a4ed881b5be", "comment": "Malware payload (DonutLoader)", "value": "1b107670d00d86e0791541131af5d663c74eec95c615ea2086925c30adb086c2", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680136, "uuid": "4712dde7-a14e-40b6-b616-ce33431c9987", "comment": "Malware payload (DonutLoader)", "value": "c73ae7649f111cb8facda9643ffc22fdf5d07de0", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680136, "uuid": "1a06c5ca-626c-4872-95fe-972cafc670be", "comment": "Malware payload (DonutLoader)", "value": "c62495f2db947de16e0ada4c4f0219c267ba35645fa3bdd45d96a2d9e3375837cca6f6747f7872f9485eafb2392ac0f5", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680136, "uuid": "0325aa8f-49f5-44c4-a879-08aa2f2c8696", "value": "T1B3A5BF751A4621A6C571642B2DBF03973D6CDCACD5397FDFBE24F612CBA80E1226814C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680136, "uuid": "4ee11d1b-94c7-4d68-acc7-9688a190febd", "value": "24576:SVyfs1K76tjuFDFybJk3lVu2TCSizExiPh3IncpKoHhTuv5TZir5ArH5b1ykMv7l:S4f7FxTKEwIn0K+uhT5rtQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680136, "uuid": "367fee7b-c6e9-4fe9-9862-0250575aba5d", "value": 2259092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680136, "uuid": "41363394-3f10-4004-b1b0-4f114fd41199", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680136, "uuid": "73559c54-2f33-401b-8fe0-a06cde2cfd5f", "value": "__1b107670d00d86e0791541131af5d663c74eec95c615ea2086925c30adb086c2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40051c2-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755652816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652816, "uuid": "aff131a6-a9f0-40a4-a8e4-67539a27bf9d", "comment": "Malware payload (XWorm)", "value": "9c4fae50d8a087f3cb1fa28f4bd2dba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652816, "uuid": "c8409c56-e8ec-4c97-a691-4ac692aa2598", "comment": "Malware payload (XWorm)", "value": "1b992e42c1c74312aac0173535432c65b2beeb5c80080517d64d2ffbf3cad772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652816, "uuid": "c88ef6a3-595c-4f43-b69c-e1adb63d35ab", "comment": "Malware payload (XWorm)", "value": "bd1efcffa77d4c3812193ed639576fdcce9aa568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652816, "uuid": "a9f19b5d-0120-49a1-a288-19c8fd4c4fda", "comment": "Malware payload (XWorm)", "value": "d90f3be84149d2c925e6f8c48e3314071d5b4f15d551b3ba4e0fb6067ad2a8d6248469818b6595ca48ed96eb75a9bbea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652816, "uuid": "d7d48b98-33f8-4f7a-8d9d-610400ba2977", "value": "T18C738C287BE90528E1FE9BF05DF53252CB79F7235802D22F24D5068A4A279C9CD417F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652816, "uuid": "2fd9b040-0383-418e-8faf-cc425647c650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652816, "uuid": "05a0e64f-7d02-4a2c-804a-994365a671c7", "value": "1536:Jyv+lZFUWCDpwoJbCi1hCbbYn67I/3ySiOlM1+Om/:JyGOWCDxbCiGgsg3yZOlM1+n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652816, "uuid": "3cfe8c70-5b8f-41ce-8695-020dd3109f5d", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652816, "uuid": "516c3eb5-8361-4adf-bb70-9284c6ecab9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652816, "uuid": "9df671cd-ab40-4944-b5ac-938760aed38b", "value": "9c4fae50d8a087f3cb1fa28f4bd2dba0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6013ade5-7de1-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755706738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706738, "uuid": "7275bb97-ed76-4b58-a4ae-dcb8ad3bf31e", "comment": "Malware payload (GCleaner)", "value": "8dbf64bf9322c8899d1510f88774f25f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706738, "uuid": "fbb892e2-bdf1-4bb0-9af8-67d15a24d540", "comment": "Malware payload (GCleaner)", "value": "1baebf4eace8dda9bfa0acc7516b4633712fdefa92f0563ef99084c5c75e74cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706738, "uuid": "bf3e0040-652a-4ad9-9027-32c4490db507", "comment": "Malware payload (GCleaner)", "value": "5959929a7b59b4763f1deedfc7ac1accf0433ee8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706738, "uuid": "8f6f9293-b4b1-48d2-9f49-a5cc71b7cc8f", "comment": "Malware payload (GCleaner)", "value": "0aec4b84f4f6239153104654b66b95f6ffbc2717cdb9c40042c9fd40c7f46cf99cb02f62a8914ff52e25ef1b165116ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706738, "uuid": "f974afe7-fac4-419f-b5c5-ef3d48650672", "value": "T16706F1732095043FD1B2267FC8FACD45A5D87904A9B5D86B627A471C6A1FF01BC3B28E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706738, "uuid": "37d64bf7-c754-42c0-89b1-45f9c6f2af4c", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706738, "uuid": "2f86445d-7c66-4fac-99bc-04bb2524641a", "value": "98304:sMUICLWoFQ+yIe9NyHWXo4oo6GJPVqztrMlw:sDFM9NyEob9GJPVq8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706738, "uuid": "d19dbb27-3c97-46f0-b9a8-1f13d04a54b0", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706738, "uuid": "d18ca32c-5c81-43c9-af62-b049253f6ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706738, "uuid": "91a0ac01-5d47-46fb-90e8-09c66e73ea41", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.13203.27295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfffbeb8-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700483, "uuid": "9398ba2e-9fd4-4de8-82d0-7674fff907c8", "comment": "Malware payload", "value": "3116371a5439555d8baa7c000e640dff", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700483, "uuid": "ceb37432-b351-4a83-bfbd-3067980f9a94", "comment": "Malware payload", "value": "1c529cc2ef9e2ecbfc4aaab8ec0ad3c3d0f527c54bdeb19d0fb0a7066cff770c", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700483, "uuid": "9efacb65-9f55-4463-ad78-39435c3bea0a", "comment": "Malware payload", "value": "c0a92cbaee023d08bca73adba4366a6cd7567203", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700483, "uuid": "5c5dd589-588f-43d5-91a5-257ed06558b9", "comment": "Malware payload", "value": "c61e1869fb33c17da5f77ff7767f5bd5feae3cd3790d6118a7ad30900d8d2417943bc895159e0efd1cd13299e563f233", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700483, "uuid": "e9880d27-e387-41f8-8613-d960227963aa", "value": "T1BAF57B06EA4E7DE1D0450878117297BA8D36DD645B35A0E38ED03CA9B53A1C3F63E73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700483, "uuid": "fae621a4-4229-43a5-a20a-bd662a38cf03", "value": "a326436fefcb2117053a862e77488aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700483, "uuid": "8a0b3d34-8b8a-48aa-979f-de06c48321cd", "value": "49152:93Lr5EoxDAtK1I2w1EOyWeCS/wcLMYqPoawAczBh78h7OF6VKBHanRJJZ:RLrvdWxQ9alQh78h7WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700483, "uuid": "6bcbdcf9-4eb4-4d47-8c21-5a519f45e99b", "value": 3587344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700483, "uuid": "9de7dd73-e18b-4dea-bf08-a62ff9e3a408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700483, "uuid": "e4d09d7a-f1dc-4f76-851f-21d9767b2afa", "value": "1c529cc2ef9e2ecbfc4aaab8ec0ad3c3d0f527c54bdeb19d0fb0a7066cff770c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "865e5c45-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755678026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678026, "uuid": "9c7df5df-3c17-4087-a8be-1cb70dd8a1c0", "comment": "Malware payload (Mirai)", "value": "1a9c10fb72c8dff13d038e61c70a1eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678026, "uuid": "274062b3-3081-433d-82a1-c4e84a1d1068", "comment": "Malware payload (Mirai)", "value": "1dba30798a19a05746fb02d4bebea1abddddad06a289f49462573f64af442cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678026, "uuid": "b0b41ed0-caf6-4803-9025-926283900f2d", "comment": "Malware payload (Mirai)", "value": "bcd2ce6acd2892b40ac9e190d2dcbbb3629a7a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678026, "uuid": "01ac29ea-2b95-4f95-abb5-fab533e6ed2c", "comment": "Malware payload (Mirai)", "value": "6eb0cc42f0703e899df476e985dc93a00b80443b26d5e1d02a89bf4e9b616e6ba7d1719c1330af4e4bbf583deed27c48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678026, "uuid": "ae8a1105-4818-4ee4-9874-5b1f7772a52d", "value": "T142636DC8E583DCFAFC120571113BFB33DB72E73A2268DA97C7D89922D952901E51629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678026, "uuid": "c9531def-b4d8-4e2b-bbf0-e1fa67135a12", "value": "1536:95WY3WVNX9c087NfsOGBeQlJSGCj4yPb0B1eipqeUdoFaYFaS2NwtiQXQn:DWyKNX9c04fsOpQlJSGCjhaenHKsYFyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755678026, "uuid": "060a59d5-53ce-4692-bc84-edd3f74dea08", "value": 72240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755678026, "uuid": "3dd5d794-cf73-4052-84c3-586d153a5bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678026, "uuid": "78744a65-776a-42d4-8d68-41d568dbfb4c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18606432-7de1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706617, "uuid": "2adcc87a-e5a0-40e6-89b8-a930ebb75127", "comment": "Malware payload", "value": "3accfd3c138d1b69319883d236b49920", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706617, "uuid": "684ee137-d301-4ad4-a91b-ea4f806ddf29", "comment": "Malware payload", "value": "1dbac3a6e697be0fb42ee1491e0c5b66bc08e1cfdd7cd1af2df70f67b667cdf0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706617, "uuid": "295b9f05-9a6d-45a1-a961-940680066acb", "comment": "Malware payload", "value": "a9a8e8f7b4d3cd4d23b514dac65873b243e8010a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706617, "uuid": "3c1af5dd-fff5-4e37-975c-567ca7605cbb", "comment": "Malware payload", "value": "02763708695c65fee50db6177d4f8215fe4697c74cb774fa2c62fc55d560f8b028b45c472e5383f82f60e7396bee076c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706617, "uuid": "dfbb979c-4742-405c-9943-3c0633c53872", "value": "T1E4A58DED36C27279D20BD876D4BFDE3312520532839A1F5EE9B01BDA4952F21C3135AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706617, "uuid": "a4eb77cf-73b8-40bc-8d00-5d259c4cdefd", "value": "cb24e9eaeae1b16736c6111f68daa0c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706617, "uuid": "44ae11f0-0e5e-41a6-9204-8e1758e812bf", "value": "24576:c46wctk4Hm5nz2QZuLtAoIpR7hLjLZaukm7cfX2NbodoQDEXNoFuCUHCbv6wctkk:cItAQoVDE9oFbSCbZtAAoVDE9oFbSCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706617, "uuid": "94844cab-577b-4cd9-b04f-beb0054f73dd", "value": 2235392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706617, "uuid": "c0705a54-2ed4-4473-8f01-1eae1d36da94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706617, "uuid": "4a441c25-cc2d-4fff-a380-e64684208139", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf84781-7da7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755681929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681929, "uuid": "87e36151-342f-4373-a338-5f7d3af3e652", "comment": "Malware payload (Rhadamanthys)", "value": "107a8980ade49ca412c2828c3dca7e84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681929, "uuid": "c1458716-d1fb-47e3-a390-50a0320fe54f", "comment": "Malware payload (Rhadamanthys)", "value": "1ef23f1accec94403d8b37e8833df6e42978e9d9f9644b609f14ead613b1dbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681929, "uuid": "77e5c52c-756f-4320-a3e8-da2ec75e1806", "comment": "Malware payload (Rhadamanthys)", "value": "d56ef865bacc68b50f8037a09f4b3a13305ab611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681929, "uuid": "fcd8bef5-adcd-4f83-9892-197d0d65dcff", "comment": "Malware payload (Rhadamanthys)", "value": "99829c94a94c404a366f3d016c40a1b534143175d49213aef222f8b3ad9d4b8ec4e864e9d982bedb564d2eeaeeb7e8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681929, "uuid": "d20475ce-f140-4e6e-99c9-2dd967928a93", "value": "T1C5858D0378E128FDE67DF93299946621F132747C8333B7DB2A8411AD466AF907A3D358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681929, "uuid": "b9f1637a-0c90-4e1d-9c43-3196b73cabf0", "value": "25c4fb4a248389347ae9cf0ce6995420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681929, "uuid": "6f337d89-20e6-4cc1-af6b-56a659a44748", "value": "24576:KRmRDnmdHZ8g68Ez9AXAO0/F/GylOHQyggpuz2V6jxOVy:KRmBnmj858ENJvyggEzBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755681929, "uuid": "59acd2f7-298a-4cd5-bd35-534e6ba40197", "value": 1859160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755681929, "uuid": "9eddf677-e4e5-4623-8dbf-d6dacb0c81e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681929, "uuid": "f69e91ed-5ee4-4aee-8a07-cc9b70230b0a", "value": "Boostrabrrelr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f1075e-7db6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755688246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688246, "uuid": "d3caf669-6d31-4215-8242-4c5d55d269d3", "comment": "Malware payload (Mirai)", "value": "4e4d7bb2c70c816bd60fade744096489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688246, "uuid": "9a91b75d-490a-4f66-9724-be8c6ee2c1e7", "comment": "Malware payload (Mirai)", "value": "1f9e1cd8b751d02e08c773b8bd21e764a21ecdde38a65766865cc53e09cd6bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688246, "uuid": "bfcffaed-8804-496d-b003-3f5bd3dd3209", "comment": "Malware payload (Mirai)", "value": "40e645ab60b2bf2c1dee3cb31adae9643823331e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688246, "uuid": "a6c88b85-28e3-4f60-83f4-238f854452e3", "comment": "Malware payload (Mirai)", "value": "086c53ac70fadfdf1f2075676c38ab0cf235eecda3be260ca2422309b030d30fa0ef6e7ac32f342a0335b223049c6f5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688246, "uuid": "ba0a71c1-f93d-437d-be01-edf4830bdfca", "value": "T18F834B92BC829613C5E023BBF66E018D376963A8E2DE7213CD256F2177CAC1B0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688246, "uuid": "677fe360-643d-4a57-a8ba-dd9c0f8f204f", "value": "1536:DcaP0/cfm859jWUWf2goK1zPUKPvoHmBXjMyxtZy3i:DcaPdfTk2gN1zPUgoGBIyxtZy3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755688246, "uuid": "90abd02f-e7cd-487a-be66-944ad6e35b7c", "value": 80840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755688246, "uuid": "6651d3de-5416-4f30-8ae4-a7cdcb9963e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688246, "uuid": "32805839-5530-4c51-b293-09e2b57e5e14", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1afc99-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755671108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671108, "uuid": "6a766c71-4be3-4a70-be41-0951f85615fe", "comment": "Malware payload (Mirai)", "value": "a223b68375e0f03bdfda8dc6b208ba7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671108, "uuid": "c2a060de-b34f-4f41-99d3-24f9c54478fd", "comment": "Malware payload (Mirai)", "value": "2004b84cd216c52dc6b407a4d85092564a545b8358f87720ce7bf260343a597b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671108, "uuid": "0d5c8189-8dc8-4d3a-9ff3-467e22cda9bb", "comment": "Malware payload (Mirai)", "value": "b0228db860b4f024ce15f4bca766f43a4e497c5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671108, "uuid": "4ba5d620-d723-4dda-8973-d1d856126d54", "comment": "Malware payload (Mirai)", "value": "8f309e65542a7292f04cf3d18005082b192e85cb954516d25f24582912db2428e1655686350a804a628058b182f0542e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671108, "uuid": "31b42e7e-da2f-417e-a365-f7f809ac111e", "value": "T14814C60AAB610FFBDC6FDD3706E9070535CC940726A92B763674D928F54A90B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671108, "uuid": "64719770-fe1a-462d-939d-bca1e77026b9", "value": "1536:r0LQpZW5icjHNrMUZez0UG7ApfqDzCVi3y5poqdsq7UZ80uZOQ+L0/diSuJEWVsx:oLr5BDZvUglisqD53QCWVwXXPbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671108, "uuid": "fd7f25bc-ec60-4044-a481-08c4e8385d86", "value": 208216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671108, "uuid": "67b539b8-7294-4b6b-a88d-8f8ef13f2d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671108, "uuid": "ea73313d-26b7-419d-82af-2c49c45a8073", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364b8268-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755680039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680039, "uuid": "25811226-0107-4704-8987-ee0fd263fd72", "comment": "Malware payload (DonutLoader)", "value": "3ec6277f3cb05a107934235745754e3f", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680039, "uuid": "091efc6a-eade-4858-a63b-1273138b2dba", "comment": "Malware payload (DonutLoader)", "value": "20b6977279a1dfef59169e545aedd091b9e74d9bcf58df2b5e2771f106a4ae32", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680039, "uuid": "ac052764-b070-44ae-b7e6-1f42b57013f2", "comment": "Malware payload (DonutLoader)", "value": "e48e9dd956e3825e64478cb2f6ce54e8038c700f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680039, "uuid": "41b49a36-f7cb-4fb3-85dd-5ed39dbf7779", "comment": "Malware payload (DonutLoader)", "value": "826ef53d981c2f1d5efaa0417b1d8932719d53bf1314e8371cbb374777db32124d322e968fd0abefa42c5a957e016ace", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680039, "uuid": "e0351d83-aafe-4154-9764-8242ead4f276", "value": "T1E5B53322DE6E68FE4768C334700B6F3A56F34794E054D9CB65C25C9B2678B523A1B04F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680039, "uuid": "589dff94-3cbd-4a55-aad0-d96fe7c75c74", "value": "24576:Ej9WXdwr041aImYRR72k4AtYrMVVNZgXtM1fDLTC+2J+zvW3ZHtFbyuwF2WtPgWJ:Ej9rQ0AbN6Zo6byvJ04HtMR2m1etdJul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680039, "uuid": "5b00faa0-fa79-46e5-b27b-532e1c4a5637", "value": 2322580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680039, "uuid": "80a87cbe-2451-4d74-97fd-7ee8b23585dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680039, "uuid": "52280c92-55d3-4152-803e-ca8966804678", "value": "20b6977279a1dfef59169e545aedd091b9e74d9bcf58df2b5e2771f106a4ae32.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3896724f-7d8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (CrealStealer)", "timestamp": 1755669305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669305, "uuid": "a0d2792b-2fa8-4552-95d8-d7a507a32cf1", "comment": "Malware payload (CrealStealer)", "value": "84bba0ffd697df77a1c227543cbdc264", "object_relation": "md5", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669305, "uuid": "674739e9-44da-47d2-b782-a719c86899a7", "comment": "Malware payload (CrealStealer)", "value": "20eed7f5d33c5c88d7aeb5c1edc037bb385eed46308caf47caad477fbdb4f39b", "object_relation": "sha256", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669305, "uuid": "7cbbd53a-1de8-463f-be19-381d3cc5f5b2", "comment": "Malware payload (CrealStealer)", "value": "0404a066cc43ccb2ff855fb52744c98048cd8d44", "object_relation": "sha1", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669305, "uuid": "b145b7ec-3666-453c-b6dc-1a415042e2ba", "comment": "Malware payload (CrealStealer)", "value": "67dd1a242664f4061bc5b5827491d24c2f840420cb1a87838cd099de428ca70f55390d886ec0b5f0283bbeb9cad5db14", "object_relation": "sha3-384", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669305, "uuid": "bedcff96-c7a8-4353-870f-b37a2247380d", "value": "T11207331862E508FBE8F7D93FD6639C61D224BE921B6AC4DF036013442D636E4663EE71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669305, "uuid": "524219cd-bbf2-4fd8-b8f4-e78f7fdd5bfa", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669305, "uuid": "37dc48bb-1963-4ee8-99a3-9acf48043ce3", "value": "393216:285vzap47VDYpA9bMyeSEuCe6mdUSCLZVyAyoy1Pq/wZXJWftO:B5vzL7ZUFyeGCe9qJF7EPqwJJWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755669305, "uuid": "a66abc1d-4d7d-4d70-9945-99abf47502f5", "value": 17451369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755669305, "uuid": "b14d92b8-2195-4c6b-b425-73c297f24ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669305, "uuid": "e20730f3-2045-4b4e-8d5f-0ea7d22b51db", "value": "Ethical.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bfb4aa-7d92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755672713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672713, "uuid": "f4187cfa-3d6c-4cb5-bf74-988c50edcc56", "comment": "Malware payload (Gafgyt)", "value": "c5904425f9d98ce6a4fc7d1f43353571", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672713, "uuid": "3f03ffc9-a147-4b01-901f-3e1a9f0ef696", "comment": "Malware payload (Gafgyt)", "value": "21451afb126e0c928a80967051b4e0c36f6981a5b6dcc83dec0ffa8f55530ef0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672713, "uuid": "7757d3f9-59b7-40c9-be48-100f20e7d8d8", "comment": "Malware payload (Gafgyt)", "value": "07f4adf8868dc36356c921ee7dc62d98a3999ffc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672713, "uuid": "1af472d6-eafd-48ec-8d57-f9d1edefbfec", "comment": "Malware payload (Gafgyt)", "value": "13ea58f7e795dbe1a16ed2d6ecedf3462cda3ea9e6881b64f8ad41820c3ca79a3609a46e74583d63f0ed1a48c7f9edee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672713, "uuid": "e16d4674-bda8-4251-a6c7-1eb4195e6af5", "value": "T167833A02F741C6B3D18315B6129B9F110532F9BF1B1AAE06F3AD3CF8AA154847663F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672713, "uuid": "f411cdd9-563b-40f6-9050-81b1572bc086", "value": "1536:v/Eo67moXD972+c6tsTngPE56XxCSn9wgvjtg0md+wVOz+sXcfW7k:v/EzXz97hc6G7gzXxxCEmMwVOz+ucfWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755672713, "uuid": "3efeda0f-faa5-4987-99c1-0d13625cf598", "value": 81479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755672713, "uuid": "363417ee-16f6-4c81-9018-e9cc0e2f9836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672713, "uuid": "690e4f31-498d-4f79-a68e-2b318ec9ea63", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef864863-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686362, "uuid": "338b40aa-d978-427e-83ab-632f8cf576b5", "comment": "Malware payload", "value": "72e4e6bdf68fc4112e6bed54e5c8f46b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686362, "uuid": "76c7e41d-b595-4a9d-a90f-e6e43e56e5ac", "comment": "Malware payload", "value": "2199924693fc3b74bc7f345c945546f08b51f70dd8f481fa6ebc29d4522955e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686362, "uuid": "79d5c0f6-7ca4-4743-8d2c-de5fedce7e7a", "comment": "Malware payload", "value": "4bc175215744eee7ac075b82a24fcdfc54215f16", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686362, "uuid": "3304bf25-9687-48ba-b8fb-608fa3696271", "comment": "Malware payload", "value": "8fa30900f5eb597f7a29ba861b4ff0b6dc718b399c3696a437e6f57fc7d8f36361f34ab6d6ed3c87c61fb7dbd0bf069c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686362, "uuid": "528354b4-fe80-4cd7-8a0a-7844b7b487bd", "value": "T167E2A62D190C31E4A932CB44DB7185269D460E129A53BD257CAC867FF3F7C586CB22B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686362, "uuid": "f77fa89d-f159-404d-831a-5f98bf244987", "value": "192:1i9/xsuHhdVg5c9fjiW91LQGTTZNzI9fjf7m91oQGTLP7e:g99rgi9xb49+Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686362, "uuid": "d2b1e181-c7c4-4426-8998-a74048a72938", "value": 33669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686362, "uuid": "6091e889-bec7-45ed-8c05-505526afabad", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686362, "uuid": "4d056868-7cc8-44f0-af33-cebf66203c67", "value": "2199924693fc3b74bc7f345c945546f08b51f70dd8f481fa6ebc29d4522955e0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e79bb1-7deb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755711068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711068, "uuid": "59356358-047c-4cf6-83a6-8560c0625633", "comment": "Malware payload", "value": "0fd134e3061fbbc3bb2f80fc708aca51", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711068, "uuid": "7e300235-5292-48ab-ba09-353873c25927", "comment": "Malware payload", "value": "225835bb477eac973330d1d3c48ad14b2f081357817402595e0bcfcbe8ad8bca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711068, "uuid": "5a8febf9-c90d-4fbe-8a2c-fb5a29ae07bc", "comment": "Malware payload", "value": "bf072bcb3f26529a74b1fdf3f7b11e299af1601d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711068, "uuid": "4101646e-f9f6-414f-a8c1-7688cfbdc16f", "comment": "Malware payload", "value": "e781256d05dfe9fe540afb197b90bbf436ccfafa55dc1161a1b13c4889d91596498ac719cff7a48e64c06b4f5ba13c70", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711068, "uuid": "60622dd8-8f54-46f7-b41f-fd4e4b9fb326", "value": "T1FA762347FB09694EC8F3E73228B146762466DC2AC713E783952873B918BFAE40F456D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711068, "uuid": "ec93e93a-3afc-416a-b087-de2b8072d162", "value": "196608:+WKszFpcSlvDVFCUwmKN6TlX5DPN+UFNZxhT68sUSDZ5A:+WKI51CkKsTZpEUFNZ6TZ5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711068, "uuid": "38ad53ce-1519-4906-a9ac-5272b90fae13", "value": 7518747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711068, "uuid": "7f658242-6e29-44b3-a95a-562607f6a3ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711068, "uuid": "741f41d9-0792-419b-9c31-d25d3dc1235a", "value": "225835bb477eac973330d1d3c48ad14b2f081357817402595e0bcfcbe8ad8bca_detected_by_motmaenbash.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d984508-7d7f-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755664509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664509, "uuid": "6f5a3b13-9fee-4564-a4ed-9787c98a1ef0", "comment": "Malware payload (QuasarRAT)", "value": "17e2e62cd93a39ca54e92d7dfb308703", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664509, "uuid": "ce42d596-8769-452a-abdd-d274f8fc50b8", "comment": "Malware payload (QuasarRAT)", "value": "22f272c6846958f95f329b9e979c28760e563d8df5a04bcf5649e6241504c00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664509, "uuid": "4c1b10fc-3996-44ad-ac44-052d873e917f", "comment": "Malware payload (QuasarRAT)", "value": "cc042996a5a99f61e68a343d3c5559c33231dc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664509, "uuid": "36b157f6-8f37-4832-b6f6-be6d133ffad8", "comment": "Malware payload (QuasarRAT)", "value": "15211d176c898d011841357d690332efedae1fb1f12ef9b07ac5f9915ac0f4e487b49a05b6b0393651b41f0eec57cf28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664509, "uuid": "ea1c261e-a12d-427b-b005-d9f1b6f42e3b", "value": "T1E2E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664509, "uuid": "78a9f106-ae10-452e-af3a-b746ea18fb7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664509, "uuid": "becda6bb-1e46-4347-85d8-d5dc952485cd", "value": "49152:3vvI22SsaNYfdPBldt698dBcjHpWRJ6JbR3LoGdNtTHHB72eh2NT:3vg22SsaNYfdPBldt6+dBcjHpWRJ6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755664509, "uuid": "44967964-2531-481d-8dcb-ce696c663c6f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755664509, "uuid": "63193760-5402-4eb4-afcc-96578e6e09b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664509, "uuid": "25e42cdd-bfae-4355-ac63-e585da248c23", "value": "blackpeople123124.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60877b7d-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755696001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696001, "uuid": "c4f3fe6a-a386-4dc1-aacb-0b69b0beebd1", "comment": "Malware payload (LummaStealer)", "value": "c7bcf2cac2e03161c3d9cce8c3926d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696001, "uuid": "eb80637f-d482-460b-8c6a-cb694df032b1", "comment": "Malware payload (LummaStealer)", "value": "2371b0a66328458ddff16721811d686dff6e689139a21ef76bd67e2b7e291e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696001, "uuid": "9cb8de57-a64e-4396-b932-8af829c37b58", "comment": "Malware payload (LummaStealer)", "value": "da7574f89501bd2779e26db50c6344cf38c2ece1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696001, "uuid": "c7da30ee-3327-4cc1-8539-6d450396375b", "comment": "Malware payload (LummaStealer)", "value": "1101248906305360df1b9e8aa68d78765c00d403866608f69082980b3458895a71804b268e48ff07b5c6051869f5c6d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696001, "uuid": "abf808b7-842c-404d-b810-9841343515eb", "value": "T15045C014E839B0DAFCD74071AF765201F8327D7F4F242A9B51D896B01A5AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696001, "uuid": "be96c6fc-0bb2-4e5f-b42f-1d478776c00d", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696001, "uuid": "083f8daf-320d-4105-a3f0-26449722659f", "value": "24576:6qHhP0Hccxas/JLDB5/DsWyR9kUVuG9B/v:bHhMHccxrjsRzkET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696001, "uuid": "537fa73c-fa35-4618-a188-25fe181f05be", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696001, "uuid": "b687c546-a206-4d72-ae17-b87a4d0bd192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696001, "uuid": "3ae891d0-02f7-46c0-8705-b973265165a2", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84377152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ce2c09-7def-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712752, "uuid": "f9a81d74-0b91-4458-a2a0-2871cb5f9d85", "comment": "Malware payload", "value": "8488dc9c0995ed7f9e24dbc160643e03", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712752, "uuid": "75cc9640-04ff-4ba7-bd3c-deb8bd71abba", "comment": "Malware payload", "value": "2387fdfc22ca539fe0593c3d2f1db18302a52e0dc52afcef241ee6a55d247090", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712752, "uuid": "d2f337b8-28e9-4eef-81ae-5d9f38fc1827", "comment": "Malware payload", "value": "2e5c964676cd5684b104bfa6cc3c8bf6f2e283c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712752, "uuid": "eec96482-d005-4346-ad3c-926b33798fe4", "comment": "Malware payload", "value": "bbe8d5cf43cdd6038f1b69975647195dd6b3e9d014d754a391ac1ce1272759e7f194afbc6c91f45b1ef5649ec3a3843d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712752, "uuid": "82b5e163-323e-43bc-bfa0-f27d33ba4a20", "value": "T1AEF1AE829FA77091C6CE8CB201A717F1C825DE7F4C746B92C34F41AC6E0E9E372A0458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712752, "uuid": "469cc80d-97c2-4b95-95e0-9968473acc4b", "value": "192:Xx+JZ6IokQX2i1ZlYyG8dzlTg5RJ3OVVRS2cy7edW3:X46Io3miLiEZiP+t5cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712752, "uuid": "86c2119b-f2c3-4e1d-8337-bdea578a484e", "value": 8054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712752, "uuid": "cc54187d-54d6-4dfa-b01a-156e99eb6a2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712752, "uuid": "2c66b805-2289-459d-bb1f-3e3e73a27439", "value": "baea41557056d6cce61a1e41406d6005fcb5bab53ae7037a964559a3b2de3c6f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f614609e-7dee-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712573, "uuid": "429d76b5-4659-4eb5-b560-d6005b7179d0", "comment": "Malware payload", "value": "96d7a9b727e2dd54b060d70e2c20f5da", "object_relation": "md5", "Tag": [ { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712573, "uuid": "258ca6c2-09b7-4a33-8601-35243194e9d8", "comment": "Malware payload", "value": "2523bd69442ff7c4ca979c7638bc0de0baf89edee60de41cd696405bf9edf32f", "object_relation": "sha256", "Tag": [ { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712573, "uuid": "4b8d8761-056e-4b66-bcf9-df139624bbbb", "comment": "Malware payload", "value": "e2e2a5cad91b7a1e8c76b9d2e97b279685cd3ea8", "object_relation": "sha1", "Tag": [ { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712573, "uuid": "941a6de7-2ec1-4aa6-ac00-679404c38de2", "comment": "Malware payload", "value": "0028c4ce805c7cc021462222de70a683762dfd399c0761c66f23ef2628a39a5fab2d5c444c8c0b1a479c0812d13de93d", "object_relation": "sha3-384", "Tag": [ { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712573, "uuid": "44ed678b-eaa8-47ed-8b4a-a3e795436232", "value": "T13EC18E1FD3424ADBE2874639EC07693D63495787A2B5721F1146F81D44E7AE069DB00C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712573, "uuid": "93ce1097-4e09-4503-a902-bf5c2cfbd55d", "value": "96:oMCQvY+tiiHt8rqlykZheJ3sW3kcksG2JR4I8xUUc7wFNw77:bC0dpN4LkLeJcUQcJIU97wFo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712573, "uuid": "806c719e-9420-4ceb-92fd-edd76a498048", "value": 5924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712573, "uuid": "b2381156-6f16-489b-986b-df26e50c02a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712573, "uuid": "092a378e-d1a4-4a75-ba4d-e31431bf40c5", "value": "2523bd69442ff7c4ca979c7638bc0de0baf89edee60de41cd696405bf9edf32f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907b2871-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667305, "uuid": "e178209c-7594-43df-875c-47da2a249d96", "comment": "Malware payload (Mirai)", "value": "47912fac9c10937c8e35f697811b923e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667305, "uuid": "fdc8c50c-8790-47ca-842b-e51df220c04d", "comment": "Malware payload (Mirai)", "value": "25c83e533f6f24353e2ec74c527f3657fe0f124f91ff28606e769d0a87292e71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667305, "uuid": "363c2dad-8ab9-42e3-bce6-0616a868fd58", "comment": "Malware payload (Mirai)", "value": "eb12a48bffc45f274d06383f6c0afabd04ed515a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667305, "uuid": "3822e5dc-9304-48c0-9e35-a6b2eb142f8f", "comment": "Malware payload (Mirai)", "value": "3d9980e073bb515ca295a5663ffa41df633c57dfdc009390d2f6470a391214832943bfb7709757e9b4d70099a381c51d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667305, "uuid": "7b248cba-f699-4214-85e1-43f84d6ca609", "value": "T11A2173CEC89E3512B0F58B4178069BA48F1DC1A7BDD05F609A9E7CB6C74CC14F8A594A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667305, "uuid": "c10d5f2e-604f-48b5-8d81-01f80c4ec61c", "value": "24:l+AVh0fO3VhzfLVhCflVh0mVhzfAMVh+fVhK5VhgjVhm4t/eIVhJn4zgIMAVhJZj:8Uh0GFhzBhC3hfhzjh6h8hoh/JhSNhCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667305, "uuid": "d6c39fd7-f9b5-46b0-803a-1d72284d3114", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667305, "uuid": "1509aec8-815b-465e-aecf-fe477820b512", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667305, "uuid": "438fe3af-63f4-463f-a9a8-cd39bb95fab8", "value": "ipcam.tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f331bd3e-7d5e-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1755650720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755650720, "uuid": "973bb6bb-5a36-464a-8c14-abc39205c14e", "comment": "Malware payload (PureLogsStealer)", "value": "32a6ac6d4df1f6e9ec46f1d2e13532de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755650720, "uuid": "ba45f629-9b1f-44c2-a228-94564c942db1", "comment": "Malware payload (PureLogsStealer)", "value": "25f43614b97cd703a214172c4596149f83065fbfc021a64a1d792a0e9c158718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755650720, "uuid": "11942e58-496c-416f-b34c-f5acd870fd1b", "comment": "Malware payload (PureLogsStealer)", "value": "797e1d63f8bb28c40650c967ea30370a708d8fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755650720, "uuid": "528252f1-d6ca-4152-aca3-90d9851b0d08", "comment": "Malware payload (PureLogsStealer)", "value": "9e5ac36d042dab912d55e9fd996414feb5215cbc0fb2cbd46824f32f92b6a97ecdcd981ba297cdc3087ad1503d4b5b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755650720, "uuid": "99e1f4c0-8d96-4d5d-bca0-cad41ef03485", "value": "T15B752317BA0652F1C16BEF77C55B434403A6EBD1F963C2463D4D632A8D02BBF9889A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755650720, "uuid": "ad57501e-7d5b-48c3-a558-dfbe9c3c3229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755650720, "uuid": "b6c63a36-9d2b-45ca-9234-294739eeee1c", "value": "24576:Jt62nSLmuXsQUI7EOs73S4CDFxTuGKrfGCAmKH6t14FPWAzOuPC:Jt62nSLyogRSzFVujTPD5IOuPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755650720, "uuid": "eb4a938a-d4a8-4ce9-98a4-69dcee4747c3", "value": 1697280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755650720, "uuid": "c97d9b1c-4312-491e-b6e4-8a53cd46f85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755650720, "uuid": "70cc98c2-5507-4c11-8045-cdf077e63e64", "value": "Updated Freight SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a097961d-7d62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652300, "uuid": "299508b2-607f-43f2-ae38-6414aa5c6fa5", "comment": "Malware payload (Mirai)", "value": "2aa97dc286fffa38c14d07b3eb6d3606", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652300, "uuid": "70f6bb37-8b04-40ab-9ffa-899679263c6a", "comment": "Malware payload (Mirai)", "value": "267b2a7bc7b0ad26d623357fad6b5a74e88261ab65eba5d8519581236601f5ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652300, "uuid": "c9293f59-c764-4226-87c0-d65f29209a03", "comment": "Malware payload (Mirai)", "value": "976bff3bc9a159d6343649a2a651fa9bce331ab2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652300, "uuid": "75d7a402-fcc5-4653-b75f-4977d3625b36", "comment": "Malware payload (Mirai)", "value": "06af0ff876b595c0e0ee4b398ebc02d909d7d612cf9c3b74c0b25c871159cbddc2f1a2236d3a42f966ab999e792710fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652300, "uuid": "63e89554-b038-4f63-8fd6-18201d174f89", "value": "T164935B21FA79193BC8D4A97662F30772F2F7438B20A8861F7D710D8DAF1565022676F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652300, "uuid": "cef827ef-961c-49da-bf40-957a56ab82a4", "value": "1536:SiKCL4iIMYXR3OaiIBkCXlSu2NPqtJi0zq5UDwBADCgAtP90+:8LrOguuDis6UUuR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652300, "uuid": "15234f6f-c581-4384-922d-aff3aa2bface", "value": 94936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652300, "uuid": "139822eb-4fee-4b5a-ba66-5d64c617197e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652300, "uuid": "b7d9c6ec-0e62-4f96-8745-fe25ebea43a8", "value": "nwfaiehg4ewijfgriehgirehaughrarg.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5f8a93-7dee-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755712588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712588, "uuid": "56f3a763-b36c-4d6f-b087-28033abab6dd", "comment": "Malware payload (QuasarRAT)", "value": "c7b5a111744b16106c9120ebf726e982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712588, "uuid": "61b23fae-18fb-4ae9-b78a-10fb0974abb9", "comment": "Malware payload (QuasarRAT)", "value": "268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712588, "uuid": "08f53a78-fadd-4c46-9595-24a0b2216a53", "comment": "Malware payload (QuasarRAT)", "value": "a77d5d5f20e48eb05fc9051be4e643e19cb86ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712588, "uuid": "3b1d5a63-3c21-420a-a903-49c582d6c28f", "comment": "Malware payload (QuasarRAT)", "value": "cbd22d930fdc711329f3236f9d54a82d3577695cc4a81ca5202788ca48598a5788266d88d9efc65232b857b57b5dc89d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712588, "uuid": "82acb33e-09bb-41a0-93a6-0f6129ee4419", "value": "T1E6746B2373A4A93BD1BD173AE43206056BF4D507BB16E38B5A6845BC6D233828D917F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712588, "uuid": "8626fa0c-6ba6-4d84-9197-14f61a2266fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712588, "uuid": "36136651-d7b1-4d38-97a1-d618e31958e6", "value": "6144:Q2+EMJ1kbrTzS+QbZVuZV3zbOBUciMAFRzeI5GgFuj:fS1ki+RcRiMspeQGgFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712588, "uuid": "a828123b-e0ec-4662-9bb6-f6ac4c097e2f", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712588, "uuid": "f80feca5-591a-4d9c-858a-6c7435367b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712588, "uuid": "1ba642cf-6340-44a6-b465-c3d6651d54c8", "value": "268501cbc4704142a83673aab0b20dc7b8bf9221b70f0e7bbb42f072ed341e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc750f9f-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700504, "uuid": "2b8cf45f-b807-4d49-8879-1bf69dcd203f", "comment": "Malware payload", "value": "0d92ba2689d74c200ed1dc300c9f4def", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700504, "uuid": "2ea9d298-b203-4f9d-b50c-8b6b0b37ac8b", "comment": "Malware payload", "value": "26fed90b2c9b1173f94ba64fd8e51fdd0929ab2a2e152960da5da3c669fda731", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700504, "uuid": "ec20e08a-a023-4647-a17d-1da7e9ac08c0", "comment": "Malware payload", "value": "0513f75f3f7ec815391ccef79f2dc915ffbedfd2", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700504, "uuid": "05827ac2-8b45-4706-a431-11930f362d02", "comment": "Malware payload", "value": "92eee50d54280a594b5bb0f381453412a46a65cd93aa6f301c43fba18965f21ff637bc5b6f34cc92a0c5ec6a69919279", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700504, "uuid": "065bc029-a7dd-4569-8dc9-e5a2cc9a8707", "value": "T1E6469FC3250482FBCD248932B02D66711A219BFFC317A5A176D85F2A6CEF584593B93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700504, "uuid": "5d11a939-100c-414d-9d40-443648e0223c", "value": "056e9d8f916719c17dc4331532b4a998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700504, "uuid": "982a376f-ed8a-40df-b367-bc0c693d04a2", "value": "98304:HOQSpGp5y6pvpFI1Ulzxc+NYHKHOH9HHHHHJHHHHrvulsLw2dz1uKez3H3lV1Fyh:toGp5w1UlzHNYHKHOH9HHHHHJHHHHTuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700504, "uuid": "51dfac2b-a1a9-4a06-8b1e-6e1c8d4fbe3d", "value": 5424400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700504, "uuid": "861a4b7b-f2b3-423b-becf-b1174723e4fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700504, "uuid": "223d5aaf-3f6b-448b-b143-b59b6449a08f", "value": "26fed90b2c9b1173f94ba64fd8e51fdd0929ab2a2e152960da5da3c669fda731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c8ee3d-7e01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755720335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720335, "uuid": "0cce6f6f-04f8-49c1-bcdc-c3aad6ab8f7e", "comment": "Malware payload (Mirai)", "value": "ac5f28bd32159e0ba287853ec56964c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720335, "uuid": "39b5f8b7-421c-4f8c-9418-c60733a97cc0", "comment": "Malware payload (Mirai)", "value": "270f0544e18891e4481fd4aa90f4c91a917875dea98cd193909ee86dd2cae844", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720335, "uuid": "30dce88b-3ae5-436b-bc75-74710a693a7c", "comment": "Malware payload (Mirai)", "value": "4d5a19b1a60b9730d9884391a872eee6576bd354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720335, "uuid": "39f5d3f6-dd17-4f09-bac1-43dc2bce5686", "comment": "Malware payload (Mirai)", "value": "6a8b5391476683f7edc61feb15ad514f90048d615714cdc824647c290d6e14376949b0487b889d0766fd6663ef12191d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720335, "uuid": "f059f364-7810-40d5-9390-efd54588f78c", "value": "T140836A25B8792E13C0D4B43B12F78325B1E5274E25B8CA5DBE360F8EFF2969024535B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720335, "uuid": "a0c106cc-b709-4d8a-ad10-5ee6b84c17fa", "value": "1536:ROQbSHSysULvAExtweDPkdXm9AYTqhv3RJLb1310A/cr9:g/y2D5weYuWhf7LbtaA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755720335, "uuid": "3444b17a-c343-43a2-91c6-1515d27d821a", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755720335, "uuid": "aad147c0-455d-4ee9-a6c0-fdc6d8ccef4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720335, "uuid": "d66d2559-9dee-4d60-9b16-60c1228c7db0", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4f8b40-7db7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755688966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688966, "uuid": "4c92a80b-fc82-4131-abaa-b6a23ec8726e", "comment": "Malware payload (Mirai)", "value": "1175b7284fa5753c21e13ff7915b83d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688966, "uuid": "3eb08b72-89e5-4128-892f-846a541a8f33", "comment": "Malware payload (Mirai)", "value": "2760e33f7a6401bc310b1004f9b64949eb8e86d4255f67b3d9ed91ac3a7a30a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688966, "uuid": "ef411269-6d9d-4557-80bd-908530d8cedc", "comment": "Malware payload (Mirai)", "value": "647f711522db5750ec747a87ad8853738368cc8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688966, "uuid": "67789a3c-488a-482f-94cc-a07e4c92aee9", "comment": "Malware payload (Mirai)", "value": "dff8cc7bf9602633eaadc7b2577a3b920529900d7e47a4e079cb5f4aec97204452c1c2cdf1f1e29eb118000b38df1657", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688966, "uuid": "6c265821-69ab-4b13-b238-d2cd0d937b0c", "value": "T1DE834C92BC829A13C6E413BBFA6E028D376513E8E2DF7217CD159F2037CA91B0D67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688966, "uuid": "77185db5-ce98-4b94-a3c2-9b881eb0c7cf", "value": "1536:f+0a1rs7hwGXL62xT2gEgIEV/kstw5aqREvQyxtZy3i:f+0YgVjp2gLIEV/Pw89QyxtZy3i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755688966, "uuid": "bc68bb22-8c34-4872-83d8-d58c79d3b811", "value": 83920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755688966, "uuid": "d3f6305b-452e-4ef3-a59d-64e4004174e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688966, "uuid": "e84b5367-0879-44eb-848e-826ee96233f3", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9335be53-7dd4-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755701240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701240, "uuid": "66fb6b9f-a0e7-4e87-9d5c-aebf7eaefd0e", "comment": "Malware payload (LummaStealer)", "value": "9bf7a6fdb4e14147efae8a79767d6d86", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701240, "uuid": "728fbd68-f4c7-4638-b599-2e32d3caca6b", "comment": "Malware payload (LummaStealer)", "value": "2837c7974b43c5836e0d123c4a9f29a337f28d57019ac6d98a6c99b6d0683322", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701240, "uuid": "21f07dcd-4d47-46d2-868a-28b88bb10380", "comment": "Malware payload (LummaStealer)", "value": "1825876dd9d7ab2b84ccb7b93554e964c64164d9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701240, "uuid": "ea0a59d6-c13e-4cfb-8931-067fbcbddd73", "comment": "Malware payload (LummaStealer)", "value": "47b26d847cd383f4fbb03d153ff281165ca5d7374333f5cfa5bdae0754479aedad8ad31f7f319eaa19d498d463561564", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701240, "uuid": "1b596ed3-cca8-45b7-8a49-def851c9e9ab", "value": "T11A15AE35A0F29033D1772B799D5BB2A4AC2DBE107D39ED461BF41D484B392923736293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701240, "uuid": "55eb0237-da40-493a-a633-09f0ba4136cc", "value": "dc6d8b5646aa412f75a87b06fd63080b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701240, "uuid": "4e94dadc-a7a0-4574-b63d-26020356d992", "value": "24576:lfqIgqXr3y0b8ibsTN/cFDd9JP0okXgXG:lrgsrC0bA/2DBtfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701240, "uuid": "15f094aa-0521-400c-a6e4-7fbbc7d6844a", "value": 934688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701240, "uuid": "5a493377-cf44-4fea-a3bf-c2652d460ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701240, "uuid": "37d38dac-8480-437e-8fb9-fb484ca99296", "value": "1lapisfirst[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cd1d79-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1755692785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692785, "uuid": "69822032-7557-4356-a923-e6a08969ca92", "comment": "Malware payload (VIPKeylogger)", "value": "6352f7e42c001ab0776afa150b942fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692785, "uuid": "0b87f253-7751-4783-b176-8059d44068e7", "comment": "Malware payload (VIPKeylogger)", "value": "287eed2ee591a0bfac6b817ebb5e9da770014fc645d0d1e1ecc523e96b1bb7c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692785, "uuid": "e861121f-73c6-4e39-8b7a-5c5ae248d030", "comment": "Malware payload (VIPKeylogger)", "value": "6af0ad6d7ed31a6420c5d9af1cda4ef4984182af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692785, "uuid": "2add2c92-8296-4c81-9248-5d393fb31676", "comment": "Malware payload (VIPKeylogger)", "value": "f9d661194d2105db576a6a8e50992990eb3f850f575eca88c2baba43b1785bdc4f040b8562fea7be471bb18dca6d8520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692785, "uuid": "8e5b7cb8-1d9e-4e68-a2df-9e3a5d0e4fa2", "value": "T1CF9533C5F880C897E03C8FB1699ED5B62859DE4C0FC1D6974350A5EEBD06A88E1F936C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692785, "uuid": "c942e8de-f228-4c4f-819d-68f03974f6fd", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692785, "uuid": "92cba620-d6ff-4634-9cca-c09888e6f7b9", "value": "49152:Sco2yIcGRXD4Hoek5Onyfl0iHYh4xQdkheCxL:EV4DEoekJ0is4auQuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692785, "uuid": "a3226404-7a98-437d-97ee-a819de6ee357", "value": 1924144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692785, "uuid": "cf5ab0a1-1c6b-4d76-9949-99f01f2b2487", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692785, "uuid": "0ac31a49-52a9-47c1-a59c-e5b7e8ede097", "value": "EGE SERAM\u0130K F\u0130YAT TEEBI - 20.08.2025 Usual_siparis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57d33a8-7d88-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755668709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668709, "uuid": "fbd898ed-3b7c-4a67-b62d-35f787ab493f", "comment": "Malware payload (QuasarRAT)", "value": "621ba2c4870126cee3e1d198911753b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668709, "uuid": "c21d72ad-966f-4cc7-8d80-240ddafe1f49", "comment": "Malware payload (QuasarRAT)", "value": "28852b784a3ace6554544ea14795a3f1cd1d37228bfcfe2eebe09dc667a1978d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668709, "uuid": "55a70155-10a6-410d-8e24-4ea456ce3828", "comment": "Malware payload (QuasarRAT)", "value": "5b4ed2899cfa3cb433a7ed672c436c3573c1e5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668709, "uuid": "4628fdb5-9078-4be8-8426-3d91885d52b5", "comment": "Malware payload (QuasarRAT)", "value": "25d42fb0b367ccbd6218c49ed96c5eebd50c6502284de3a89949b5f743126c9eece796b2747e5f4c957fd62f92401db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668709, "uuid": "574008ee-eeb2-4c16-80ad-de722da6bae4", "value": "T1CAE55B143BF85F27E1BBE27795B0041267F0FC1AB3A3EB0B658167791C93B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668709, "uuid": "29f234a1-55cf-4190-aa6e-bf32964b0793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668709, "uuid": "200d19ad-9d3a-458b-b3b2-edcb0861e1f6", "value": "49152:yvSI22SsaNYfdPBldt698dBcjHdbDobRcLoGdZYUTHHB72eh2NT:yv/22SsaNYfdPBldt6+dBcjHdbDLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668709, "uuid": "f44f6539-ea5b-4d63-a3ea-03b1f8d267a0", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668709, "uuid": "c27fe02d-9e27-46ac-92e7-2e6bd68a461c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668709, "uuid": "d12a9f1d-feeb-4ae6-96bf-bb3ab5e755a8", "value": "blacknigegr121243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6650623-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652873, "uuid": "46acdd99-ce04-4926-8bd9-144f13b85628", "comment": "Malware payload (Mirai)", "value": "169ac94c365ff0b9ed02c7788f9b7bc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652873, "uuid": "94ad2f20-4da0-4502-9d3f-29c321297ae8", "comment": "Malware payload (Mirai)", "value": "29499a50ee8192eebed270c3823a9387fd591be9ea31adeeda0162eb31e1021d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652873, "uuid": "1aa90955-5270-4d14-8dc3-f9cd9ae9c451", "comment": "Malware payload (Mirai)", "value": "1da6e6546f55a3c5da4aafa5630938d498452755", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652873, "uuid": "79a7645b-f484-46f2-983d-d920400e5944", "comment": "Malware payload (Mirai)", "value": "b6fd8bf6e940a8d5a2de155bd9ad8ea396bfca7f1a15dee583a32bca163b81217f4d22b85db923a93d4002f132d056fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652873, "uuid": "a3c66f69-ddd2-4f1a-8ace-5afa195624f5", "value": "T16813F1B3A0D6F1B5E04C95F49C682D8CEEE208A1F5477B364B9B15D4ACA1C6C2443EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652873, "uuid": "23027fae-ef4f-4338-8b03-c6ed72906144", "value": "768:GAi7PZ6edbWD6QLgdSS5PQY/Vb2OHx5mqqkPjC9BrEWTzoPrE/V0x0K1:k7FRWD6QLTSJQk20XZtrEqP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652873, "uuid": "0d1ccc1e-b21c-4a06-ac4c-4fd009be6d89", "value": 41860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652873, "uuid": "582a9305-2d34-470a-9aed-3edcba50cd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652873, "uuid": "1601d564-d917-4fee-8c95-676df256e3b3", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d747df-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702424, "uuid": "f6ecd442-e180-4a28-95ed-11220d583ea1", "comment": "Malware payload (Mirai)", "value": "13266c55a00166815120c62d1a22a3c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702424, "uuid": "a5035dda-50b6-4cfa-adf3-4165c0f620d5", "comment": "Malware payload (Mirai)", "value": "2a30522440db5a23e538224a21664f487fbd3dbd245175a00c21817517ca6296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702424, "uuid": "543247ee-ec28-4def-a9d4-841c53a6faac", "comment": "Malware payload (Mirai)", "value": "8e32b7192239e6f1d213198e4d82f9f9c13b567e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702424, "uuid": "a6afd6ec-2112-48de-9e3f-08f1efbcb56e", "comment": "Malware payload (Mirai)", "value": "c637de33ee130fa6a1c1950f82973c85d95aa8bd592ebd7b9931ea3e51c1f7b3bd20b2b1d0d37ffa98a0f99e3eef6aa5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702424, "uuid": "71af75a9-7dfa-4a67-b618-61961cccf4df", "value": "T1C7738269F8424B33C0D70279B59DAE4A3F2113E5B3CAB1136AB05BB03EE75171D26D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702424, "uuid": "7e85fb70-264d-4d7f-8225-911421a23ef2", "value": "1536:KtnuVzi6cp9i1LNFPvCYc73QbrGtlgDi+ciSI0iW/OS0Knv:ngLSLOYMWO/OS0Knv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702424, "uuid": "168c0790-9229-434b-985b-cc51fbe83d8b", "value": 79152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702424, "uuid": "8607a77c-a15c-41c8-b7ca-eee938b0ea9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702424, "uuid": "6e65dcaa-cff9-4d63-ab4c-6b2541d98154", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc86297-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755723105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723105, "uuid": "21f498ef-91c8-486a-b2fa-f743fa09af52", "comment": "Malware payload (Mirai)", "value": "1050b879f16105e8634d877e3dcafdc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723105, "uuid": "8bf88363-b14f-4889-8089-e9ab08021e25", "comment": "Malware payload (Mirai)", "value": "2aaafa22fb6b7eb4b6dc9badd15ce23026079ade1db36e0ba1083f01f8a529f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723105, "uuid": "8c3fd22c-8799-4b77-86ef-ee5738d6ee79", "comment": "Malware payload (Mirai)", "value": "f52d51157e33ffe3d1c8ba87c4c1fde2b48050d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723105, "uuid": "31298f03-d4ca-4b4e-a756-43f84a9b8b29", "comment": "Malware payload (Mirai)", "value": "562f2b53dcae9853cba4275a057317786d4fd43b7b3afd63fbbac44d1995bd7a4e816b0e79ea79e87f89bf4abe262672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723105, "uuid": "24ef9fa0-e27f-4b0b-90ba-365ba62c5469", "value": "T1298319B81996F67CF9F250B9F45310EA28610A18379CE1E3B987603BFFB47087169D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723105, "uuid": "f9ef5520-ec99-4188-8c56-968e0080c3d0", "value": "1536:0LkGPAJF0A/nnmrgKoKkf6Tx5/WvfAyV9xbi0lOM:kIJF0A/n2oKki5/Wx9BRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723105, "uuid": "cd610b0f-0cdc-4fe3-81cc-e2f2ec56108e", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723105, "uuid": "9f5c1bb0-f42a-4da6-baf2-ca74318a68d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723105, "uuid": "a9827110-d2d2-4b64-be47-82aaf6d8d288", "value": "db0fa4b8db0333367e9bda3ab68b8042.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a17624-7dd4-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755701375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701375, "uuid": "de8ef039-83e2-43fa-a908-93a2962e5bdd", "comment": "Malware payload (LummaStealer)", "value": "29aa212d03ab42c9f53561b436c2453d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701375, "uuid": "f0510e65-d498-4ccf-b84b-e98a88287a2a", "comment": "Malware payload (LummaStealer)", "value": "2ac22f6149fab895c84c34ff4f5fcc1d6a95bb032372c4f5b37befdda7d0b81f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701375, "uuid": "32fecf9e-704f-4bd4-9f4a-9b681f8b4e95", "comment": "Malware payload (LummaStealer)", "value": "3d031c26845f98625ece30a651f2954a6f978683", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701375, "uuid": "37150d91-b5a4-4aae-a572-39335fc92996", "comment": "Malware payload (LummaStealer)", "value": "aaf208f0b07aadd44c0c9d12c3e2cc5437a760b80ed37accd21b368afd5999d5d3fb4126063406e673308a7ac359c584", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701375, "uuid": "cf4992e5-af9e-4d91-9600-ac9bcd8c7527", "value": "T17245C014E839B0DAFCD74071AF765201F8327D7F4F242A9B51D896B01A5AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701375, "uuid": "3e0853ca-803f-4050-b943-d1b96a35dec1", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701375, "uuid": "8a475054-10f0-4403-a6ea-bad4744e7934", "value": "24576:6qHhP0Hccxas/JLDB5/DsWyR9kUVuG9+/v:bHhMHccxrjsRzkEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701375, "uuid": "0e834136-4041-40d5-a8da-925830627a84", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701375, "uuid": "b71b3858-543d-4f5e-bd6d-d8c9ffcc0eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701375, "uuid": "40b75b3d-be13-4a83-841f-a84297b9e05d", "value": "ONE[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c5db22-7da4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755680410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680410, "uuid": "4165706e-38ca-4aa7-9578-40621abf27d3", "comment": "Malware payload (RemcosRAT)", "value": "11150724b404d0ade8b6fdaf6597f2df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680410, "uuid": "a6d35079-532d-41d5-b91f-1207cbcee0a0", "comment": "Malware payload (RemcosRAT)", "value": "2af452692d3b63287d9214f6fed23b139df8ede4d495f5cd6fe61de3d21232ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680410, "uuid": "9ea77936-49dc-4481-9a20-ff8c8dc3a980", "comment": "Malware payload (RemcosRAT)", "value": "59985aaf342dd147ef2423d3485013cf7ad2be9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680410, "uuid": "053c756e-d512-495c-b00a-0d3ee232982e", "comment": "Malware payload (RemcosRAT)", "value": "07fcd58d481f3385afa193e45afbf937da1d169884568f7a48dc4e9cdb8536e3861a15b1a7e0337889cc03eb1b551b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680410, "uuid": "3e57df26-6cb0-45c7-8815-920a112f5e96", "value": "T173A41261B778C827CA9301B769B19ADAA5749F2609105F0F63A0761CFD7628FCB4E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680410, "uuid": "053843d6-e22d-4d1a-97fe-c055abb6a38a", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680410, "uuid": "ebdc7dee-886f-48ad-ad58-2726c7c3f26d", "value": "12288:xTDJt6Xlu9oCrtcC1VArHKGx9e+0ckgbip4e:xTDJ01u9hfvADxeD94+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680410, "uuid": "d3854e03-bcee-4b09-a6fe-8530fe2504ac", "value": 490248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680410, "uuid": "8c04ad3c-ebbd-48b0-8c34-dcdefbc28254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680410, "uuid": "9a225ea3-44a0-40bc-ad6e-8f26efb1db61", "value": "rPayment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5295df56-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683093, "uuid": "697388e6-e2b7-4ae8-b227-b3c95b8c31fd", "comment": "Malware payload", "value": "bdc4fd7329e5f5baa7964b24c61171fd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683093, "uuid": "fb1ded2a-6753-4176-8cc1-f2d215280c82", "comment": "Malware payload", "value": "2b7801369eb9a58b96024a3c0a3e4f7e5753863880d8d9de1f7144070ba5dc30", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683093, "uuid": "089be41f-d524-4942-a77c-bf4eec8f2652", "comment": "Malware payload", "value": "f7ef82146661f8d80193eaf29a190ccc86c5be0c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683093, "uuid": "9a0611fe-58e3-47cd-a8a4-bf8b785fa0d5", "comment": "Malware payload", "value": "9d33f433352feb960cc3a7383e4b09d9574299212167f7ac5fcd9e207716ee8abf8b80fcf399ccc0b94dace3db7c561d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683093, "uuid": "e7c7e530-0cc1-477e-9b94-df4541987a9a", "value": "T186D40C1435995CD623C310FA9F965894FA78435340ADBC68BACCC6C26F05908EBF67EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683093, "uuid": "a2bee847-8269-4cdb-af77-95518fb97f38", "value": "12288:pRbDbhJGYDb/XwXMX9ycFb7b4JVzARyvQ1svRO9Q9f:pRbDbhJGYDb/XwXMX9ycFb7b4JlsyvQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683093, "uuid": "c4fb3c09-62f9-4fe8-82c2-a1731a53c6e4", "value": 626620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683093, "uuid": "fc32c272-2cdd-4487-b16f-f64828a6d6cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683093, "uuid": "491b90d6-5223-4dc6-9203-f8e6f6568d19", "value": "ad_ru.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8944838d-7d91-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1755672447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672447, "uuid": "80e7514e-e549-4163-8986-b450e13b76fb", "comment": "Malware payload (RedLineStealer)", "value": "baf0e23a0852a51e26cc01527c5d70a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672447, "uuid": "0b0ba841-899f-42ff-ab43-62086410ea5a", "comment": "Malware payload (RedLineStealer)", "value": "2bfb116c87a739c99be5f189f8a0607b68bff49c755cab33c1daa8a3113b7c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672447, "uuid": "8708df59-b6a1-4b7e-a1a6-92823f3934f7", "comment": "Malware payload (RedLineStealer)", "value": "be6aa6719d2d4a1596d1c37b1bcdf3f8acdf98a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672447, "uuid": "f69c41f5-1acc-4204-bf82-bccf06416401", "comment": "Malware payload (RedLineStealer)", "value": "0fe82303d4a05a5a8c8d59e5bf75cc467acf76e80a525f95771b3efe46d0359605084e0692cb77cfa02d9b26c0562ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672447, "uuid": "3b4cf8ce-20b2-4a5f-a844-dac431fd1bd6", "value": "T1F535BE027391D022FFAB96334F56F6115BBC79260123AA2F13981D79FA701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672447, "uuid": "2add1405-d751-4c14-930f-3f3f8a1bce99", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672447, "uuid": "28fb3063-45ca-4db5-b4f4-cf0060a5b7e9", "value": "24576:Q5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMG//ALpq1i9:QPVt/LZeJbInQRaMSmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755672447, "uuid": "8b1d56f2-d6c6-4408-81df-db352aac683b", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755672447, "uuid": "40e8aa2c-4d7c-41fe-a652-2193ee35b074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672447, "uuid": "9f197a33-a3c3-4e1e-86c0-7a14bbf9d83b", "value": "noah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd83a14-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1755695725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695725, "uuid": "370f2e43-2590-4671-98f2-34ff2bce4789", "comment": "Malware payload (RedLineStealer)", "value": "888f19d6a9aa7e7dbf0a0631a2846092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695725, "uuid": "577a3bf6-8e87-4cf1-8b88-f2b5c0535110", "comment": "Malware payload (RedLineStealer)", "value": "2c7de71de889aafad05239bce7583f33677e527b1b12f30c313351fb8844af17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695725, "uuid": "0308c914-7fcc-408b-881d-e46ffa6708c6", "comment": "Malware payload (RedLineStealer)", "value": "c765ae734e9f46ec71d1353d6a5848e3169be005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695725, "uuid": "32ce051c-a986-401e-ba5b-acf8a9619116", "comment": "Malware payload (RedLineStealer)", "value": "af59afea2f174c37b237276fbca5c21cca9271c80ae92776301279dd8f05cc5fbf4d71c9293ae67770e10c14e7860a7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695725, "uuid": "cb5650fb-bf9a-400c-bfac-01df5924c005", "value": "T141D42286AD912E54D1507370C432CCB096793C719C56733EC76DE9AB2C343C2BA63AAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695725, "uuid": "d1636368-8343-4fc1-a625-ada5a2f9717d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695725, "uuid": "ea144dad-9b3f-4921-9e38-a92d62d01f2e", "value": "12288:Yz7hU5I5yuNHIgzSFKxWltRohBfSTso93UYis2smrQBTLwIbJkHXS9oe:Yf+iN57Gtene3GbWTLF+xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695725, "uuid": "f5bf119e-6e39-440f-a4dc-3292670dc9a9", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695725, "uuid": "d9fb81d1-c4d2-4e9d-92e4-8288cfeaf4e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695725, "uuid": "fb51e952-5fca-4b4d-8180-68b55752beb6", "value": "Dhl Tracking.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e215255c-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700513, "uuid": "8123fc5c-d52a-4987-a8cb-5097e4a5a04d", "comment": "Malware payload", "value": "49f90901d0c763d464e4afe927651981", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700513, "uuid": "afcc75a5-5d68-4579-bb09-c461bf458804", "comment": "Malware payload", "value": "2caa92a20feafe5b9bfb44b55b41939c26968017b1d620126ea1a17ba820f541", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700513, "uuid": "ce8d07dd-6cc7-4af2-933b-4906fc1eb431", "comment": "Malware payload", "value": "2cd455841a7ea02fa41298c2384547590786ecfa", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700513, "uuid": "c532c671-ff57-46ba-a357-401646f83b5c", "comment": "Malware payload", "value": "5d4f4734db9c8c6cfcb9d916e448105c59fc863393374e262db631b11db3b2322c74ee392f5792052bcbf786a19c844b", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700513, "uuid": "8e008eb5-f806-4952-a30b-2ae3ba396753", "value": "T1B0A37B0175D1C035D8BE19355868DA719B3EB950DFE0DCEB3B9506A90F302D2EF35A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700513, "uuid": "b9c9ed81-fef7-49a1-a8c5-00cd4babf1f6", "value": "affdee779abe29db981f9b49c43301e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700513, "uuid": "c96bc349-e043-4f25-9677-fc5a513402aa", "value": "1536:fkgFqzCDTOf/278SbGcEJkyUNt8QyPybDy9gzneesW5cdwfIlldZ81+TGH9:zFqAOH2qcEMmQyPyqUnmwfIlldy1+T29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700513, "uuid": "7e6146a0-6be5-4b9d-90c0-4266ee91e771", "value": 99088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700513, "uuid": "8e780110-2497-487b-9086-0c99842c9122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700513, "uuid": "b825c719-7e88-4887-b773-27fbd457d6b0", "value": "2caa92a20feafe5b9bfb44b55b41939c26968017b1d620126ea1a17ba820f541", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e9d4ab-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1755692661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692661, "uuid": "0a2e4310-4cc8-435c-a1ce-1e9b98500846", "comment": "Malware payload (AgentTesla)", "value": "3789c90b217dca894cebe98b93d4a714", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "andrefelipedonascime", "colour": "#53C268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktc2005-com", "colour": "#4C191F", "exportable": true, "hide_tag": false }, { "name": "mindless-kettle-surge-sh", "colour": "#D71DD4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692661, "uuid": "71f9a3a5-4b12-4a85-ac48-80bf568b56d1", "comment": "Malware payload (AgentTesla)", "value": "2d02606c43b8a9be066c030f5d47833058357b216790ab05f5399eafb433d83b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "andrefelipedonascime", "colour": "#53C268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktc2005-com", "colour": "#4C191F", "exportable": true, "hide_tag": false }, { "name": "mindless-kettle-surge-sh", "colour": "#D71DD4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692661, "uuid": "99d0a617-9d5c-4e10-a12b-e7625a06efc0", "comment": "Malware payload (AgentTesla)", "value": "0658373859224551e7c83506cbab685b366c3c8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "andrefelipedonascime", "colour": "#53C268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktc2005-com", "colour": "#4C191F", "exportable": true, "hide_tag": false }, { "name": "mindless-kettle-surge-sh", "colour": "#D71DD4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692661, "uuid": "2be8f173-8601-4580-90b2-c0ad315e1cb7", "comment": "Malware payload (AgentTesla)", "value": "59e34ad72555c3ee8fdcd10f3bc92800e5a84a75d7bcd5cfcfa7b0b74522678a4c32874e021cd033696f75daeef868e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "andrefelipedonascime", "colour": "#53C268", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ktc2005-com", "colour": "#4C191F", "exportable": true, "hide_tag": false }, { "name": "mindless-kettle-surge-sh", "colour": "#D71DD4", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692661, "uuid": "7ae2fe75-126b-417f-b1d3-b8718f6aed0b", "value": "T15F84F12134C0C1B3C4B7043589E6CB759A7A7071077995DBBBED1BBA6F212E0A6362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692661, "uuid": "18053ef7-c601-4906-b4c8-c33921f8ed91", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692661, "uuid": "fb6d479c-91fc-4b57-a7b8-55f143041fd8", "value": "6144:fDKW1Lgbdl0TBBvjc/X31ZqyfpoQeXP74I0+uefG0ZU47W/q4bz3xxa:7h1Lk70Tnvjcv1ZqMpVe/74I0Si/Le", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692661, "uuid": "af8bb6b8-feb4-4a95-ac89-50908f56dc09", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692661, "uuid": "ee40073e-fcfe-4cc8-83df-0c908f9b4aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692661, "uuid": "ba94c423-1038-4d89-8974-3cade86fb26d", "value": "final-payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758c223e-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683151, "uuid": "88d727c5-5763-4a44-bd32-618aded5c7cc", "comment": "Malware payload", "value": "61baf00df41bab70ad141dc366e3dc44", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683151, "uuid": "ead0bbeb-ad45-4364-bb04-95ea6d8a2e74", "comment": "Malware payload", "value": "2d1185f5d264b1d756d6d16d2beefcce4eb5d0b0eba29a7c5d83a3ad7b130a40", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683151, "uuid": "dd25b02e-1b52-4b87-95c2-036ac476616d", "comment": "Malware payload", "value": "fa0cf4e5071692b63acff0e041d3b09b1d365fda", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683151, "uuid": "38797a43-376e-4624-8568-403ce58a3b5d", "comment": "Malware payload", "value": "03a92b115707f54abd54b21480a6d96b158bffa510d8a81c3db381d16fa5e53a9cbad1fb004c7b047552e4251ee32a2c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683151, "uuid": "cbd8c6a3-3b82-4419-b0f3-c830c7fd8302", "value": "T10E43269263CC07A6E94804DA11B9651BD1F2D03D39662AC4DAF3A757F83A653FCB8370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683151, "uuid": "a4042c0b-a941-4a58-a039-8e37bd6f7074", "value": "384:JC7SjW2yr8p/W7L3JJ7io14cJuD4Bn/4T1cKWqGf2yr8puC7SjOYlQkRb:jjxEHrio14SuD4B+1cKWqj2jOYlQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683151, "uuid": "661165f9-1a3d-45d9-a5f9-c83c26d3a294", "value": 57822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683151, "uuid": "d40e4229-4e5e-4b8f-a427-003269375ce8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683151, "uuid": "8cde8b14-3328-416b-a809-e77cb8d6ef53", "value": "owa.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de363e78-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755703513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703513, "uuid": "ea671ffb-79e7-40b8-b331-9c885b61c161", "comment": "Malware payload", "value": "505622bde2630805a5c853d7c3514ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703513, "uuid": "69e33bb5-897a-4f99-91d0-13023a6853ee", "comment": "Malware payload", "value": "2dbe6dcda7e8c51276da7c5635cd52fb044cfb2278b7d3c3f045d4037249245e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703513, "uuid": "44ff7ed1-6f00-49dc-96c5-3280037ad38e", "comment": "Malware payload", "value": "00e3524c9cbf1d6133c6d2f05c58499185c0253a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703513, "uuid": "fcbd9f23-9516-4570-b3c0-42e100873b82", "comment": "Malware payload", "value": "90aeae760bdca32aa99f681c5f91b95ac0246f775e9a5e41b302e69c5890a1cb7d9a4a98bfa0a8e6f16a64b2e970c73c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703513, "uuid": "63fef415-3aa0-4883-97ca-8a20b45c53eb", "value": "T172764A57EC6145E9C0B9D13089769262BBB27C484B3123D33B90F7282F76BD06EBA754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703513, "uuid": "a8fc1dfe-fcef-480e-a7e5-a76bdba77661", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703513, "uuid": "1d483710-8e29-4d36-bffc-a7001fd6b8f0", "value": "49152:r/3q1uoQ5EXAY2sugaok8jnhmstzXnAc1e8mC7LYJvne1pWXB4EJVxEtFpMbXMK8:rvvwactLAccrnOkbX813m7jFEEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703513, "uuid": "dae4868f-b570-4d9e-b8c7-001cee14a9c6", "value": 7759360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703513, "uuid": "e02dcd4d-d5d7-4dc1-b38a-c513cc1ef71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703513, "uuid": "20eef7d5-baa4-4adc-beb4-0b6548653edb", "value": "wIiwRJJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a6e4c4-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755692760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692760, "uuid": "610ec61d-49a6-462e-9409-580b635b5592", "comment": "Malware payload (RemcosRAT)", "value": "3ce52c9fb07a095c7885e91f4924c0ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692760, "uuid": "b6b91cb3-52ba-4bbd-a65b-f21773b6f2a9", "comment": "Malware payload (RemcosRAT)", "value": "2dcb95ebe5144f45e045bc0e92ec983ab0ead6e7ae72950ea178de51760cd06e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692760, "uuid": "f439fb41-d159-4bcd-8998-e25f0f1a389c", "comment": "Malware payload (RemcosRAT)", "value": "362fc953a06ee8c923b912543ad00a244f9f23cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692760, "uuid": "3e599081-8511-4165-8457-4c7827b1ab39", "comment": "Malware payload (RemcosRAT)", "value": "4c9f9ac28840bedb2848ce9550e24a36e3f1e23e354f5a499e63d4cb6515d36dc487218004311576668dcde2c38cc17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692760, "uuid": "de577697-42d6-4de6-82f7-93d84741f24e", "value": "T1AD85E162F1D14633E4321A34CD6B96B4982BBF612E2CE8557ADC7D8C5F363C23825297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692760, "uuid": "9dd4aa7d-9d5e-4039-b326-09640841ff15", "value": "c5097c4844a18a789c2c97ff3f7431b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692760, "uuid": "7e8cf2be-d550-4c19-a180-6b1a8ebbd17a", "value": "24576:mPI9NxLxG6Bl93ZldYtVsH+xyPyoUkEmMi58Sl58y6nsOFzyj03TJsZCS2rNiMcm:mPIq6wxyPvUkEJIh2bvFGgNs8S24Mh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692760, "uuid": "13b04b99-c65b-498f-9240-96f9e4293042", "value": 1788928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692760, "uuid": "af74276b-7f68-4aa2-a585-429f0dceaa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692760, "uuid": "32d25e1c-52a0-492e-b074-13f98221f5d9", "value": "HG9876543456789000987654567800009876543456789000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f10c7d8-7db0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755685691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685691, "uuid": "edb2d703-57e7-4e1c-acbe-84f03922f154", "comment": "Malware payload (Mirai)", "value": "25e09d364c48bf80820856e2edd01d30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685691, "uuid": "d8970c98-31f5-4be0-9e53-d2983a1cbb10", "comment": "Malware payload (Mirai)", "value": "2e7a8cd6af4292d7d8ddb069bfcfb32e4d08e3c82eace278d0b73d9ae0311d49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685691, "uuid": "ba496b3f-d570-4575-9747-8fd39dfe12b4", "comment": "Malware payload (Mirai)", "value": "b6eba4960f1c08037bd8297c895cbc3b2b143479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685691, "uuid": "c433a0d3-99a8-4815-a463-68af4b67e0d9", "comment": "Malware payload (Mirai)", "value": "3880a3d5e7ac47de941c556773e20e0aa4bc6643e1f9fb16c37bb81c21a6713981b2bd8e11d65589017c945930ba1c4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685691, "uuid": "415c6d6e-7b5d-49e5-932d-5b00a1cbc2f4", "value": "T1D7732986F68B80F6D4570D3050A7F73FCB71E96841B19A6EEF4EAF35CA379419212248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685691, "uuid": "26e864ec-742a-4b6c-9ebd-c497a9ee37d0", "value": "1536:nHxaJIjrGMf4GEfzXRvmUxmLN6BKMIOhFWtsnXZ0CEZJ2qPwtiQtw:nHxa2jr5fOfzXRvPgLN8KFOnXZ0vZkqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685691, "uuid": "126aee3a-655f-4cc8-a80b-5840e4c880ab", "value": 79056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685691, "uuid": "0ef01503-9969-4988-9a63-cc4ae2f88713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685691, "uuid": "9a9bc0e3-5a89-4534-9329-fa08d3412fa3", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40817e89-7d65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653427, "uuid": "8a0a72d8-6fd0-47eb-9ea6-9f468f824826", "comment": "Malware payload (Mirai)", "value": "f6dfa1ebda7c6d5992f087e6e6f91f83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653427, "uuid": "373626c7-4b35-446a-8603-78ef6aa69e48", "comment": "Malware payload (Mirai)", "value": "2f2f1d3747fe2a9b67d0aadf81904c6e14f51f67a1976effc8a7fd7d24b81b6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653427, "uuid": "4f4ae22d-b79d-44b6-870e-459b0aba912f", "comment": "Malware payload (Mirai)", "value": "b89a8837f36c54e205dfb30ab37186d32dc30dcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653427, "uuid": "9e7eb0d5-cdff-4004-a359-ce5eeb4614c1", "comment": "Malware payload (Mirai)", "value": "0fb3a1fc8380172c7d588267919a6e3f43b4a74a0cf7067393402c7e422371c6e403672a7f2b2450368382368b6f0680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653427, "uuid": "877a3c99-7a53-4fd1-9794-80cbabb059dd", "value": "T1DF03E1C29CFF570DF2A911B35CFE79461421669C6886AEF46341B22A76C3F142B18F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653427, "uuid": "6ff15a97-0111-47be-a79f-f3b9c200910f", "value": "768:4k8SXZQoydUhlTMq8atkdLktypbHKIYIdvqyIJ9UInbcuyD7UHQRjj:4SPy0tvELkMJq/GCyIJxnouy8Hy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653427, "uuid": "ec5c3cba-fcbb-41a5-9ad1-2d5c6eaf71a7", "value": 40528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653427, "uuid": "a24d01a4-07f9-43d9-a370-8168553b7ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653427, "uuid": "28e1f30c-8d95-4847-b2b8-87a936eab91f", "value": "nwfaiehg4ewijfgriehgirehaughrarg.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc094622-7dbf-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692343, "uuid": "8d68496f-68ab-499e-8639-56825e281565", "comment": "Malware payload (LummaStealer)", "value": "27f6c5d50f3e16e88259a61f5b81f345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692343, "uuid": "23480981-bf4b-4f57-8470-279cfd3d987d", "comment": "Malware payload (LummaStealer)", "value": "2f5561a0b8268a796b97b58d38421fd3d377e4b280825120f00fab3292e706b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692343, "uuid": "09911e13-c2e3-4e24-9cc7-9760d82d539f", "comment": "Malware payload (LummaStealer)", "value": "0b04c8f67e747a0200972328784721107824795a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692343, "uuid": "20eea857-1b0b-4e02-921b-c38ab0b932fe", "comment": "Malware payload (LummaStealer)", "value": "f1c05a68d2ebace9b06c27a5dac7b03a0f5211aac08183e11a6dc266b9be181b201902400827ca64778e8464343a68cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692343, "uuid": "e4df3eda-3b25-4fe4-84a5-7faa23f48f80", "value": "T19675290278B11CFDE6BEE1329AA26110B5B375E50333778B1A45059D96AAFE43F2F314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692343, "uuid": "06221991-ff1b-4fe2-b049-5d68151c64af", "value": "25c4fb4a248389347ae9cf0ce6995420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692343, "uuid": "909c7c85-351d-4a13-8587-4c8071ef8261", "value": "12288:AxjAdXKIWv5cGyCKtkjt7KILyqGCMdHK9F0CSkRxEjIqgGTHza6gtwNLAh8L1p95:FK55cGyCKaJ71eXfqRWggQKsT/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692343, "uuid": "7eaf739d-abf4-429f-96e3-dee79c36e978", "value": 1614056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692343, "uuid": "5b496443-97a1-4e42-901a-672b3eea069e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692343, "uuid": "37a61c9f-d7d3-4d0e-91aa-186e1c71a30b", "value": "\ud835\udc7a\ud835\udc6c\ud835\udc7b\ud835\udc7c\ud835\udc77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6026d8-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698652, "uuid": "1ee3bca8-d2f9-4f10-a310-0ecfbdf61e6b", "comment": "Malware payload", "value": "be6276a980fb50d4a5343ec88500d129", "object_relation": "md5", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698652, "uuid": "3c7058a1-8a05-4d80-b7a6-4a34c6f89ded", "comment": "Malware payload", "value": "2f57c1ee409b690337bc2d95863455d606917ca60d207c3d2bb0cf2ccd0bb1cf", "object_relation": "sha256", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698652, "uuid": "4c10cbd2-8614-44d5-bd9b-0bf333c4d1fd", "comment": "Malware payload", "value": "01921fd8b126c0f06d54b615c759fb08ef3dc985", "object_relation": "sha1", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698652, "uuid": "ac3490b2-c323-42c4-8274-c95b52569e4f", "comment": "Malware payload", "value": "c07915fd6976c71f9f9a3433feebc9f231b3258fb1cec44bf1b1043de518394dd45a1f023f9ac6b0a3bb8d1ead66a619", "object_relation": "sha3-384", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698652, "uuid": "5c508e41-a352-4fa0-9385-0d272a9fb3d5", "value": "T16F048F43AADC7CE2D039533133BB83D0C72EEC5459A1C91F66D002AAD97D553B922BE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698652, "uuid": "bc637363-ba78-40f8-8bb1-7d683425a819", "value": "6a5e409e89a5678680535aa9cccfff00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698652, "uuid": "df8e76ad-fb40-48b1-b4ad-d53fc689335f", "value": "3072:JismrLDeNqtEG7DXK6MO7teqIa9rCVTH:JiXr2N8DpyTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698652, "uuid": "41a63826-881d-4310-b19f-9dc539c42fd1", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698652, "uuid": "23cec8de-cf27-4ff7-9cdf-e9e122860de4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698652, "uuid": "4637d3c0-d3ca-4aae-b783-8928474210f1", "value": "2f57c1ee409b690337bc2d95863455d606917ca60d207c3d2bb0cf2ccd0bb1cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ab3c0b-7d7e-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1755664408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664408, "uuid": "3ba6cbb3-9a37-43e8-b6a8-08fe04ec99e1", "comment": "Malware payload (ValleyRAT)", "value": "8952e969222ba3142c4d5cd2e2f0f947", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664408, "uuid": "f6db50da-40ee-41d8-99bb-d986a761a927", "comment": "Malware payload (ValleyRAT)", "value": "2f5d28ea6c52666c11998a2197fea5974a3f45eeaa7926dc571b30d4bace617f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664408, "uuid": "ab2d20ab-cac3-45f7-b7a8-10d37c1b7b62", "comment": "Malware payload (ValleyRAT)", "value": "a9e9d3186d9cb68676e719a6d23e0a1f911ae01c", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664408, "uuid": "ba567084-1db7-474b-babe-ded16238e239", "comment": "Malware payload (ValleyRAT)", "value": "d6d1438780528e782f25d47484915a98f9811eb1e1909ce0ee1eab5930bff7724d1473aa4efe6dcd3dff644d4c2a73ef", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664408, "uuid": "81ce4775-cc88-428a-881c-7a26b0849797", "value": "T120B73347D9426E76E681163FC4310C806D5D2EFE6EE099881EFCFF4E26383D29168E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664408, "uuid": "c5899760-bee7-47db-a64b-df6b3fb1e578", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664408, "uuid": "8e58af31-f0dd-4872-94c8-7ef44d6c38da", "value": "786432:i6I8maBnUwQ72cpUUU+VTHtnrYgcWYpmAM7Bin/iVK8IKIVm0Xb8fE8KulziC:i6fLNQ7s+VT909Ud7QiwTk0I3XoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755664408, "uuid": "1c8b3383-1c0a-4350-af30-e726c64ed334", "value": 49912723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755664408, "uuid": "6177f406-65d5-4ad5-b4aa-8cfa6d518d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664408, "uuid": "8dab4dbd-52d1-455d-9356-503d4d5f5f4f", "value": "LD_ply99_windows2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996734a9-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Sality)", "timestamp": 1755706404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706404, "uuid": "f783dff9-4d57-45b2-a150-bdb5d5088e74", "comment": "Malware payload (Sality)", "value": "9caa356fa5581b7e8f7d7e64d520223d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706404, "uuid": "516d235f-bd3d-4dea-b6be-2d5f12ae4ff5", "comment": "Malware payload (Sality)", "value": "30a9291c7713404a55cc3025689f8305aaf31fb9492a5612841b80f1d2aa45ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706404, "uuid": "cdabdba9-1284-4e1a-89e1-39d9219a044b", "comment": "Malware payload (Sality)", "value": "e6ae4dd7729fe30104c594d4bc7ee0f15cca4a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706404, "uuid": "821cae8b-e5e9-4dc3-a393-86f54e8c94ed", "comment": "Malware payload (Sality)", "value": "4058601b8d59bdade12f77e61e9e438d62e8cb1b88d20690025c369db15e0fea1a0fdd59b71bd6329d64ef35742cba1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sality", "colour": "#CBF9CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706404, "uuid": "9e340e47-2bad-493f-b6d7-a5ee506e97a1", "value": "T1E3251242B54081F1F4107532E95D27A79A317C3AAB50A11B63B0BF6D3DF02626E1BF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706404, "uuid": "2ac8e29f-f054-4b74-81ed-5dace3c6a729", "value": "ec52b856484588a741da264a7e0bd180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706404, "uuid": "733b5ca4-2a46-4db6-84c7-0b3dc63ce021", "value": "24576:5wn0a4mZ4Nj9KRpRoUWmmKKR+Pz3VZcwZ60PX0wS7fLIonJwDl7:5wn7VSNj4fWm/KUPDVZnZfPtEL7c7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706404, "uuid": "1e190ae0-54cb-4778-9204-004189d94b6f", "value": 1023725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706404, "uuid": "a5f16c17-a193-487a-8433-525f4eb64c5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706404, "uuid": "fc2154f8-fd5c-4113-ba21-5a59417210e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1c7b9a-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755680020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680020, "uuid": "a8c7627e-c179-4f98-8d8b-6d6cf830c0e6", "comment": "Malware payload (DonutLoader)", "value": "b3c9cfa22c8532253e644936b1257789", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680020, "uuid": "33e9e303-7247-4337-881c-2f3135f6c206", "comment": "Malware payload (DonutLoader)", "value": "30d3720e0b4b9319fa62ceda52321c366a6cedee3850478916aadf9e59e80221", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680020, "uuid": "5a13c5ae-85aa-4e64-8cc4-fe270fb12174", "comment": "Malware payload (DonutLoader)", "value": "6757386c1fd8dee3dc3e7446cbfe52a4d3ced0a5", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680020, "uuid": "df133e73-4698-4d16-b80d-c741fa79036b", "comment": "Malware payload (DonutLoader)", "value": "da8f13750f89683e8134b88c4b34ee45cc331025e36429b07f09bb9641cbd019ec6e1592a4a9b413c481d78e763c2c5d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680020, "uuid": "6029e3cf-f541-49a1-9ebf-f69118fce532", "value": "T1CCB533805CAE7C794728433C767B1A0E2E984FA18A4DF1FF53E256AB376EBD06117814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680020, "uuid": "d3e3853d-cc2b-4ef9-b158-d8f8abddfe17", "value": "24576:h6SzNBG/xvwKtRiWUwLHHlieQI9xRMCsCAhHsrycso70lxKpxgnaPpsu3kw7IT9Y:h6YG5wcRjLD9AhcyZooU8aiu0aM2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680020, "uuid": "fa8ab733-ebf0-4c09-a429-4e15730babba", "value": 2268972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680020, "uuid": "d73d7431-5461-4736-833b-0ad5d667580b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680020, "uuid": "ad53f6c2-6b5b-4175-a92e-d36ecfdce0ae", "value": "30d3720e0b4b9319fa62ceda52321c366a6cedee3850478916aadf9e59e80221.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65d20cb-7d6b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755656309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656309, "uuid": "001623d9-99d4-4e3d-970e-683417bc710d", "comment": "Malware payload", "value": "dfaf501ffa1236dcb3392d78a273bd82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656309, "uuid": "4dba2570-9166-4c18-922a-684880d82fbc", "comment": "Malware payload", "value": "3101ee219b37642afb50f327404ff97b06ab3cafee1ccc2bf49b0a499dd6f47b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656309, "uuid": "30e82582-2be9-48f6-b314-ec1990e01f73", "comment": "Malware payload", "value": "e2d7c45f5f0b0a98aeed9b43f95be78eb3bf9ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656309, "uuid": "b9eb33bf-105e-4f83-9749-63091e378b6e", "comment": "Malware payload", "value": "8088398d34dba12e92237fa59675b03527abd2f30e435754544b9f15cd7df6c6cba1bee30863f3a1f504d4713d3b4de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656309, "uuid": "c6421116-2ce7-466b-b278-dd84d4f7c2e1", "value": "T155B3049D32D071DECA67D4729FA86C6CEA5174BB831B5203A02306ADDA0D887CF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656309, "uuid": "6801cb10-86b5-4926-bd1e-9df0c759b9d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656309, "uuid": "aa43ff7e-1723-4e58-b571-47ededfd5cf8", "value": "3072:RiEBplKemy9rJlPd1bMQlMG6YTDF2u2lQiWok3jrvmLv:1Bpl2y9rJhbtlMG6YTDF2u2lQiWok3jU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656309, "uuid": "d07820ac-63b4-4f8b-a247-7d56d09f6775", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656309, "uuid": "7a79800a-707a-40fb-8c72-3d81dea64083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656309, "uuid": "ada0ab16-9f8c-47fd-9cdb-60a08e00aa75", "value": "SecuriteInfo.com.Win32.MalwareX-gen.35788449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd235a2-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755700828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700828, "uuid": "553ba507-b93b-44f4-ba8a-ab23cd995733", "comment": "Malware payload (XWorm)", "value": "fcfcbeb5322cc1f2cc3d8abbeac06814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700828, "uuid": "4d5be170-9c76-4949-9784-d697616c05eb", "comment": "Malware payload (XWorm)", "value": "314d0fbf925c53f52ff40ff6936824d8db25e4e0c23134aa572aa1828faacedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700828, "uuid": "7fd71695-8537-43fa-bce0-20b228a0a170", "comment": "Malware payload (XWorm)", "value": "7792dd9bac3de22c2a026e055432af83a4e358f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700828, "uuid": "d3d4138a-17c2-453f-90ae-b7484e5aba03", "comment": "Malware payload (XWorm)", "value": "5727face004c66f371b60d8fa61493200821c67753ba7e2fa0e0ee600c1aa4f2fac5b85dd5284b56aedbc4621650f236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700828, "uuid": "b380702e-e3b2-4d0b-83b6-dd74486687c2", "value": "T14005AD066AEC01FAD2A2D33989E25982D7F73D5793155FCB02D58D4A3E9B1D0E87E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700828, "uuid": "e12fc842-6809-4f15-bbf2-86591e68f519", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700828, "uuid": "2e90cbde-6a5c-4eb0-bbf7-9f3a23fb270f", "value": "24576:qKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIw:T0op", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700828, "uuid": "643f45e2-da97-40a3-b854-0d6b9bb47cf9", "value": 854631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700828, "uuid": "8ec1213e-13bb-488f-aa0b-ba58b76fcdd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700828, "uuid": "549313b7-8dd6-4942-9bf7-0853ea98d7df", "value": "fcfcbeb5322cc1f2cc3d8abbeac06814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ff14da-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1755679723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679723, "uuid": "f605b9ca-7e5a-41c0-bb8d-988c165f0629", "comment": "Malware payload (Cobalt Strike)", "value": "a5129073c231699032f24b79d7191adc", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679723, "uuid": "9bac97d9-53c7-4eb5-aff9-71c7e7a47eb1", "comment": "Malware payload (Cobalt Strike)", "value": "317f057e1d593b35eb9a63319e9cb210911f070f8d0ce97ec5944fe5ea602788", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679723, "uuid": "db9cc03c-da23-4d7c-87d8-70c6ce3a954e", "comment": "Malware payload (Cobalt Strike)", "value": "1329696688ea07832645024056bd34c7126d543f", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679723, "uuid": "13952697-e983-42d9-b054-744c1d4fa15d", "comment": "Malware payload (Cobalt Strike)", "value": "c316a5347fb42a58788b230832ee5664599931d66656edb06a73e9a8e9f356609fe3ae28f8657a72d61a94138f6aa0f8", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679723, "uuid": "bb62465a-d58a-473d-a166-13db2cec6775", "value": "T10892D82FF70364DDC117D1B885E66B3299B23822546A772F5778D3702F112982B7E924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679723, "uuid": "cfedb2a8-c3f7-4c2f-b115-1de816f96353", "value": "9133e54115603c0107b8f985598440d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679723, "uuid": "0bc2b977-24ac-46a5-9e42-b11474ebfe6d", "value": "192:CRb9yNFe4YK7AtGGc/HejzPssH3gk2/tp1eMZgq/V5nnnsIvGakjs6rvANExnI2F:0R4xYK0nsC4k2/tp1kaBX6MSxny8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679723, "uuid": "63678dba-95d0-4b92-82b1-5eaa5631a06c", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679723, "uuid": "6f55eb15-8b64-4fba-89f6-c0bbe6128b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679723, "uuid": "d74b41cb-a5d8-4063-8e0d-0b0e13b0d379", "value": "artifact_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bd1c19-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755704333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704333, "uuid": "e40e5bec-0353-4047-a8bc-2bce40fa71bd", "comment": "Malware payload (Mirai)", "value": "733e3db6b2efe8ed102171d2bd617725", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704333, "uuid": "88d335ae-de9a-4751-8952-657e9a898d75", "comment": "Malware payload (Mirai)", "value": "31ae01390882726813ee729431bd26093bfaef1cd87bc5ec8004e93a18349168", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704333, "uuid": "28b1b1cc-8e9a-4d1b-94a7-97cf7e4a8667", "comment": "Malware payload (Mirai)", "value": "aa97d5759636158c730a072f944ef6abfcb2f14c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704333, "uuid": "3ba7f01b-975c-4b38-8399-19eecb42cf5f", "comment": "Malware payload (Mirai)", "value": "3fa8b28e079bf8559c0b0c8990d02a302c318a611ba60f3ebd72ade464757eff85b43a67eb301ed92b4bc58f1e8fda1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704333, "uuid": "2af4c73a-e3fd-4e85-8f6b-039651f4d045", "value": "T12CF058DFB82017C3041CEE0FF1639849605293CC90334BA8BDCE95696DE4910F514E05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704333, "uuid": "dd84e09a-5739-423c-a20f-a07fb017e0ea", "value": "6:tfLwVIjXWBYF6yx0FXWBY3fAIAjXWBYTNNIl5H5XWBY3a0LKiM6LSXWNM8NIQXXS:tzwiFW3o3ThNIl5tq0LKjI6jQPZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704333, "uuid": "b1192dd8-966a-46ef-ac39-5cbdd1e5dfb7", "value": 469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704333, "uuid": "88b4cd73-57c3-45a2-b6e8-bd2ae1548908", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704333, "uuid": "fed0e9a4-cc33-40b2-80f9-6b7d1c7c44e8", "value": "wt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c771ca9f-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755704334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704334, "uuid": "e5a9c232-b926-4d17-ac47-f042e33f815b", "comment": "Malware payload (Mirai)", "value": "46e161ae478164b7342b683110c07920", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704334, "uuid": "74a4776d-bd75-470f-8b62-48877f655303", "comment": "Malware payload (Mirai)", "value": "31beac028f961b6590d26aebebaf64ad084fee9cc0f6f39b40e3b146a26e0ef4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704334, "uuid": "51ec365a-b04b-45ff-8ae5-130d892a74c2", "comment": "Malware payload (Mirai)", "value": "d912832ae2bbef8d931233dabe885d45e6b757f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704334, "uuid": "84589ff2-be35-4204-9c4b-5515da3e8d03", "comment": "Malware payload (Mirai)", "value": "75bacec75690c0184db987694ca4277d09dfb44d53c8ad9dfca571748197df7768481f6854c7d13d82a4ca2c7e168afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704334, "uuid": "e3ec30d3-1b8e-4226-8df4-b8e35fd52baa", "value": "T15F14A51E6E228F7EF66CC73047B78A34976923D627E1D644E2ACD1105F2039E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704334, "uuid": "6838abad-6083-469f-81ad-e424debc8bd5", "value": "3072:68PopBfhx3Ln+aKFLjd4VfZU4JEc5vz/MDhwI:68PopBZx3LnMJydZH5TMD2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704334, "uuid": "8bada340-b52a-48af-b50c-7ce5b054eccc", "value": 203480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704334, "uuid": "8d615e80-1758-4703-9d67-d493ee5089e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704334, "uuid": "d04cb58d-a645-419a-87ed-e41d043f4f23", "value": "gmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb22c2a0-7d62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652452, "uuid": "c2b3cc36-f8f9-4513-ace6-07fd38f641df", "comment": "Malware payload (Mirai)", "value": "af9fa0c09c32d1a873bc3368c6d99870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652452, "uuid": "b0b97e0c-98cd-4672-896e-80a29f54807c", "comment": "Malware payload (Mirai)", "value": "323f4d7fc643b4e2304504434c5ec5d97d3b337b7acb4208df98ae9a5b94691a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652452, "uuid": "e9e157d2-4d69-4174-a579-8e69882b6eff", "comment": "Malware payload (Mirai)", "value": "3387928c10c0087091a4fbce6537a818c56d8bc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652452, "uuid": "a68013f5-b066-4f7c-b8a2-200c32e1c539", "comment": "Malware payload (Mirai)", "value": "aeb0d538be4c28ed810ecf5a99027251d1513cfd9264ed7f256e0c7ce1769c47eb0372fb3af749197b31ab9ea5af7a43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652452, "uuid": "18cbfc2e-e85c-459a-b7d2-933e93bc2e5b", "value": "T1A36302903610EA38D8F77BB775E806434A569D33F8EA7AED7575B5A21C3418028ECC87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652452, "uuid": "31f78b74-0af9-4097-8520-b998af71fd9c", "value": "1536:SG+gYQHTlYQXbR9gAZGmyY+0yL9BKxEZk07/SbNoY/:SGVpHTlYQXb/cY+0yL9sck07uGY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652452, "uuid": "db3ffc8b-b2ae-4641-8335-2e98830549d3", "value": 66936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652452, "uuid": "a387beee-81b3-4998-9ee1-9c3e6cd995ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652452, "uuid": "91473482-bf5a-4f2f-891a-6ca4d9c47056", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a588ef-7d8c-11f0-91c6-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1755670211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670211, "uuid": "d2aa07f8-2e01-4484-9ffb-8f498972013b", "comment": "Malware payload (WSHRAT)", "value": "73ac79c4e6375700441191c1c0cc18d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670211, "uuid": "841f79fa-9611-4ac9-9c7a-b74c5ce6fb2c", "comment": "Malware payload (WSHRAT)", "value": "3242c49ec0d1e3f98f34049ec4e388babf92e581b61acd0f04624fc4466017fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670211, "uuid": "f73b848d-f85a-4419-95f0-dbbd649bab0d", "comment": "Malware payload (WSHRAT)", "value": "ea762769559e7cb8c1ede0393a8e8eb2c4de7336", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670211, "uuid": "3dfc6013-5e7c-4f52-a1f7-0941b6adaa0a", "comment": "Malware payload (WSHRAT)", "value": "ad2b02e3489b0f23f93834a5ffd5ca363519fac2cec2db9847d97f1bf8603a9497f256be1bfa597c93d4115fec984fce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670211, "uuid": "446c3b87-d352-4ca0-bcfd-3eb472df1312", "value": "T1F664DDFA49EC9D543A478BA4013FFFE653C9CA574873B1888B15FDB16B629000EE4E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670211, "uuid": "1e830181-d8aa-44e8-ad30-f74a1ea5e66b", "value": "384:p3Sjj2gyhyO3ijjjjj7zijjjjj2QJQqpXbfzjps0fq6h7tWLIC9zjYjYjYjYjYj7:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755670211, "uuid": "c976c2b5-38dd-4027-a68d-08a19e0d8ad0", "value": 313037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755670211, "uuid": "c5122755-7989-4ab6-871d-2a1299a5cb1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670211, "uuid": "de9aa95f-1de1-4cfe-b232-c0c116bace33", "value": "numx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04261a29-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702288, "uuid": "a320172f-61dd-4263-8d58-50a5fb33f348", "comment": "Malware payload (Mirai)", "value": "3fd2d41e47d90766b1a566ff8abc20f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702288, "uuid": "26a05fcb-c905-4a29-9959-f9465506254c", "comment": "Malware payload (Mirai)", "value": "32d67ba1a2b31f014a4092f3ec8a41f9f0147f57cdca28ebed8dca28470ef0d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702288, "uuid": "dab3b7d5-c3b9-4399-9f5b-5f6dfd1c939d", "comment": "Malware payload (Mirai)", "value": "effee1dfd7ba4bbaf4aa44dcba3a8a4d9a31337a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702288, "uuid": "c0b66f50-73e4-415f-b36c-a78ed77a3d41", "comment": "Malware payload (Mirai)", "value": "3a57285a2cd758ae57049a3b72194bd36f64ecdd7f343fb7ae38863be60dadb497d2fb2067914881079128384370a89a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702288, "uuid": "c3e3a484-23a1-4ccb-b739-ed25c31e9591", "value": "T14423F1211F847870CF3094B1BDDF4F926E664BE441EA7893125A6BE02ADC45E3AF2743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702288, "uuid": "ba152656-224d-4aa8-86db-e70970039474", "value": "768:THc/MV+wUyFzYfbuRn117BTXW3AGN807+OdTppGLM9q3UEL1BZ3LPB7gwPa7CghQ:T8M3EfaR1Jt+AmQOxTsVL1BdLBVPa7Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702288, "uuid": "cbce07fa-f1ea-4841-9a76-45824ddde5f4", "value": 47796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702288, "uuid": "36cfdc33-9316-4f8a-99b9-4ed9f4f47c90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702288, "uuid": "241ac7ec-3abf-4720-9100-d525972a08c7", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637301fd-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755671525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671525, "uuid": "96df8ddc-bc93-4486-8057-645b36fd381c", "comment": "Malware payload (Gafgyt)", "value": "e6263431fddba413ff67cce6d16fcf1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671525, "uuid": "77a8b44a-62b7-4ed6-ac4a-7aab5f28851d", "comment": "Malware payload (Gafgyt)", "value": "331bb6a11ee0989c37ca12448d183a21b8d9bfe9091c8335fbcf91d91a7266b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671525, "uuid": "8c5c1971-4a79-4e8e-b154-2eb161c2d032", "comment": "Malware payload (Gafgyt)", "value": "1f79c9dfbb93ffd0630db7f311ff717fbc58fc4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671525, "uuid": "d0c4178d-43f1-493f-9a8b-9f5ab7b55336", "comment": "Malware payload (Gafgyt)", "value": "89dc08473addb3ce83111ea7dd27bd50bc6b3e6aa9e6164efe9221ea2c91f540dc8ff72e1cae030231dff98aca03b437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671525, "uuid": "a5d8b9db-8641-4b56-b93e-ac17fa33aba0", "value": "T1B3240A01B9518F53C5C31BBAB79F42593733AB24D7EB3301EA19BEB42F4669D0E2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671525, "uuid": "efad1ffa-9b39-4ba1-b860-69e2de2d5802", "value": "6144:HlW0LJTXvtlhWbo0DFD1RUwhwwIlhkNRi7mrokQtGykFZx1uxkc2cpvd:FW0L5XvtlhWboU1WwhxiEi77kQtGykFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671525, "uuid": "6c276a91-11fe-428e-ab40-608c1ec46021", "value": 214080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671525, "uuid": "632890e9-6c55-40bb-84a6-cadde6c13dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671525, "uuid": "a338abd0-9b9c-4f63-b644-fb94733fe8a9", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ee2d1-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755701931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701931, "uuid": "f18abe06-f7f7-471a-a652-2b20324b8166", "comment": "Malware payload", "value": "1d7a59a825fb2c7bf7c72e2c842bee38", "object_relation": "md5", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701931, "uuid": "69207835-b75a-4a84-95b1-8fe0d27dd663", "comment": "Malware payload", "value": "334dfbaefbf7e6301d2385f95d861eb6dae9018c48fb298a2cbf5f364fbcdb2d", "object_relation": "sha256", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701931, "uuid": "78f32594-8c8f-489d-a480-5eff4cac6a55", "comment": "Malware payload", "value": "c9184a4bc49f34d8a6d6ea91df71c87928c21ece", "object_relation": "sha1", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701931, "uuid": "64e1b9f0-c86b-4772-ad3c-eb936ff9cbd0", "comment": "Malware payload", "value": "39b8256a6c6f2089b3dbd70c184a206c922028317b1108f415b5d203430452e6d0f0cc3a99d372b1d558cb240acb8628", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701931, "uuid": "c400c390-f4c5-43cc-88ca-73273e14b404", "value": "T1FA9743B042C5BEF992FA4777F9EDD7CA5385D01447B44BC72A621AE82D227890DF0938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701931, "uuid": "0e803b2e-d89f-451c-9864-295eeb8f67f0", "value": "24576:aoTz5sCuZi8Fo7LkLWgGeGDMfRo3DaSfZZJJfT+uNFUJ2Ivr9VfC75Sp+Re9aIHU:aBjQ7AxiQcPuPN9aIhUkG88kvhx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701931, "uuid": "2737b5cf-e9e4-4e09-b109-e98eadd7cd9d", "value": 43009033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701931, "uuid": "46b558eb-f2c4-4679-979d-7ce1f7baa57d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701931, "uuid": "406fc962-0fe4-40d4-8ce3-58806cb6120a", "value": "334dfbaefbf7e6301d2385f95d861eb6dae9018c48fb298a2cbf5f364fbcdb2d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b268ebb2-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755695709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695709, "uuid": "a6a0f28c-2a85-49bd-bbfd-c51f77cea30b", "comment": "Malware payload", "value": "621035273a142c173e21dce99b97eca9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695709, "uuid": "44730cde-85e4-4e5b-b556-f185e501b630", "comment": "Malware payload", "value": "33912e2315c6ce788cc44e678aeca8d5e0741d8e0d5c3f4868ef4acd8b71a523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695709, "uuid": "cd91886b-4d5e-443c-9ab0-b1a6255eeea1", "comment": "Malware payload", "value": "c62e643736e9c69957aafcaadf1e71909f9e239a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695709, "uuid": "77ee62ac-7c3f-4770-adba-4bdc80f225f8", "comment": "Malware payload", "value": "a57a1352fdbc7125a05b20325ea73821a93611a835453e54267fab9f4385d6bcd7c3de975f3bb8dc638347648bb07bb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695709, "uuid": "b64f0889-0e99-4f33-bd31-3b7ba91675f8", "value": "T1FF25121156D9D414E4F63FB41AB1F3B8977ABDCDA931C30A87E86CAF7C216806C24366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695709, "uuid": "c2e8b37e-eeba-499a-9969-2365d1f3a1d3", "value": "12288:OrezPr9mMAlcvCY6Sy1ZEYjBnJFtgU63rPJCP9XJJQ3uvZu11PfN3UDvu3W5iBDP:2lcqY6fFyUuDJSB83uqSvwBDhYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695709, "uuid": "7b85597a-9df3-4ba1-bdb9-a7b0c29e9b38", "value": 1030144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695709, "uuid": "1ffd7114-7d0d-4286-903c-6f3457c02863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695709, "uuid": "b61c8342-7fe3-43fc-8913-175d038e13cf", "value": "SKM-410795376200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76af891-7e02-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755721138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721138, "uuid": "3001b358-81b4-4db1-9b17-905801862a34", "comment": "Malware payload", "value": "b1048c8a4438b3ca0db769bfb47e862a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721138, "uuid": "0a5b4991-4096-4925-9d1d-44126f445037", "comment": "Malware payload", "value": "33d84c6da79f8290982bc316fee776d732746052d3428f1944b278701dcc0b0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721138, "uuid": "3f246a31-2335-4b1d-ab11-5656212181ca", "comment": "Malware payload", "value": "054554da7885477a09d6d489f421207a447a0150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721138, "uuid": "48157246-f375-4ebb-8823-e4205908fc62", "comment": "Malware payload", "value": "d1021a8ca4f9c37a53680e3238aa6735a224a6efe7ecf45f44b6d826d83dcd5f638b1072ab5dfa453771489e3de2714f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721138, "uuid": "384a01a4-8bad-4477-8a86-1e87918faab9", "value": "T194B4F18FE19CF71BCBFD0A38982162F79251BC195A2117A662463C2BB93F4D0744BC57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721138, "uuid": "dc740673-49c3-4245-b977-788d5363f3d9", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721138, "uuid": "016a29e4-bd7e-4206-b693-3d36b7c94e99", "value": "12288:HUBKrmOZml/fbcVbX7pM8KEDav+9DgO4Z4RHZ5yA81fFAY:0Bio/fbilJ/ZtgOdRHuWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721138, "uuid": "99753f67-2106-4995-830d-0ad5a7bcd501", "value": 540885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721138, "uuid": "0db9fdb9-9d06-4b5e-88cf-73f54f580347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721138, "uuid": "ceebf592-a0f8-4e40-b0ec-f91dea94ae16", "value": "SecuriteInfo.com.W32.Trojan.JZHT-5703.22564.14350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb2cc28-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679999, "uuid": "941e3bf2-67e0-4698-adf7-e9c696c0a183", "comment": "Malware payload (DonutLoader)", "value": "e51d5d8615b3ea380915b9d514b01729", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679999, "uuid": "b784d4bf-576c-4ea1-b02f-15fb5ada8581", "comment": "Malware payload (DonutLoader)", "value": "347a75b431eb440062058a8e9f4d17d2b672d4e031ab6c76ea59665447944b4f", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679999, "uuid": "b5b7ab2b-41a3-40a7-9a42-ea61f4abd664", "comment": "Malware payload (DonutLoader)", "value": "06e7faaca6d7450932e5b8582230da59bfb39bb9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679999, "uuid": "71e10aa1-699c-4c4b-971e-d6ac1b24f8d3", "comment": "Malware payload (DonutLoader)", "value": "ad6175750210ce05e3a8a73cb005a7834c8f6ca140b2bcf820a7da0233840736d107742b9c92789f08cd1c22b9d02501", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679999, "uuid": "4fe4a54e-006e-4d91-8094-8d59ada8555f", "value": "T169B533201FEA6E8D0B9C9734709F4F1E47975F9364D8E6D2567882E280BEF41178B826", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679999, "uuid": "12a1517c-429c-48b9-b207-ee3e62740696", "value": "24576:iou7X0f7hEvkNuiH33AINNVS/F7WoskTbMSQaBPrZ4gUj2ll1VhJ5kEm+l8SXX+W:67X+woXMv/QMtDBNxXPBocbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679999, "uuid": "9a1b6116-7704-4ed6-b643-743c54b20a70", "value": 2308612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679999, "uuid": "2162f0e9-f343-4fd2-b202-73292d259457", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679999, "uuid": "6984ab09-886c-48d6-a965-3ee346e41a10", "value": "347a75b431eb440062058a8e9f4d17d2b672d4e031ab6c76ea59665447944b4f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91226fa8-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698660, "uuid": "ee28d127-6920-4a6b-8710-3e5708ebaaa2", "comment": "Malware payload", "value": "57731ce0ac20a00136e6d6cc1edfad34", "object_relation": "md5", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698660, "uuid": "aeae4c5c-85b6-4225-9304-6280aed80826", "comment": "Malware payload", "value": "34a69a41d71116f98a116166c177151a7b237b20bd3b47888b34aad76f27a59a", "object_relation": "sha256", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698660, "uuid": "f179e857-52d9-4166-96db-b8b7e07fa140", "comment": "Malware payload", "value": "aa71d723976051be051b0b17ffa5ec1f717084cf", "object_relation": "sha1", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698660, "uuid": "61753437-64ef-4cf0-8482-f856e0972994", "comment": "Malware payload", "value": "6483a7d5089d8fc2f0df4813d2e79d4b0a68f82c3757296d2e6c3d870c1925c91623d15c5a16a9112a7d6db37311cc63", "object_relation": "sha3-384", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698660, "uuid": "0c658dbd-92f9-4225-994c-db103d8b50f9", "value": "T143B5688A3728C9CEE5581EB728A5533A073DD841106CF163FE7719CEA9B204677279EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698660, "uuid": "0c2e9aba-2adf-46d1-a6b3-b94ac8c7df41", "value": "6a5e409e89a5678680535aa9cccfff00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698660, "uuid": "b338ebaa-4c0a-42c3-b76a-e9f8a597943d", "value": "24576:vXHvTIcqNvc/NyFOfRHvTIcqNvc/NyFOfm:vXHv8c2o0F6RHv8c2o0F6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698660, "uuid": "63f66945-3692-45f0-bb2c-3dff8d18cc5a", "value": 2320384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698660, "uuid": "d83ac408-50d1-4abc-ac5f-a2d286022096", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698660, "uuid": "824c289f-cba2-44b0-b3dd-8ff56bd5376c", "value": "34a69a41d71116f98a116166c177151a7b237b20bd3b47888b34aad76f27a59a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc13452-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755671247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671247, "uuid": "c507fddb-9cdf-4a9c-91b3-87e1c24f73bc", "comment": "Malware payload (Mirai)", "value": "cbb72e0743a726a37bb9fb67b7b1298c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671247, "uuid": "ff8868bc-e23a-4c75-a0d3-2f90852f22e0", "comment": "Malware payload (Mirai)", "value": "34ddd03e4a01a087f7a7a9921e371a3df3b14adc96357c32efea888f2e385cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671247, "uuid": "0168ad95-cc27-4041-9568-11dfb61ed966", "comment": "Malware payload (Mirai)", "value": "78bfc50d608ee7d5f5fa6fd0f739936e49b8ac10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671247, "uuid": "4b01e3bc-e96f-4a45-b643-f158a8e15301", "comment": "Malware payload (Mirai)", "value": "a2fefeca4956f80aeed286d2a2cda0d7baca5173aae20acae965951adb05594b2b7f580b334d421c4e517866fb911428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671247, "uuid": "4101025f-2214-44a2-ae88-0874cb7d2122", "value": "T1B9D3F745A9428F11D4D732FAFA9F414933536FB9E3FA7101D9209F6023CAA9B0F76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671247, "uuid": "19e54fe3-ff2d-47c7-9e93-84822222f45c", "value": "3072:lWSr/PfZT4+X6lil2IAuFaUBa4KC8rwU5MTL50C/jpEda:lWSze+X6C2tONBa4KC8rwU6Z0CjpEda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671247, "uuid": "0fe8196f-ccb0-4a7e-8c09-c59725bdd7b1", "value": 137408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671247, "uuid": "4f59599d-8eef-446f-9b02-76a5460239cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671247, "uuid": "6cb11c1c-af51-40f6-b950-463b9ed562a3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9ece7b-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755695994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695994, "uuid": "3ab0670f-a3a8-4ef5-ab38-eba5243b3594", "comment": "Malware payload (GCleaner)", "value": "90ae9ea4403cc0cf5c92af2d3d82c7e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695994, "uuid": "05b39675-7872-42f8-9893-9e40ec3b83d8", "comment": "Malware payload (GCleaner)", "value": "353bb7ff551cc81d11dd41b3ac03084ab2ce72a86099a6010a9ac5d6a67cc5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695994, "uuid": "0b55caf8-925b-4b55-9375-cdc270032384", "comment": "Malware payload (GCleaner)", "value": "c597515b70d6e9e0c9619b178e2d1d1dd103d23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695994, "uuid": "e1248018-aa57-4691-b437-b54a7b43b149", "comment": "Malware payload (GCleaner)", "value": "63e37b26953c2ac462b52fa4baf232cb8fd5efe32ce309c96bd6aec9376cc79f45b74264c39cd8008e2e3c9372e17825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695994, "uuid": "52a17bf7-9858-45b3-972f-4e343799387a", "value": "T1ABF5E1D253899F32C3D115B2FC1A85BFEC696F603538C3DBCAC90945CA152F67A29872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695994, "uuid": "551ec0cf-a051-4022-ba6b-8b184f628a53", "value": "f303e1db0fbe1c7305a785747c4d8fb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695994, "uuid": "4b7426a9-fb1a-47f0-bd9b-a788c0808614", "value": "98304:oF6Nv/ychCBbrfYLwBmmUhVswi5m1NVLhLWfFZ7DznN3G5arGUKTnsKQMCSJ8V:s6ychGbrfYLwBmm0VswJNVLgfFZznNc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695994, "uuid": "6b8977c6-2730-45d5-8230-3354dcb386d7", "value": 3527968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695994, "uuid": "5b4915e4-9d62-410e-a36b-753da98f6fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695994, "uuid": "da0739fa-3e04-46e7-b2e1-7c301b60492d", "value": "SecuriteInfo.com.Trojan.DownLoader48.59334.4882.11953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf7a391-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1755693176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693176, "uuid": "e67ebc89-eac6-4e97-b814-735233dee7c1", "comment": "Malware payload (VIPKeylogger)", "value": "0bfa29caf0bf03aa51021cf0060b3b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693176, "uuid": "081f89d3-2c7b-44bd-b414-a056179d780c", "comment": "Malware payload (VIPKeylogger)", "value": "3560c6f9c634f01045b6d421270e3984dab8b43c7b9a5af2a4f87903028b21e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693176, "uuid": "9f952ee5-cec9-42c2-b4ff-b089c50cc517", "comment": "Malware payload (VIPKeylogger)", "value": "b4068ce4aec98a1a0b41e4b2f5c6e5432dd498d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693176, "uuid": "8267ba70-fe67-465f-aebe-613a90a71265", "comment": "Malware payload (VIPKeylogger)", "value": "4196c7a754636af8b3e3a87cb776aac629e31c8c8ae136b90c4d993e3e225ec3e7350c748b2fc2af1c9e8617b8b4f9cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693176, "uuid": "1d0b16cc-85db-40f6-97af-24a1fd9245cb", "value": "T14846BE19A3E905B5D42BDA38C656C333DAB1B9515731C24F0A8DE6462F33AA08F3F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693176, "uuid": "664148bd-57c9-4259-8465-b73956c97305", "value": "0480067c60452f8f957a333bdf46582e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693176, "uuid": "b4958c47-1224-45d9-9ef7-e6a927f48c91", "value": "49152:aM/mev5WpfIxCKLcSpRYMrzMcGclvPv48ur4GhKOqfyAHLHHWqF5UNpa+B53cK7I:Xcir5Pv4b4vOqfew9zfMKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693176, "uuid": "1d414183-66c4-4e68-bcaa-5508370797b7", "value": 5351936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693176, "uuid": "0b2feee3-a785-42ba-a055-1f8d86f8c94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693176, "uuid": "a168a37b-d580-410b-bf8e-d453ac4a47af", "value": "rtinfo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9473f13a-7e06-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1755722717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722717, "uuid": "e26f7a97-b755-45db-9cd4-f6fa78c69e72", "comment": "Malware payload (DCRat)", "value": "3ea39ca11d20c8915fe45168d605470d", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722717, "uuid": "4ba819d8-dbe9-437a-966c-fcffb4930ceb", "comment": "Malware payload (DCRat)", "value": "35884e6b675c04af9969b8f158e6ead42a2ce5b5542e7e47facbc8aac437ca9e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722717, "uuid": "fce9c6e3-757d-40b2-8118-07c1188dc602", "comment": "Malware payload (DCRat)", "value": "aa6f35e58115301d640884fea238152e34e4b718", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722717, "uuid": "48481b10-a27f-414b-aee0-7ae228eaf409", "comment": "Malware payload (DCRat)", "value": "b09baa888975c8c3c09872c8630b00ade94705483ad178663275e29c61a0618203b726b49ceadbdcc80d7b8c9013c895", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722717, "uuid": "39fe36c9-cbfb-41a8-9d3d-a14fa250aadd", "value": "T179658D027E45CE12F42A1233C2FF456847B0999166A6E72B7DBA37BD15123A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722717, "uuid": "29a1a76c-4311-4b63-ae71-97821cbf6f7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722717, "uuid": "8f18f342-d3b3-446d-bb7e-7e8f7c0049bc", "value": "24576:7vQ8dZuv3d2FIiwXozzvnNaf7wrfs3nsTEsuWNfKUMVNVscBO:748K2upkzFaDwrf+fs5fKU+XscB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755722717, "uuid": "582989a5-c511-4690-b2d6-16ce3d1095a3", "value": 1502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755722717, "uuid": "cdc07b97-25aa-4d3b-b965-39877e27f2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722717, "uuid": "6c69b877-3f08-4708-aebc-475ee11a1af8", "value": "3ea39ca11d20c8915fe45168d605470d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037cf26c-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702287, "uuid": "8ab5693c-07e8-4792-b862-11dcc5931dd9", "comment": "Malware payload (Mirai)", "value": "10b67ec7998767377f191371cc18a29a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702287, "uuid": "b1a51841-f6b5-4092-8857-eab568895a15", "comment": "Malware payload (Mirai)", "value": "366ea24746c64be379b1efca25b963dee012186b618af54b7d3f353daba2b6b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702287, "uuid": "91a0e061-20cb-4316-ad1b-2664d6833d7a", "comment": "Malware payload (Mirai)", "value": "1f378199682b0d21411a41fa0aa3969bdb7cc4da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702287, "uuid": "91213a20-fbf4-43dc-9459-a07eaa413ec3", "comment": "Malware payload (Mirai)", "value": "8f07967a479d7f41606ab0b8b75809806514d8fe1319268bad0039232f197abab05577dd480af6c0cc6406ffd2edc97d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702287, "uuid": "bc293fbe-ab6f-4408-a5ca-da0d1bdb6223", "value": "T133D2E13C4370E4E09DA01B77F971CA9A76654B38F0B7B4221A261ED85ED35829EDCD07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702287, "uuid": "459eb66c-96c4-4ee2-b3e0-0abebbf0d864", "value": "768:wEdrEbXKDnI/U//XNbhrgGOEb/PjlB9q3UELFK:wLXkSUHNbhrgzErbl0LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702287, "uuid": "d23f696d-b282-42f1-a7f3-0c5d48c89e44", "value": 28464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702287, "uuid": "22f0dbee-e2c1-4c76-9e01-fa25065a7f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702287, "uuid": "7bbf7441-5e3c-4839-8bec-c6598308ed02", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e606fe9b-7d99-11f0-91c6-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1755676039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676039, "uuid": "a4a86988-67ac-4ba7-8c5f-f8d9d66016cf", "comment": "Malware payload (DiscordTokenStealer)", "value": "6c84a65b99d100d4ff79c1ce03701e01", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676039, "uuid": "40a51126-6a36-4791-98a4-3ed86ac22219", "comment": "Malware payload (DiscordTokenStealer)", "value": "36cfd82cf3348bb91506fd5783e7edf12b470cb5928140655fa4c76be46f210f", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676039, "uuid": "84dfd89a-02b5-4a69-9451-bb5ae9337618", "comment": "Malware payload (DiscordTokenStealer)", "value": "acff9ca1829bb5ddf7b9e83cc4428c72edbb45c9", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676039, "uuid": "7bcebada-0328-4ad6-9510-56fd6a7ca73a", "comment": "Malware payload (DiscordTokenStealer)", "value": "569d63184b930ed6fc0aad52f08a6698a7af4002f0df86ac18dd7c3b403aa380e40b9e8a5cfe86e0ffc362192e1c5c2b", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676039, "uuid": "028bd001-fba5-4510-86cb-7c567c27e6f8", "value": "T18424E0222DEB209DB3A39BB65FC8F8FF486AF9B3550E30F531510B4687229858D51B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676039, "uuid": "fc3882b6-ba31-445a-a466-85fe4bb56982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676039, "uuid": "edca4a2d-7102-46e5-b09d-30770bb99f3f", "value": "3072:7l6R/7oWpna6lada9a2nzXTAzH4dBz+A6bOnJAn+UiVrrYFkH:Gal0dBz+A6bOnJAn+Drm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676039, "uuid": "76b2dcf6-15b3-4732-8ce3-0009488ce69a", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676039, "uuid": "82470f32-a18b-441f-84f3-c5fcd9668ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676039, "uuid": "e19af898-36af-4c05-8855-28c91f2c5a3e", "value": "Coger_crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dedc73-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679986, "uuid": "0dd39add-f368-4e3d-a761-695b3b82f029", "comment": "Malware payload (DonutLoader)", "value": "b2a595705436a381ce3e6cc2dfed0def", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679986, "uuid": "d0d77f6a-d022-4e39-9cc2-05de38a5976a", "comment": "Malware payload (DonutLoader)", "value": "37592b17dc083268c1e95337165cffa031725f36d8a69e46693b715cdabc4030", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679986, "uuid": "d97014f3-89be-4a68-bd04-202468615b14", "comment": "Malware payload (DonutLoader)", "value": "34f99caaa35126957aa17fa23b7ced4077849503", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679986, "uuid": "37c43178-c6dd-482d-996e-53a597be42b4", "comment": "Malware payload (DonutLoader)", "value": "96d811fd518f10227aa7ffb6776649cc78dcd10f14e707e425468bb493d3e649b251354e6095a8c9c17d5122ddd5c24f", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679986, "uuid": "49d83ae0-d895-4111-9863-fa2111cbbfef", "value": "T176A6D2DBA31D59DA0DCB377CDB465D63AF88A92106B1824FF6AE891EF04F81540F091B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679986, "uuid": "c15beb8e-5daa-4112-9eba-9ee370120342", "value": "12288:1d4i/cKfTBZ5kk1r79ttScnXStAqA8qygwGbkFeX9z6DPBt6qfirOAttyzXvmFMn:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679986, "uuid": "acb62aa3-85b7-45b6-be52-b217bf1062de", "value": 10340267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679986, "uuid": "b74bdf98-c1c2-45c4-9de2-2872724b6dac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679986, "uuid": "feffe747-a2b4-42b8-8bf0-7d7a3bdfd54e", "value": "37592b17dc083268c1e95337165cffa031725f36d8a69e46693b715cdabc4030.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f9841f-7dac-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755684145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684145, "uuid": "bd3b4c64-5373-489e-a62c-ec854a05ce7a", "comment": "Malware payload", "value": "593d6f3771fd3a6a125cedeb012cf5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684145, "uuid": "47b68a65-03ff-416f-ac32-c9c2cc36fecd", "comment": "Malware payload", "value": "37e550b9b7f59ae09308c1e2f17306ab3f1cd03ac2ac885eb66ae6a81a6ae5dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684145, "uuid": "1d7294d0-656d-4eca-98bf-dc4da154380a", "comment": "Malware payload", "value": "69df9fc126455f1466b27203967b7affc743801b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684145, "uuid": "bc33c2aa-ec7f-49d7-aab8-632ecf079fd4", "comment": "Malware payload", "value": "88d0820e20e7de64f16f33ae205df6366f3e0ecfc88d9feefa8eeed0d28718b510fac2e7c9568c9c3e2788e2564c7a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684145, "uuid": "d2bfe168-bf9b-4600-acea-02cd616b02e4", "value": "T1C8187C5263FA09D6E9F79A3489E65213DA73BC063F3086CB324C176A1F736E04976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684145, "uuid": "94f6b7c1-b505-46a4-8692-a4a523b66862", "value": "b2e426b78f8291fe9c5a3f4a8555e42d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684145, "uuid": "5986f574-3fcc-4d55-ad7f-5e66594aba2d", "value": "786432:mo4cR8Ez2LD+RZiZ71RE/x+npgPVlcmHps:mobRbz2LYxD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684145, "uuid": "ad238d3e-13eb-4320-bbed-616555455c73", "value": 85447012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684145, "uuid": "75553286-86cd-44e1-a527-3a11289bed4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684145, "uuid": "cb1dbf4f-2e92-4fab-85c1-33bcb563f406", "value": "v1.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e145d6-7deb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755711284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711284, "uuid": "ad228d88-0aa1-4e47-b7df-2f01efd0d002", "comment": "Malware payload", "value": "fbcd32d55839acc3bc9483fc56eb65ac", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711284, "uuid": "cfee5e2b-1e3e-475e-813f-21df9d2faf1b", "comment": "Malware payload", "value": "387341d7438c649bf2345b751a9b5ed445651dfae1e1966e08977c0a4b129207", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711284, "uuid": "c21996a0-de6c-4f59-b361-9142b99445c6", "comment": "Malware payload", "value": "fb57fd6f7224ab00e02e427cfa56889692aac255", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711284, "uuid": "ccf60171-c1ce-46ab-a6d1-79be34c938b8", "comment": "Malware payload", "value": "05a47013f9005e4843cf0da0ff920b02b76242c5fa030256d8a4032028e72e3cdf9e71f5b65f12dbca2a4cd07a12182a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711284, "uuid": "89aac9bb-3011-41af-9ad5-45352dd80020", "value": "T1E6973329BBFDD417E047A135EE009553580415ACA2C4FA5B2A22899CAEF7DD4CB07FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711284, "uuid": "44929577-f24f-4527-ad13-416d2646ac8f", "value": "786432:89qefFrF6o0ul3j6HulZSKupEaD7cW3uIALuaJbk/BAU7DNnjki8xxQVcjwihfRy:8/rB043j6oj0Z3nTgbkJH7hnwrxxRw4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711284, "uuid": "d66d019d-ee53-4643-85ef-389af812265c", "value": 42023375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711284, "uuid": "705ec54b-488d-4e10-a822-4390aa146360", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711284, "uuid": "8465e528-b3ae-4896-a530-1a872bdb72b0", "value": "387341d7438c649bf2345b751a9b5ed445651dfae1e1966e08977c0a4b129207.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1759bb57-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695449, "uuid": "3b089d25-1936-4a20-ad9c-4b9d9a7eb6e9", "comment": "Malware payload (Mirai)", "value": "3a64c4b2efdd207409ea8740c6a265ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695449, "uuid": "2f3bad07-18ac-4c54-a90f-5ab06778e928", "comment": "Malware payload (Mirai)", "value": "387a7ee9fd9dfac18b151d9ffe1f4c8272db71d81ad8ff39752d75e4867c5a0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695449, "uuid": "24fa72cd-c957-4285-962f-5513a8a543f6", "comment": "Malware payload (Mirai)", "value": "7b1beaf4beb2fd51c47d4e9c0af9c3ef21762868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695449, "uuid": "724dd641-cbda-4c15-9aaa-0ba7998cfcd2", "comment": "Malware payload (Mirai)", "value": "bda2e83c5c8c0a844dad2da4cfda6cb4d2b8f0c1539d76857ed14817a8e032336c8dee249c7d06c87f0a0e9284b11a39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695449, "uuid": "edf0c1aa-97c9-47e7-ae5c-7ef0be621e0f", "value": "T1DB33029157B5C2A1D26A307899FD7E5E4801B61EEB498A7D94C9E62F0E3CB3E031C713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695449, "uuid": "30fa0295-62ad-4667-a540-7b7b4256e5a4", "value": "1536:0gWpD5BTSW/CumyAc+aFQfiS/3cVnHnouy8GyH:0gWp9hfCQAc+aifiiMVHoutD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695449, "uuid": "dcd491e5-88f2-47cf-a04e-fa3a274d3628", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695449, "uuid": "37fdc9b8-9595-4f33-bdd3-0bf0c864a0a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695449, "uuid": "45f25aa2-efaa-4460-8a49-2de3ab0fa1f8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d55aeeaf-7d84-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755666991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666991, "uuid": "c1ffc10c-0caa-49d3-b847-4858d5cf8bc5", "comment": "Malware payload", "value": "d8fbeb3211584b706feeec9e65953b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666991, "uuid": "cdd18404-cde4-45e7-ad8d-4ae842828d56", "comment": "Malware payload", "value": "397f446d93da6de7e6efd095fa23c0f06900dbc6ef719f05952b66e00c7aa51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666991, "uuid": "592d1c2b-8acd-4ed3-b9c6-03084f4425d0", "comment": "Malware payload", "value": "c77ccf2c0e7e464365d5d0aaa7b31670543b4ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666991, "uuid": "6d932c47-02ee-4695-a916-ba7afbadcda5", "comment": "Malware payload", "value": "8482e7e90be9f42e3be55bc1dc18efeaf56fa5858ed9b931962ed1a13931ba85e1d5d67aff7f313b5c561c49cd70dc64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666991, "uuid": "49b099b5-21ce-4505-a6d6-6d84f54c66c0", "value": "T11CB3129D32E071DECA67D8729F986C6CEA557477871B5203A02306ADDA0D88BCF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666991, "uuid": "86fe54f6-03d4-44f5-a8b8-9eb1d839747e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666991, "uuid": "eea96d7e-cecf-4886-8eec-2df809a6d3ae", "value": "1536:ZvRURNkPGo2tsuK9lzQ1bMq4ZcG8Q6B/RNFrZYbUmG1Sv:ZKRGP1lzQ1bMq4ZcG8Q6B/RNFrvmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755666991, "uuid": "5ae70bf9-f482-425d-8faa-4cdb86214c69", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755666991, "uuid": "fd77300b-54ce-4a6a-a98b-fea4c001e2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666991, "uuid": "01674b9a-1365-4a07-b0b7-1c9fe53395cf", "value": "SecuriteInfo.com.Win32.MalwareX-gen.25127376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4666b39-7de9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755710315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710315, "uuid": "1cdeadb6-0bc2-43f9-a687-7d498f211ab6", "comment": "Malware payload", "value": "ea56cb53260629cf931753df0f50e53c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710315, "uuid": "20c7b801-bcd2-4d2c-90c5-d8629df741cb", "comment": "Malware payload", "value": "39d44f4ed527e432853b33c759a87f9399cbf6367807070401e914ea64bd7bf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710315, "uuid": "d1825374-55ee-4aed-8a5b-deca2a068c6d", "comment": "Malware payload", "value": "15ca107fe07a849e09828b29d397d616a0cf32b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710315, "uuid": "34eba63b-0a25-48f6-aa90-4b2923e7590d", "comment": "Malware payload", "value": "63dcb6fa7f79c19daefdfd7bf921529845a6d1cb049615bcb81d501c161e52a8a2157a40606bacb93f611986a087bcf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710315, "uuid": "575ad726-1e2f-42b2-acbd-765d70a80a80", "value": "T11784F76BFB21CABCC087CAB5489287E29630BE140E75178732C4775F7D729507DA8A4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710315, "uuid": "add1f196-4d08-4bec-8108-5d3ed5a0ef8f", "value": "8bde2e193f8f96c4d155344c8480096b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710315, "uuid": "fef8c024-5346-4f33-a2f0-ad67bf4a9ca3", "value": "6144:Sngt3bYrAZMKsgzRDZPR8COtORftSPhip:ptLYrONRzrPeCwORftSPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755710315, "uuid": "69021763-efc2-48dd-ad2a-7583092113fe", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755710315, "uuid": "6b53f906-9785-4997-a859-85295dfe8bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710315, "uuid": "54c69909-d38f-4cc0-9691-7f91b416732c", "value": "SecuriteInfo.com.Trojan.GenericKD.77098573.24224.7287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7904f657-7d93-11f0-91c6-42010a9c0006", "comment": "Malware payload (a310Logger)", "timestamp": 1755673279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673279, "uuid": "bff8bf51-c305-4103-817b-b2b264e68c39", "comment": "Malware payload (a310Logger)", "value": "b897fdb61655c8eeb77b325aa3c711aa", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673279, "uuid": "4290e9ba-959f-426e-b448-6637f8cb295c", "comment": "Malware payload (a310Logger)", "value": "39db2a740fc77b540ccf59e40d9525c3175b81de89f3128bf25fa5df5f416300", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673279, "uuid": "0acd7e02-232d-4222-83f3-5782a0f1283f", "comment": "Malware payload (a310Logger)", "value": "02ca3cd1d72c8d714adb1cd8614f99cc523e4e86", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755673279, "uuid": "45027b4f-868b-4256-baf3-87320095cf1b", "comment": "Malware payload (a310Logger)", "value": "2ca4d3d8204184944495e665d3d33335ae0e746fb7ea457e6606dee8f76eacb5d0ca5c5a90611daafbe977163fcd75c7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673279, "uuid": "67d6926d-5a65-4cc5-a540-00c6736f58d2", "value": "T170B44A06EB60711FF053C8F1AD75524768266E3A5698EC6BB3409F5A30729D3A8F072F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673279, "uuid": "43f42471-04d1-4a83-9278-df2aec49ca01", "value": "b44ad0fb82eae97c68aa51d08a4714a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673279, "uuid": "30864b2f-ff66-4a72-9f7f-187632a5bbea", "value": "6144:eT7DjtkzjvOE2Iw8d1/w5KA81IJ8GpF6nuTmOOUyRmgradOdWZuHcBG/y2tmldAS:evFkjv95jYKkJj6GmZUE7P/3/y2tmj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755673279, "uuid": "a2920814-f2a9-47ba-9fc3-84dafe6274e2", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755673279, "uuid": "5728b2fc-d6f1-4715-beb7-65e580beb340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755673279, "uuid": "e83c5bae-cf11-44f4-8cbc-156b1bdacc46", "value": "rflushingly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791e9d62-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1755679721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679721, "uuid": "db68b407-cdc5-44b1-9433-b7b495472b2d", "comment": "Malware payload (CobaltStrike)", "value": "1d68a09c777b81e4e5d93e80e6bc367e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679721, "uuid": "e9198b70-150e-4c90-a096-43db09f2ad71", "comment": "Malware payload (CobaltStrike)", "value": "3a6f9d75c3839518896cddafd638c70feb82a84eacb4227094081d6ad0e2c35e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679721, "uuid": "145b3c24-5342-4892-8822-fd4a070eff56", "comment": "Malware payload (CobaltStrike)", "value": "f7544ecef6f5f1ff7354c46f6c81e1cdc7647e55", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679721, "uuid": "8061d1c9-ef9d-4c01-88b3-b3c35cf68c6b", "comment": "Malware payload (CobaltStrike)", "value": "9296a04a2d38181c5090228469c3963060caedec0035c2971dccb652bd50407f7f17cf62fb2eac5ade0ec99b321173a6", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679721, "uuid": "69bf029d-cf64-4099-92e3-657f2f677e53", "value": "T1CC7108644ACBAE4EED9624037E3EB4861E3D1FA74AC62C00F5F46620B983C35D2B7714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679721, "uuid": "7d22fbb3-9ca9-46cc-bdd7-1a401594c36c", "value": "96:pg5SvvvOmVeLx1Yn64q46V/sw3djLA0lgUV0la:SIvOPLx1YnwVn3dFB6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679721, "uuid": "77223389-f3be-4667-9430-1e7771093c0a", "value": 3603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679721, "uuid": "68d34397-1a11-498a-8c4b-8ccbbaa59ff2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679721, "uuid": "c52b6bc6-d710-45d5-b695-16af76594f2b", "value": "payload_x64.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0ad04f-7de9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755710091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710091, "uuid": "2c611e26-e29f-4264-90b3-670f929c402c", "comment": "Malware payload (AsyncRAT)", "value": "a269fd14b8db0d7ebdf6683dda97a459", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710091, "uuid": "d45bb05d-78d3-4fe0-8d57-24bcdfb2c202", "comment": "Malware payload (AsyncRAT)", "value": "3aae6a7f8e455aec4606dd0910dc874809441f81b5eb2e5e8b27a5d7a3c4e8c1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710091, "uuid": "7538d475-8414-412a-b13a-a69b5e7f9a94", "comment": "Malware payload (AsyncRAT)", "value": "1a0154a62a1a72ebb1a7e138b0090e3c2ac236d9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710091, "uuid": "a2a80340-423c-47b0-8496-bae89d14f25a", "comment": "Malware payload (AsyncRAT)", "value": "dd763374a07b14b39277ce0c32960445d7267e02170baaf849094d62355814abf11179ac1f5798691a4f01bba4312a01", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710091, "uuid": "592171cd-0e56-438a-ae5b-1206f1ecac31", "value": "T1B6D176562E8B915405B0C376AB2C01E0EE2D93EF432525D93A79D5EC372A0D7C1FE9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710091, "uuid": "7de4d53a-de85-4dd6-b573-9d82a3fdc193", "value": "96:U4RQLS81j32yheaxm7s97omE08mqHQCsG808mrkcn42JpbN:jRQLS81j32yheaw7I7GpHp+SkSzH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755710091, "uuid": "1eaea212-0466-47e9-b1d6-511eabaaeaf3", "value": 6672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755710091, "uuid": "db6c8916-6472-4ddb-b77d-85d7c1d0bc10", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710091, "uuid": "65e56899-3953-455d-abc9-4208edae886e", "value": "yrsa.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a9f805-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755702632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702632, "uuid": "23c8d506-c09e-4985-a760-e6d145bc50f6", "comment": "Malware payload (XWorm)", "value": "7c136e58cd9cbfa39193e4f60f019d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702632, "uuid": "61e34bd8-cc1e-483a-b00c-88351d5e3ec5", "comment": "Malware payload (XWorm)", "value": "3bb5b7905d133153dadc408f2ed8075c6b3d11aa13ba52b3bd97704484655c3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702632, "uuid": "3ee8baf1-6edd-4296-a4ba-550fb341c931", "comment": "Malware payload (XWorm)", "value": "9c966164966fe79ac56b7b5142d4c2f97087146e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702632, "uuid": "64236d50-695b-4f1f-ab54-0b05bd6be1a1", "comment": "Malware payload (XWorm)", "value": "573c07e91fb108ea1e5b0e79ce643b02e77a56fd61de2f6bc157afe3dfd72790b6619e92f92deb6a8e09830e53f79375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702632, "uuid": "00f82e28-efde-495e-a6f0-a2c53120b039", "value": "T1A7536B1877A50626D1FFAFF15AB26216C679F22359139B5F38D841862723A88CE107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702632, "uuid": "06ad6c5d-9ada-4cd1-a39e-6793235e9b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702632, "uuid": "79c25055-2d5d-40ef-8151-81214a0f683a", "value": "1536:NqPEsKQ+VBfTJmeC8QRc3KqTkb3EKpJ6h/vOOnJ:SkRTIe++3Dkb3h6OOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702632, "uuid": "d80030ea-769c-4ba8-885a-591a700da62f", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702632, "uuid": "6886c8cd-2387-41b5-979f-422cb26e05e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702632, "uuid": "e381d434-4843-4b29-87e1-88d0420b919f", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3ac173-7dac-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755683918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683918, "uuid": "e0fe703e-d26f-4ab1-8ae1-b309eee48b06", "comment": "Malware payload (Rhadamanthys)", "value": "c7f59a0a1482314d12219ee225426585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683918, "uuid": "831c3eb0-25d0-4640-bf55-cd1d3730f5f7", "comment": "Malware payload (Rhadamanthys)", "value": "3c311998d6c8cc46dcccb2105e92e37f6134393a91e238fac2ff330f5204f731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683918, "uuid": "6bfcff7c-c83f-45ba-bf2e-1e064c420e20", "comment": "Malware payload (Rhadamanthys)", "value": "3b96b495d377c11c72f017090e38597194725a25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683918, "uuid": "61a9b52a-cc88-4209-97ce-06aace58ae68", "comment": "Malware payload (Rhadamanthys)", "value": "03b335426f3f8dc32804ed9dfe534ab5ff06d7bd5894b3f97e424f3c90880cc9de27efc761a911521301d42dd4a5ca19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683918, "uuid": "8cc9a5a2-640a-4922-ba29-01fe53d14bef", "value": "T12F85499278A12DBDE1FDE1325B64E6207636786E03332BC7198015EE3759BA87E3D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683918, "uuid": "05ca7a9f-38eb-4e44-9ef4-d0c2098f8746", "value": "25c4fb4a248389347ae9cf0ce6995420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683918, "uuid": "b0e19a1f-e99e-4a06-bd9a-f7b7e2d84100", "value": "24576:Cy/ktkS5zIISzhZrWLDihqWsYYxggmmwmoj:n/kqS58ZhZyLDEqWsYUggfwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683918, "uuid": "0f2a1a58-9b03-4c53-815c-2c96343185f0", "value": 1844224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683918, "uuid": "eb77748b-4165-4f64-b5b1-51abfa07f8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683918, "uuid": "abc59f72-7436-4b62-9dbb-992c550eafe5", "value": "Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3d7d28-7dc5-11f0-91c6-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1755694843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694843, "uuid": "69acd890-2bf4-407f-a37f-55f9c9e6e5ba", "comment": "Malware payload (CobaltStrike)", "value": "558a5b1e7d522106befa31207e0d4f68", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694843, "uuid": "0a02c778-7c2e-4aaa-a9e5-b4485b023d14", "comment": "Malware payload (CobaltStrike)", "value": "3c50eb2e3055d6cd28e128bf48ba711ff757089c0dee8b1bacd26f4470705174", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694843, "uuid": "dddcbcc8-8480-40e0-ba68-244a4381569a", "comment": "Malware payload (CobaltStrike)", "value": "d2c2edefda995f779b57450468af67985d0c1ae1", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694843, "uuid": "19efa0f9-394d-4bf4-a803-d46517d86af1", "comment": "Malware payload (CobaltStrike)", "value": "01956a7b73147b7d1c9d673885a8cb4c422d893e24b622c3e8a1cc8e2897d4797fd3e66e3066dd70274e738ac6c95163", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694843, "uuid": "6f72acc2-64f5-499b-8060-377cb6519b6b", "value": "T158A49F29E7900DF8F827E574C9A28512E633FC954760A6DB23A8D6252F332D41B3FB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694843, "uuid": "14d6aa6c-f15a-49f4-8c45-52340ebd5a60", "value": "106ad4e9f3312122f2c2af65d96819a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694843, "uuid": "295d9aa5-a9ee-4a34-b1e1-17b2efd6f301", "value": "12288:J5/Q54aSkFcnzgLXKg19diNCTo4m/zVTJAdGyI:X04fkFcMtzU4STJ+RI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694843, "uuid": "eb8814a4-fe3b-4363-9e7d-d1be86f9e2d9", "value": 467520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694843, "uuid": "18dfa208-29b9-4826-82a6-595f85c518c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694843, "uuid": "1d38a3b2-2247-426d-a9e8-a51c63666d93", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164b45b5-7d5d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755649920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649920, "uuid": "71d8d64c-ebe9-494f-aa8c-871024af7b57", "comment": "Malware payload (Mirai)", "value": "f4866e5b855cae0a219752e7549ced79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649920, "uuid": "b0feba1e-5469-4c66-8f51-2d786a945a7e", "comment": "Malware payload (Mirai)", "value": "3d00a07947d443c59c3d10bc62feff0eef69cbb2788300ebee5bc882fb585c22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649920, "uuid": "84414a70-ed73-48bd-9d8d-700ee433f4ac", "comment": "Malware payload (Mirai)", "value": "e506440472ef4ce1679029448ff98f22d6098b2f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649920, "uuid": "a5c6a2da-7181-455d-a35f-aa5123c0f5ce", "comment": "Malware payload (Mirai)", "value": "8d1df87589cae2a9f6cf073d3e91c4832be013ed222b7fb861b870da0fb833e3d18040b870209c4bdc19ab7c829872b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649920, "uuid": "de97a803-3aa4-4e74-bab7-d76692838109", "value": "T1AED15FF2B4C552BCDE9FCD3A6111697D2089BA8B268B4D658BED2465BC89FCC1C10DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649920, "uuid": "12b93cfd-7e88-435f-98f0-7941443e310e", "value": "192:gp/p3mBdpgpOBqEphpp83Hp8pC12Ipepk7sKpypgnA2p3pPOZlp3pPOZlp6pofIM:Ah3mB/AOBqcLp83J0C12o2k7sKSgnAuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755649920, "uuid": "4a8cafd5-9ea2-4929-b47a-43c4b5c8d2a5", "value": 6419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755649920, "uuid": "a03b52c2-413e-4274-8548-5088371cd8de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649920, "uuid": "4d33b206-1e21-4801-a132-312977e13142", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aedec95-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652586, "uuid": "5ef7ccd6-1fa5-4e36-baa7-7a0d461415bc", "comment": "Malware payload (Mirai)", "value": "61d1c8d11009b40578c794b07656cb40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652586, "uuid": "54e0a082-da3a-4479-81b8-133f15d368db", "comment": "Malware payload (Mirai)", "value": "3d6e830d7a9a9fe1d3ed7b0b08f886945ab5703d0295350617adc4b3eefb214a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652586, "uuid": "63abe9c0-d243-47d5-a439-a95c727f80ce", "comment": "Malware payload (Mirai)", "value": "9d818a75db944a4986fd1a9d07fa34b2a5ec703d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652586, "uuid": "07d0c5a6-2c8d-41ef-b777-87b9262b4e15", "comment": "Malware payload (Mirai)", "value": "46dd868250c1a4804979a6745f38cae7db281489d88e7304d6c851db63ef7185d470587be01c2b32b0fd6251fa358fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652586, "uuid": "ad3e8b0c-edbd-483f-9f16-b42011675764", "value": "T18B13F160602CB8A2ECD11C7F8E49C2CA768586BCB0E57489196D0A7935E76BB2DF41C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652586, "uuid": "8b66b033-642c-4989-8cd5-68e5fc738a5b", "value": "768:B4DTBFzUZxqD7cDFPSk1m6ZnNb0XTywDIXmiOBfXi6dn8pEYOCXFqf9q3UELfh:WDdFza4DgpqkjzwDIccBO4FqOL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652586, "uuid": "0edb9991-2388-460e-8fb8-fdc287d08c3c", "value": 43696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652586, "uuid": "787db055-cd61-4d60-8571-5afbb7969229", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652586, "uuid": "22810b9c-802d-4253-84f2-c1faa7bdcc5d", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed2c7f7-7d9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755676805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676805, "uuid": "97fdc8cb-24c2-4f9e-8abb-c22d7024c710", "comment": "Malware payload", "value": "e30c480912510ab389464155c7c41a55", "object_relation": "md5", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676805, "uuid": "bfe15c16-98e9-4663-b72a-0eddc4d57649", "comment": "Malware payload", "value": "3dfe45544897fe9f2258d52ae5277f26a40da37bd2a604303b6e8f9d2d03b767", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676805, "uuid": "aa2e76ea-1599-414b-91b6-07c0865b96fb", "comment": "Malware payload", "value": "e16f6d2ca1f685aca5fd5329f5029d7b11781e3b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676805, "uuid": "b797759a-30a1-48d1-91f0-965d4d380663", "comment": "Malware payload", "value": "653b3ef51c86d45f3d044e51352c99115b6e949a79e947b357f767c2ae77f28fbd34b62d0ab337547360479c832dc80e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676805, "uuid": "1ce5bbb8-cb2b-4adf-8220-b040b34998c9", "value": "T181E633D49429D3EECD3667BC8BB279FDC71BD01E59A3896274B081051B128D7CBC28DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676805, "uuid": "7b952458-9afe-44d2-9cd8-4e115997d07c", "value": "393216:M1+rTG53b4S6MmpJe9t+c9EO5Qt65u3r3lM:X++SCHWsc9PQt6ILq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676805, "uuid": "07dacc6a-79f6-4a5e-9f2b-d490783222fe", "value": 14307113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676805, "uuid": "bf2c45f0-1fae-4af9-a40e-f3a433a52840", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676805, "uuid": "cc26623b-8f9e-4f30-a9ec-0840f9a36e98", "value": "Advanced PDF Shaper Ultimate.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3666f1-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667303, "uuid": "a9ea2aee-c4f3-4f51-84e1-ab3dcfdab02e", "comment": "Malware payload (Mirai)", "value": "76637f958b376a54011476281fe26ce9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667303, "uuid": "67bceba2-61eb-46c5-a0be-c4081a5829ee", "comment": "Malware payload (Mirai)", "value": "3e47b3a535f5dca6b395e09cba27452e33e56b2c827eada547c59f8eda9cbe47", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667303, "uuid": "71604f33-84fc-4146-bf38-fc596c996ad6", "comment": "Malware payload (Mirai)", "value": "c182339a5638d0ebd872a103c70043f9d88dd49c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667303, "uuid": "30d8d081-4970-4a6b-bad6-d989aa023414", "comment": "Malware payload (Mirai)", "value": "01df34aafb609c169f066ead72c78d55b8694a653cf91d5fcd32ecca2687a4ba478b52234e33c56be53646665f87b302", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667303, "uuid": "623f548b-70aa-4c0f-932d-751a8c731239", "value": "T1FA214D9A885DB109B0FACB02B81397409F0EC5A3DD945F90A78D7C7ACB8DC04E47568E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667303, "uuid": "79c59101-b467-484c-8452-82be59e61ff6", "value": "24:vx0x4zxHCxJeEzx7HboT0lKvgPt/e3JJPzgIiJjga:50qz9CjXzxbysY4ejiWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667303, "uuid": "8cd2efad-7219-44b9-b414-af1df77548a6", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667303, "uuid": "4957d305-cc67-47db-8b8c-7c58417cc370", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667303, "uuid": "fe894d7b-b27b-453f-b08f-7e2b2f1cd596", "value": "router.zyxel.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7649fd-7d91-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1755672565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672565, "uuid": "bc72e8e3-e861-420c-9238-1a2e8925e9ed", "comment": "Malware payload (SnakeKeylogger)", "value": "5d2a7790239f7747ef2f791cceed6e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672565, "uuid": "65498646-ba52-4b58-ae26-ccc67544933f", "comment": "Malware payload (SnakeKeylogger)", "value": "3e8279793b98f6e65bc424d5cc52c6b05700ec2798c5c1377df85c33c18ed678", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672565, "uuid": "ad3080cc-90f8-48ed-9db6-903047695785", "comment": "Malware payload (SnakeKeylogger)", "value": "d588c83068bd403e4b4ddad8de38cea49ddce479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755672565, "uuid": "6e032990-b347-435b-bfc8-7718a06fc040", "comment": "Malware payload (SnakeKeylogger)", "value": "dc9561a72304a0f398f6f868f67ead046fa683ec3f95b093fd12bc0bb5a1802ed519862bf353a371fd0e77f9348078e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672565, "uuid": "29b82be3-42bb-4ccb-97c2-255cff2d5b8b", "value": "T1D405CFAC3250B89FC8578D768D64ED74AA506CBA930BD20394E32DEFBD0D5978F141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672565, "uuid": "def9fa00-7284-461b-b47a-1fccbcb791b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672565, "uuid": "f4ea5fa5-c02d-4648-aa06-1057f8727990", "value": "12288:ZJCaptT263lyOwR830EHd7FXi+woD8ZHxlQwg44EBLPplDiolRlGYoQLmhan2Mks:ZJCavvIJR8NHd7Fy+wo4pbN5Pzi3YoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755672565, "uuid": "3bb847be-cc26-4261-90dc-c475a82b4f85", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755672565, "uuid": "d4ae0b6c-4441-4b27-88f1-e1f1c0e90eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755672565, "uuid": "62e89cb1-8a5d-4f18-a270-9e7e6b586720", "value": "payment advance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1277cd-7db6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755688397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688397, "uuid": "b351b9a5-a9c2-44b9-a2bb-d4cee05d973d", "comment": "Malware payload", "value": "f57e786c7b0061d46ed66491cbee2868", "object_relation": "md5", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688397, "uuid": "31a4e031-df78-4702-b29f-d65bee69ea22", "comment": "Malware payload", "value": "3f40ab5eac046ebe7596a1a902ace79b03580ef339f216530d82790525a49fc6", "object_relation": "sha256", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688397, "uuid": "0d801040-ef99-4699-8333-619c37cb6a06", "comment": "Malware payload", "value": "9a339e8e21413cc522896e9cc04dfbfaba2583ce", "object_relation": "sha1", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755688397, "uuid": "0e27df83-3901-4148-9fec-b09f8810f78b", "comment": "Malware payload", "value": "f61da7327992c94a1c812e03b524ed0c40179ffe979066b651f621624c27f4adc756b1b8b304e6d830a631ebeb705241", "object_relation": "sha3-384", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688397, "uuid": "6aa7be3e-db3f-429c-85a7-8639358d8277", "value": "T1B6F761B0DB8FCFBD810A5419D9A6D002518BA72DBB75C5C32B721D7522EEE5A02F5B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688397, "uuid": "7e4b2f2f-e196-4788-b47a-289d351bec98", "value": "49152:HcfMtpELoWKQCcdLWDuNBXTQ+FV6/dg7hDyClq615tLyUDL1YLVv0SvwesT1lQ7Y:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755688397, "uuid": "46879bb0-d790-4fec-8db9-5ae496c3a209", "value": 75324979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755688397, "uuid": "c43d8e2f-edb5-4cc4-86ce-18e4491f5302", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755688397, "uuid": "1396f02c-0908-4b87-94c3-26b777751d54", "value": "Comprovativo_Agosto_iiExywZkGS_19-08-2025_121.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791fe6f4-7e04-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755721812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721812, "uuid": "63d6c842-30ba-4545-b4c6-fea9f6566de4", "comment": "Malware payload", "value": "7d251dbce001335ba0d7f697804e1fb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721812, "uuid": "0a6ba765-2473-48fd-b7ef-8bb37f47d9b0", "comment": "Malware payload", "value": "3f61c3774ae7fd2bc31da22879e6f1f7ac3121f072ffbf336a12d6f92bf2fb39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721812, "uuid": "7d0e2857-263d-4c89-9654-b6941372f741", "comment": "Malware payload", "value": "148018a40680efba4e868fd37b5c1d645745ae45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721812, "uuid": "c40166c0-1e43-4548-a84d-96c3164a7787", "comment": "Malware payload", "value": "8a706f68520c79fd3b8734d83ab0a8a6d30585492b83b638fabc760e886ffbfaa1a66e5fb2fd865753ad4699a7434fb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721812, "uuid": "96f5912a-6836-4cd8-96a0-05484cc86fab", "value": "T16466235F11DE88E4E9D50430462F9ECA22B2CE8744948C1E1DDDB989AE7AF75A0F7C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721812, "uuid": "c6bbb781-8681-44cd-b8e1-5d4dbe08cb24", "value": "5fd7a64f782f2a19b3a934fcf8a06b19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721812, "uuid": "9a713c9a-556a-4170-a9af-2536ade5e782", "value": "196608:Vc0AUAGk6owZ40AEmlE1O1Zi2FalBjozeozwe:Vc0AzwZ40AEmlE0ZDcl9oicl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721812, "uuid": "3c5f6add-b103-4fee-ba28-f164d9787efa", "value": 6965640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721812, "uuid": "c7baa1bf-3f9d-4e56-bf14-3d704c7eb122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721812, "uuid": "76639d19-3a93-432c-ba18-6e943932862c", "value": "MetaLab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b50801e-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1755686194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686194, "uuid": "ea42a247-59d5-407a-bb6e-18b91bf79dd8", "comment": "Malware payload (RustyStealer)", "value": "2a15f3d984591cfed95875e6e8d7cd9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveLoader", "colour": "#6E978D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686194, "uuid": "d2288df6-2fad-4fee-96b0-0bef9ceabbcb", "comment": "Malware payload (RustyStealer)", "value": "3f9dc80452c3a89fdca16f3add83811706156b829b1d958c7659550569f09dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveLoader", "colour": "#6E978D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686194, "uuid": "8108a3b9-dcad-443f-9bdf-dfe8a6ac7da1", "comment": "Malware payload (RustyStealer)", "value": "635a2748b0384df3b5b08e22b4cd86ec2425a091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveLoader", "colour": "#6E978D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686194, "uuid": "624c8e07-4963-4c51-a583-a50e88a2bfcf", "comment": "Malware payload (RustyStealer)", "value": "cf263bb6b8115d35f2b47fbd9ca38306bb1592e5deb90897401049ac44c2ce8825bef9fdcceef99917f133a268d8ab60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveLoader", "colour": "#6E978D", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686194, "uuid": "eb929ccb-d0f7-4361-b393-3a08e12bbd86", "value": "T15C865A11BB9A99EDC09AC074824647739A3170CA0B34BAFF45D486793F6AAF45F3C358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686194, "uuid": "cdb86348-1403-4b74-a21d-5bc4a6c32bf5", "value": "851dcd40b19fecfe3cfbf6c7f31a0844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686194, "uuid": "dd9ae8c3-b1f5-43df-be5f-5ecc1a5b6110", "value": "49152:njb4NCTfUQ8EqHMnkuaohWNEhHm5aeC4sQ6E3gVWeBEt/xNOHalDdVP1rTVkZxcK:jb2UqsStq2a9hXY5xaA8LlNDqzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686194, "uuid": "6eefabf1-05af-4227-99bb-484e86f13345", "value": 8346856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686194, "uuid": "358ab72a-e830-4786-9020-f6cd06371790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686194, "uuid": "f3b4c448-f375-40bb-bb81-89f2af19cfc9", "value": "zenith.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d35cce-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755692493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692493, "uuid": "9dc2d51b-49cc-4921-a735-959eaf7f2cf1", "comment": "Malware payload (XWorm)", "value": "3f6b356a7b782f2b514ff0f5757911c9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692493, "uuid": "1e103d67-747c-4eae-aa0d-f11f25d961c2", "comment": "Malware payload (XWorm)", "value": "4067fef3b33decef1a6a72fd9c8b191c81e5e999abdb6281bbdba41626f11638", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692493, "uuid": "204d42ce-5331-4a11-a13d-b3e4754cf25b", "comment": "Malware payload (XWorm)", "value": "8432bf727d22a3e737c7d7ea5721e53ce335dd17", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692493, "uuid": "92d40ad7-3763-4b86-a514-978ef91f6dc7", "comment": "Malware payload (XWorm)", "value": "2d62ec826aa086badd75f80fd18e7ad235225182c6eb090cbc611803b0ca6627f926dfc724dbcd438d03203b8790f703", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692493, "uuid": "759061d3-82dd-43f7-9249-48fa03338ce5", "value": "T113958CB0BB94BC04115CFD62DE50823D13DA233BE215BB4E4EC37AE815ABE35AA554F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692493, "uuid": "2ea16d96-4b58-4b10-b4be-8ec8c2f70f29", "value": "3072:6MH1FVvDa4rHNC9oB+qtiEi9babVmLfG0Pnk8h2TNg+rZosnlGnilMxiigInfU7D:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692493, "uuid": "b1c9c5bc-bfc5-4678-98be-c3c5ce2ba29a", "value": 1898500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692493, "uuid": "b70d6b89-9ab9-47d0-af15-6ca171a5b634", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692493, "uuid": "1fb50e78-dc1e-4972-8fe1-e6a35de57699", "value": "WindowsDefenderTelemetry.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665b46ee-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755648766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648766, "uuid": "c555436e-acea-4ccc-9a89-bb39f6182459", "comment": "Malware payload", "value": "55aff2d198c99a071422848a9286c5c5", "object_relation": "md5", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648766, "uuid": "c8560834-3e67-41b3-8aca-ab1538ce56d8", "comment": "Malware payload", "value": "40b8db71ec35ab5459a98c0de5c4d1df0bc05ed1b604a7e657f098189604aa74", "object_relation": "sha256", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648766, "uuid": "9efada4e-c851-43df-83e3-3814c22c2a9c", "comment": "Malware payload", "value": "e7afbf0ec86783679b09a8da19499266eb31ef9e", "object_relation": "sha1", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648766, "uuid": "90358ed9-e64b-4c2e-b517-e267ae679932", "comment": "Malware payload", "value": "98c2f5e33f7f9e80470b930e99232e57a133683e2bbcfd3f2926f2fab0765fad6b7a491a0fbd2276f1723ea40497a0f2", "object_relation": "sha3-384", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648766, "uuid": "afcde502-cc69-474f-90f0-b0c6022d428a", "value": "T1588523137F4683B1C2190B7AE4A5547403F5D78AB263FA1A399E13216843FFDC6A5387", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648766, "uuid": "4c9d2556-d59b-4e3e-8d73-71e4cb8a4417", "value": "24576:sSmOI21uRG1QZ9KCS/q3V3y1TAdXZeWebK1Rz1pSh2SAuh2UUIGD22RrlzgvT:FmM316BSy3VQAdsWRRafAuhTU42R5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648766, "uuid": "47cb2534-d170-4e36-b173-46c94cdf6b15", "value": 1801728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648766, "uuid": "750ae659-01ab-4b9a-924c-73e373adc09f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648766, "uuid": "6f271194-510b-4e9f-bfc5-e9dc71c47b22", "value": "pm.K-ebK8S8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0c2a63-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703486, "uuid": "70911ddd-0885-49ac-858d-6d506e14471d", "comment": "Malware payload (Mirai)", "value": "02cae111badfaf7207237413d93b1474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703486, "uuid": "e8d2ae53-f95c-4615-b524-e90f4575e21b", "comment": "Malware payload (Mirai)", "value": "41792a4ccd7a2c916da73b04442db2a1b67f902b7ac41e99824d46de24dc8028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703486, "uuid": "8af21a22-3957-4701-9ec0-50e48e401e5e", "comment": "Malware payload (Mirai)", "value": "69ef6cdc15d2f3de89eb4152cd32b9b7b54cedc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703486, "uuid": "af0c6e15-988c-47b9-b605-0bbc039ccc27", "comment": "Malware payload (Mirai)", "value": "b93ecf8006812714f01af5cf2c05072996e1fb174afe7ef5cc6df7eec4fdd31bf6a390bb57b7db037672d79606f93498", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703486, "uuid": "80ce6609-2004-4edb-b899-4cde5de055ea", "value": "T19982BF19D25AA952C9610DB6F8A80E48DFDA3FF5D8E3782306158E8C57E10C75EFC48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703486, "uuid": "ae9aef99-5602-434f-b4ba-0781fd1fe1b0", "value": "384:/MniNlLW+mN2PW4f2HlRfc0zXO9brbXsSh7qmdGUEpiaVGt:/MYPPW4f2HlRfcB9/bXsS9q3UELVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703486, "uuid": "ae70f9ba-611f-4913-bcd2-7ae12f881816", "value": 19200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703486, "uuid": "0a65d66d-ca5e-47a8-9cef-3b92c622eca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703486, "uuid": "da55d9be-e398-4b8d-911b-2b2b09468afe", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73df385c-7dac-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1755684008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684008, "uuid": "8ba7373e-d647-4d50-a618-5a290c8c0d5c", "comment": "Malware payload (GuLoader)", "value": "da46e40befc8fe047880faf81d239665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684008, "uuid": "cafe6d79-862b-4bf4-bc77-88733a72c338", "comment": "Malware payload (GuLoader)", "value": "420c14d970b34cad90493f8377d8130ac4e471da915f70c873a1db78d68a5e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684008, "uuid": "911b25fb-7b7e-420f-9560-717b841630aa", "comment": "Malware payload (GuLoader)", "value": "202609a0a76de15ad525350951e243d189ae6e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684008, "uuid": "ae8eea66-3fae-471e-8fea-841e66a5c660", "comment": "Malware payload (GuLoader)", "value": "2ab13f78f7c31c8949f08c871da6411b889956ebcfd02453861ebcb41052da74b5425c05b304448d216f18d3967da23c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684008, "uuid": "d4cf3018-c00f-426f-acdb-9d00cf200523", "value": "T1BCB40200B378D857D1A340B7587A9ED961A9DF2519469E0FA3503B2CF9B628FDB0F342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684008, "uuid": "e1263e75-d3de-44ca-9850-c3ff80f22583", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684008, "uuid": "5a395074-db5c-4456-9b18-592c3cca6d4f", "value": "6144:tT4DtIJeHFQEuKFntQgIS6fH8R5wvDs3kdMntZ1V9gc+7iomMe6y9OlWinUwUs6o:tT3MQKZaTcPSdUngBfX+OxUXsd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684008, "uuid": "fce11c01-c24a-4fb9-967a-cfbfdc22fd2b", "value": 521869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684008, "uuid": "41e5684b-fbd5-43ad-8f22-e0c23bdc27ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684008, "uuid": "3aceff7d-70e0-47c6-b0c7-8dd627db7295", "value": "rActionary.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f37fed-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1755692841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692841, "uuid": "786e26ae-dcd7-4348-a658-42f2d2cac323", "comment": "Malware payload (DarkCloud)", "value": "834eb0efb1626df2454962b6fe7ff913", "object_relation": "md5", "Tag": [ { "name": "Darkc", "colour": "#FB53D1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692841, "uuid": "93c4fa81-48c1-44f4-885e-670f6782be51", "comment": "Malware payload (DarkCloud)", "value": "42137d564499e5ddcac13b1aa1513f6f997d288c697a0cd6afe54dd3528c1414", "object_relation": "sha256", "Tag": [ { "name": "Darkc", "colour": "#FB53D1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692841, "uuid": "e2ee19e2-cc4a-48f3-a1d9-d4238aa911f8", "comment": "Malware payload (DarkCloud)", "value": "85ec2f4b14aad6b6a2793b9c83ab6fa099c4514f", "object_relation": "sha1", "Tag": [ { "name": "Darkc", "colour": "#FB53D1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692841, "uuid": "2a8476df-2c51-47fb-abdc-a127b4060fa7", "comment": "Malware payload (DarkCloud)", "value": "3b8b6b6f31f17f703906da3236c0c88524d0ac0c59512da3f986c2b93d86dc1b06cefd6a59a4e2c03bc3d63e98c59e93", "object_relation": "sha3-384", "Tag": [ { "name": "Darkc", "colour": "#FB53D1", "exportable": true, "hide_tag": false }, { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692841, "uuid": "5b937443-496d-4d34-92f1-bdb6c9589372", "value": "T129414D8E3A81B0801717A2DB4D6E5847E612DD36745ED600F232F0843C2CB21AB6FA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692841, "uuid": "6edb30ff-54bd-4758-aa2b-52b71240e498", "value": "48:qiz4G+TEUa1xGC5ONHrwjZ7iO6ETXhrWJYxpycnCM86e:gRGxawl7ZNrW6xUgn81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692841, "uuid": "b43342dc-1043-4777-994f-62fa01765a17", "value": 2256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692841, "uuid": "2223bbb4-16e5-453f-b78c-191db8fa62e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692841, "uuid": "aa3cea9e-4871-4cf9-92f9-2149fed7d220", "value": "RFQ#007865-TECHNO MACHINE TOOL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd0d5bb-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700617, "uuid": "11a7ca7e-083a-40f1-8bbb-adeb6c341f73", "comment": "Malware payload", "value": "f46b02d0cf429bb20116dde91da0cb35", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700617, "uuid": "4e8caaee-b54d-40ac-ba0a-5bd9777763c3", "comment": "Malware payload", "value": "4235d1e13c3de67d1ffeb4efc3471b55317faf5f211f7b87910a74ff475ff8ed", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700617, "uuid": "8e1acd1e-336f-4d9a-9860-a776a456166f", "comment": "Malware payload", "value": "203e9970218ed936da79fde832098763c46d77de", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700617, "uuid": "b72cfbfa-76c7-4284-b4ee-217d5e0e97e9", "comment": "Malware payload", "value": "8cb592b5c6ca85a71d550ad550e325c8913b347e72f4ac885e6e15e634e4305b0ff2b5b3d0c8574a3b8811da3dc14bd1", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700617, "uuid": "d673b99c-24a1-4080-80c8-18e2345cc47a", "value": "T190D5AE06FF4385A2D896407A12F3677F8E395A148735C9D3DB9228B9C8315D1AB3F398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700617, "uuid": "5dae0e39-3514-4869-9893-88967e70f766", "value": "6ec07dbdde37f75d6446ad4aa6e1894e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700617, "uuid": "8aa51375-4872-4e81-87ad-10d16356ca19", "value": "49152:ZWrKHf8uKkzM4Kugl1iI1BZbDP98hAih6zkH4aD63JnT8TeFdJ:ZWrWNP+lDV8hAihnH4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700617, "uuid": "e49c7eba-eb95-4600-a6d2-19a1509a7e37", "value": 2771216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700617, "uuid": "afb0d626-79c1-42a6-a9ad-a81a220f2927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700617, "uuid": "807f73f7-7bc9-4a19-bc48-4f1d9152a103", "value": "4235d1e13c3de67d1ffeb4efc3471b55317faf5f211f7b87910a74ff475ff8ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b68fccc-7d98-11f0-91c6-42010a9c0006", "comment": "Malware payload (BQTLock)", "timestamp": 1755675457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675457, "uuid": "463e3530-dd1f-40c6-bd73-feceeb0b4111", "comment": "Malware payload (BQTLock)", "value": "d244b63e40aab7299d194c11bf060054", "object_relation": "md5", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675457, "uuid": "752c2643-3479-4f4d-b2a1-81c2b286ff50", "comment": "Malware payload (BQTLock)", "value": "425b2f283b71237276f84d941d9c2982c7f61a9aff12ece10e15065b73b7165e", "object_relation": "sha256", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675457, "uuid": "53ca69cf-142f-4a6d-98f7-2293c5d2910a", "comment": "Malware payload (BQTLock)", "value": "5531198fdd7c3691be3b0bb2e449dafa29620c85", "object_relation": "sha1", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675457, "uuid": "29f1f294-915b-433f-829b-00e75a2a2935", "comment": "Malware payload (BQTLock)", "value": "8caeed67960fcf8c98f89c1f8f996dd682cc9e476efa90022da68f6617702e1824f14174c99eb50acc567ccfc92e128d", "object_relation": "sha3-384", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675457, "uuid": "4f67ad59-5dfe-417d-8516-95a9cb34f1b3", "value": "T163865B6BE17720EDC66BC1748257A732BA30B81400747E7F6A54DBB12F61E901F6EB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675457, "uuid": "1e38a312-fd99-4c8f-9ad8-7c573242ed00", "value": "96e2c2ef4b21c8c7d61113fac3c4bdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675457, "uuid": "4196c202-8b91-49ba-8e4c-7fbac5fe3a5b", "value": "98304:bjt9/0y2EP7GEBd3TPXgfCYUWIf+ccwacGafsCILeeHZv+TuETo:bz/32oTPMpCCeoZIDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675457, "uuid": "dc132953-3633-4e38-8e0a-b80bad40ed69", "value": 7976448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675457, "uuid": "b799063d-5e2a-4be0-8d3a-fc488bc2371f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675457, "uuid": "dd2287ab-22e7-477f-9703-5a33bcc648c4", "value": "425b2f283b71237276f84d941d9c2982c7f61a9aff12ece10e15065b73b7165e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62624ef-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679851, "uuid": "a381f1bf-fdd9-4c73-a2db-d94cf4a73765", "comment": "Malware payload", "value": "9f246e1b99f9a3fdc025c1197c38c44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679851, "uuid": "46244c7d-d337-41f9-9fdf-b6b78a5c97d8", "comment": "Malware payload", "value": "426c07651b7c6305a5b4e297a8f0b9d878193ee3d53d7a2b43957684481acbaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679851, "uuid": "29fab142-9794-4f17-8a43-887f9c501a6b", "comment": "Malware payload", "value": "0e692481efbf8ee28d5ca656d51d5f0888589de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679851, "uuid": "2f0c263a-223b-4a6b-b617-58b28a960115", "comment": "Malware payload", "value": "2bb89f172db4186fea9f70d5beffa36b1916a80f70c46a50a734a205275696b7cf5336b985b0a089501fa576a3379c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679851, "uuid": "710b1960-a864-421c-a293-f06357687d3d", "value": "T1D4122A089BE8856AF9BA0B736DB357404330F902496BDF6F1CCE525F2C366580B937A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679851, "uuid": "fd0e944b-1b2f-45a2-8513-12f3282499c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679851, "uuid": "0ac7bd8d-a72b-4a82-85a0-d3d280f68895", "value": "96:txlq62w6VnkUXXweMcgDLRyGNMj8Tf38XiDLdmfu+xw7gxTZaijf5mlrxRxLszK1:1cVnkXcexlTP8yDRqwyTUEOxRl4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679851, "uuid": "d31dcc37-037e-462d-a910-23d8785f11de", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679851, "uuid": "0eab4b31-6216-4389-926f-545cf04a6f91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679851, "uuid": "b69d0ddc-784d-4358-a035-047411c23fb1", "value": "ADSSServiceManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe855c7-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698819, "uuid": "0dfa4ecb-98e7-4cff-aa9c-57f401c0a8d0", "comment": "Malware payload", "value": "ea0fb64bc4b639a15f33758bbebde338", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698819, "uuid": "2e3911db-1869-4601-976d-31c16f8ac40e", "comment": "Malware payload", "value": "42a80a0e15d2189398f6110493d4415518b14eab647a8a66ca4682846856f7e1", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698819, "uuid": "6edb78fa-2343-4720-a65b-92b694bbeb61", "comment": "Malware payload", "value": "ae6b435088ebed6a52102df7d3a1704a272ea3b2", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698819, "uuid": "0504538d-0545-44e6-b23e-926032458930", "comment": "Malware payload", "value": "9f59b950ca1681eca87f720d15a1299279585b23e528674e3bc4acfdd180c677683d4c3373625d814bed520785f3c74d", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698819, "uuid": "66b2c4d1-4490-43aa-aee6-a2740288d22e", "value": "T17FB5E6D2B844D571FD24483E80627ABDEB215EEF587CD009F28875B6A171DF22127E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698819, "uuid": "fb52f775-432f-452a-a520-51bfb5a7a1a9", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698819, "uuid": "6290270c-8572-4802-91bc-207398e836a3", "value": "3072:IGOfZMRnxR9y7b7Vj/9jRZ5vka3PNEAYe111Mp94kqnmgGvmIkvdhu:cf4nvAbPV69OOvqvdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698819, "uuid": "20eeb62d-39ab-4e6d-8e3a-63ffd94836f0", "value": 2391080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698819, "uuid": "0f23ce69-63c0-4ae3-add4-f4741c9b2744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698819, "uuid": "428c646e-8b74-455e-874c-a376c214571f", "value": "42a80a0e15d2189398f6110493d4415518b14eab647a8a66ca4682846856f7e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db49e03-7e14-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755728745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728745, "uuid": "dfb0f7f2-20ed-4ffb-b3f8-b4875e6acd39", "comment": "Malware payload (XWorm)", "value": "1332b13ac1905269d208165bc58f3893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728745, "uuid": "6bc9a2e4-31c1-4a44-99fb-d8e5c6559af6", "comment": "Malware payload (XWorm)", "value": "42bf72ec18bf518b7750a61d88c607a354f3110df9405cd13ec980ddea4b0d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728745, "uuid": "4cac6f85-329e-41c2-a05a-8cc212f60372", "comment": "Malware payload (XWorm)", "value": "8fc9d7ac9deaa6c254399f0818bd59dd5adc6ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728745, "uuid": "189d14b4-f8da-4460-9ab3-eada52f5449b", "comment": "Malware payload (XWorm)", "value": "31cf9483309de9e4f1008da143d8d1f7e93b40cb6a2a26d44e0b41a30fa03c4bf4ac1a60a334160cf97cd350d744ca78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728745, "uuid": "dd6415a4-c92a-4926-b8a6-795608949b34", "value": "T143D36C5EFB429884C51D0D738563A14847ABD8A75427FBB724D83DF48DF3E988E4B8A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728745, "uuid": "27d7b7f3-4fb7-4c27-9f9c-91d43322a3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728745, "uuid": "d7eed8e8-0f84-4733-889f-cefc93ca30c3", "value": "3072:NpqiOKvXeyLDoM141umqvTZ4ZmbJLTnge:55vXea9u1umqv14Zmbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755728745, "uuid": "9d5c92be-f385-4b12-a8c9-ba218a7a88c1", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755728745, "uuid": "dd1ef732-7885-4435-9c87-e45a2a330a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728745, "uuid": "02719af4-cfd5-43d9-a923-65739982ae6d", "value": "1332b13ac1905269d208165bc58f3893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e247ea-7dad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1755684487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684487, "uuid": "3e13f2ca-beeb-43bb-be96-92233d99f42e", "comment": "Malware payload (Sliver)", "value": "533295e64b41a15830c83969cb800c01", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684487, "uuid": "a451704a-524c-438e-8db3-8adacf69f5ed", "comment": "Malware payload (Sliver)", "value": "432176960a5189336c1fa2e9328adce66917f0d2d2f56c2ba46158ae74b89b08", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684487, "uuid": "4a1a83d3-6419-46cd-82ec-ac70bb360afa", "comment": "Malware payload (Sliver)", "value": "b931f15b378075eb922729cf54593bb80dcfb1ac", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684487, "uuid": "d4f47d3d-5c46-4508-b266-0228be17e3bc", "comment": "Malware payload (Sliver)", "value": "4905f3c9a10869beb1d5063e278a060b7a3c6ed1109a20faf7c3fd65e814a8bbdef34b210273cabc7023c16eddc9031c", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684487, "uuid": "d80e3227-9884-46f3-b0ce-2bb2520820b2", "value": "T19A071B03E8D610D4C4E9D2B489214262FA71785C0B7973DF6B61F7B42B32BE49E7A790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684487, "uuid": "f8200586-f56b-4c45-b5cf-4dc3691e5138", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684487, "uuid": "de11162c-b34f-4725-8d39-44386a7251d3", "value": "196608:IzWfDfsM/VhqTLEdsduZ7OuWoxsqsnJ8:NhV9SksbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684487, "uuid": "faedcf94-9098-4506-9ccb-c5e698bb6acf", "value": 17296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684487, "uuid": "9e909e81-8200-4b30-a6fa-3fde551a4030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684487, "uuid": "242aca4d-9f20-49e6-b5d8-cd1f4bc19878", "value": "f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dc4852-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755677381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677381, "uuid": "2b983131-a247-4f44-9233-668841524504", "comment": "Malware payload", "value": "9f8117fddf96dbeab1f70a682cdbf225", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677381, "uuid": "bc2a17f4-e1ce-4fda-83f5-3107345c1fff", "comment": "Malware payload", "value": "438c8bf237332706b67521e1ef44fd02be249867c34cbc2ce3f9851e40577151", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677381, "uuid": "0688ab10-06b8-4c3d-b3e4-54ea7e573613", "comment": "Malware payload", "value": "37c9f1fe30d52e425169234be356b899058827e4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677381, "uuid": "c23a047f-ef46-41e4-88dd-c53c364d72c4", "comment": "Malware payload", "value": "c7228b38a404baaf128fa0c8cf1ccb5db50cfb15b8eeafaca082542126d45b32b10501d633513da1690b1b03dc305fd3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677381, "uuid": "bde0e44a-6d99-4e8a-9900-4553ab928fb0", "value": "T127762302FB58AA5FC8F3D332187556366066CD16CB13E74BA40473B529BFAE84B427E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677381, "uuid": "93962edd-d81f-46e8-9483-f2e89213ef3e", "value": "196608:tAw9lYvZ4qBEeR8wt2wxCaVxlNIIRBingo+4kK53:tl9OZ4Ud2+ZNNbRBw+4kK53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677381, "uuid": "df4e996d-a2cb-4395-8c74-05139af5c929", "value": 7506459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677381, "uuid": "cb37f9e1-254e-4b89-a9c0-99ed07342640", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677381, "uuid": "133f84fd-4338-4b05-932d-1fe6b5293d23", "value": "438c8bf237332706b67521e1ef44fd02be249867c34cbc2ce3f9851e40577151_detected_by_motmaenbash.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f907e19-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755699435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699435, "uuid": "c4e7242a-112a-4805-8351-12eb63b0c3d1", "comment": "Malware payload (AsyncRAT)", "value": "0002adff8bc4c7bd2b481957baf7cf35", "object_relation": "md5", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699435, "uuid": "f97da87f-9fad-49fc-8c4a-98a7dc70bedb", "comment": "Malware payload (AsyncRAT)", "value": "45b343f36874f23da6602e68e390fbbf7c221c8014e8ea04535828e4ea54876c", "object_relation": "sha256", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699435, "uuid": "0d06fc0a-8cce-4414-8d17-887e3dc77741", "comment": "Malware payload (AsyncRAT)", "value": "bfe419fc4e1043e7f9ae55957a1df29439bca02f", "object_relation": "sha1", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699435, "uuid": "82a73eb0-0f9c-4e96-af1f-257df1435889", "comment": "Malware payload (AsyncRAT)", "value": "a20546db0e20788d100a4b1c5dfc98540930b74ab443680ecd70c46fe6e29c1b4a8554137e63947c1bbfea771e4eaa98", "object_relation": "sha3-384", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699435, "uuid": "b92fcc24-6d04-4b9c-b575-938d2750aa5d", "value": "T1185533DF7A967C06B4CA82982E60AA4B135BC3CF85C53E51153C8423DEAE436B1C7797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699435, "uuid": "fe8fd874-1902-4c35-baf8-4df94a1f0cc3", "value": "24576:pZIeO6bbkPq5KH7OZed4tz/koEstIrkz3R4IB+W4lG705U7VGX6v3utS/myYekI6:pZD7bz5vZe4tz/koES0uBgGVGqvcgjYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699435, "uuid": "418c82d6-b1c3-4378-abee-2a963abd49b7", "value": 1382488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699435, "uuid": "abcc8bc7-c8f6-4835-a858-8bc46efac70d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699435, "uuid": "7a0e50f6-1d2d-42d4-8a65-6e3f85513fb4", "value": "45b343f36874f23da6602e68e390fbbf7c221c8014e8ea04535828e4ea54876c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79a8b92-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700549, "uuid": "f350dff0-a13b-4543-a5de-b03297d135a3", "comment": "Malware payload", "value": "7e3db2d4be6c04555c496f5b9ca0b1a1", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700549, "uuid": "2f0231f6-10a8-46e7-a025-51910fa27f7e", "comment": "Malware payload", "value": "4639b903a522ad905ee74418ad247fc32bd842e593e8ef382d0b6309843b7543", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700549, "uuid": "d2435ac8-42d7-47a7-9fa1-be64764a6d6f", "comment": "Malware payload", "value": "dd97c2a9cb9042e965afdeb265cf9c93966ab758", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700549, "uuid": "dbd1f77d-de8b-4a5d-bdde-b1e96cda4853", "comment": "Malware payload", "value": "6e00a4d1ca07254657b9774e9616a267768d765b728d4d370ea95748a47b2765d6461da575dd4fb21fec68c664577e2f", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700549, "uuid": "7131a1d1-3874-4beb-8a05-a31e9b69dbfe", "value": "T1BFE56A47FFD741B1DA9D053A52B1A37F5F3A8D084B60D4D39B511F9AE8A22D2223E348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700549, "uuid": "e3d99647-f335-4359-9529-9b704f432e69", "value": "404748c1b77439418c3cc5518ae3754f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700549, "uuid": "4ef2f3d2-aeb6-4b81-b615-83d1f9ce3b06", "value": "49152:P/rrJB6kELi4p1yFIkyc8W7JKeMck2P24+zukv856YIzD3MBszNr:P/rCkjFIkyXaJKeRkr4yv8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700549, "uuid": "5096e5a2-dc03-4cca-b217-c0bdc4dab473", "value": 3239184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700549, "uuid": "684911c4-2e9d-4e5f-a7a6-90e6a87f6125", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700549, "uuid": "df561b02-7108-4448-9733-f8dd37b30a64", "value": "4639b903a522ad905ee74418ad247fc32bd842e593e8ef382d0b6309843b7543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fb96c3-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755648678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648678, "uuid": "ca7b1c63-07b6-4d19-97fa-389fdac9a80b", "comment": "Malware payload", "value": "7b95823879dbfd5895b0d3e5f4fcd338", "object_relation": "md5", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648678, "uuid": "d3fd13ac-15cf-46bf-ac68-12cf58b8da15", "comment": "Malware payload", "value": "46be33b6d04b4781b91b7fcc74c2e584d0039f28cd1ba1de60ab88d4e0783b0d", "object_relation": "sha256", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648678, "uuid": "b01bfda4-58ca-4b1e-8308-a162b2e285fc", "comment": "Malware payload", "value": "fd640bab37741b5d0d8cb840be8612e5f9812948", "object_relation": "sha1", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648678, "uuid": "95ccda55-b277-4fda-aa9b-f4c6d9d991dd", "comment": "Malware payload", "value": "22fd6ade5e688da09e048acbec7d0d68c66d168bf25cfbfdedf21321a393f208dabed867680ca53ff9dd22af4f38a36f", "object_relation": "sha3-384", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648678, "uuid": "75e496d7-edde-4927-a6cb-b083a5a197d6", "value": "T1D1F5AE18AD69D0DAFDE305F17F2DA2A2B412AF3BCD28176350F8CB611245DDD123626B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648678, "uuid": "f9a5bf6a-2242-4311-9ffa-d7386fcf60cd", "value": "1e67d2940d71dd2c69b0a1f1192a549d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648678, "uuid": "f8028c8c-7ae7-4bad-b838-03b26fc5e4f3", "value": "49152:7xgdQFKC/PRoa3xPCX5VwIKAXsopR9xZghXs1Ao:MoyuCpVwIKw3ZgeAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648678, "uuid": "13098d5e-3917-4cb1-82d8-a4fd608ffca7", "value": 3419136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648678, "uuid": "f869adba-37f5-4b05-8bcd-324a22903a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648678, "uuid": "86242807-5444-4bc2-83b3-00d2dbce4eee", "value": "46be33b6d04b4781b91b7fcc74c2e584d0039f28cd1ba1de60ab88d4e0783b0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bb9fdf-7d6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755656607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656607, "uuid": "b048d962-525d-4728-a193-4a81ff58747d", "comment": "Malware payload (Mirai)", "value": "cfda32562cc2b9e5c38d3f672929f93c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656607, "uuid": "57c94952-f4df-4fdc-ba2b-61b4ace7ee6b", "comment": "Malware payload (Mirai)", "value": "46f60dd981b0201513c61743f52a32c7fa6c5254066d948d2280238ee5a288f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656607, "uuid": "4a660cbf-039f-47b3-92eb-d84d7428378f", "comment": "Malware payload (Mirai)", "value": "86d738b1d311d448a6b2e2cbe778de8c315756c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656607, "uuid": "f273a34b-9222-43c0-828a-1866d61c40cd", "comment": "Malware payload (Mirai)", "value": "3da703b99e578680bed1858650f57e2351c55e8a43c1e6a94ed91b3ed67ebf967b1313f54d91aaa1e72ce4e53f8eeac4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656607, "uuid": "0936f8c0-45e1-4834-b9dc-c9929d2eaf57", "value": "T1C641E5ED90A2D5D6C488CE1CF1628F64BCE59F8E32968FD09D0F2E29494D94C7C37A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656607, "uuid": "b486d280-44d3-40af-bf0a-6aa56e37908c", "value": "48:TOB76QskaImoZn8AEOISm4CMsZqI5wvi8GsnAQnw5nsf:CD644ZaDFkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656607, "uuid": "43664701-d319-4d8c-87a4-c886e1f76571", "value": 1940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656607, "uuid": "b960bf05-ce12-4808-8df6-dca0ed5b1983", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656607, "uuid": "5ddc6b97-5b5e-4627-9ad3-f2cc8c5f2ef0", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9233ed5-7dac-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755684231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684231, "uuid": "ec9dfb6c-1bb6-42be-ae25-71e7bb3ad36d", "comment": "Malware payload (Mirai)", "value": "f1594237b626858e161c0d95cbbdbe96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684231, "uuid": "290feb79-da68-4d86-bf4f-99f88ed4b14c", "comment": "Malware payload (Mirai)", "value": "47e51bed22685af1ab081dd8b9a5bee3150697e476174c1e7e066232464011aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684231, "uuid": "6ec8396b-32c6-4f25-9b44-d1b70d2bc32a", "comment": "Malware payload (Mirai)", "value": "973b5d8a979b823d97c0adc1fc9dde1e6b64042a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684231, "uuid": "3a12d480-1d0c-4b10-9e56-2b485c0f5111", "comment": "Malware payload (Mirai)", "value": "48669eef761ccf510dad2860cdb41de16609252127d9293d5e20951ad1d039cf69dfb3d095f593922e40e4921e247684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684231, "uuid": "ab4b1547-bc0f-4ef2-9ffc-26b5d2bf8103", "value": "T116833B02735C0D47C16719B4293F27E087BBEAA121F8FA85690F9B469275E77108AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684231, "uuid": "2c5ebb1a-803e-4743-80a6-dafd92fea5e3", "value": "1536:l7m85GvSrWVLnb+t8wWpVd+6yFin4vshfB6m//9hq5XyxtZy3a4:ZrYjL7+R2KMB6MqXyxtZy3a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684231, "uuid": "bb0a0827-a066-4255-a03c-dfc2d68951f4", "value": 80736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684231, "uuid": "9316fa79-4c41-4032-9c6f-45c2d1944639", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684231, "uuid": "bc6ca28b-4158-4d17-9c59-c028437fee8f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae39aa0-7dcc-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1755697656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697656, "uuid": "96a670ec-9363-455e-8b70-12a4a2e9d9b8", "comment": "Malware payload (MassLogger)", "value": "5bfe183c85c0822586f3fe68ffd699da", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697656, "uuid": "0c359c32-218c-4765-93ec-239feb838805", "comment": "Malware payload (MassLogger)", "value": "482fd155382b42cb1775f996c83ae4527701aba2c0b4c38a2205e6707635d7f8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697656, "uuid": "9bf49bc1-c62e-4522-9757-479641a4280c", "comment": "Malware payload (MassLogger)", "value": "288add9ea7af0b010a5a55e576483aa29971757b", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697656, "uuid": "9225e490-ec15-4e46-aa0e-6e5f7e45d34d", "comment": "Malware payload (MassLogger)", "value": "1bcfd60367519a453e153f4a8e498b07c1130d0d3a24d1271c51810d753d42c920a15e5879e828b39721991d6356e05d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697656, "uuid": "4999c120-9070-4732-add9-bcb1e16e39d8", "value": "T144257D9D9471ADD3A054FE70E540EB9B8CDB4384122747121FE5A8AA6302C47FFAB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697656, "uuid": "3044d745-1af2-488f-8b61-1b25dfdaf9bb", "value": "24576:K11hxWxzX4vJWqaCsV7/0iJpMNkcYsIshWbVgrv/:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697656, "uuid": "71472cb0-52af-4177-b916-5145376867f2", "value": 1009724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697656, "uuid": "7c8f935f-6daa-4c64-a573-ad1f7808cdbf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697656, "uuid": "81c8a89a-168c-46c2-8463-82f6cf210779", "value": "rrckk900876.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1df16de-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755693641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693641, "uuid": "52bb7b2c-48cd-45cb-a240-9844058fea58", "comment": "Malware payload (XWorm)", "value": "fb5d864ea260cea1e75d825d88d4152b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693641, "uuid": "5cf7b8ab-efe3-4ba6-80f0-e59126942124", "comment": "Malware payload (XWorm)", "value": "48658b63dba7df9119b111b9d5d537f087162b7a8be03904dd6b76cfe39380df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693641, "uuid": "91a3ae65-70d0-4bb8-bd18-8be4510c9283", "comment": "Malware payload (XWorm)", "value": "fc31f4cccbfef0873736337065e4a84d7c60dfc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693641, "uuid": "9761f484-1c39-45b1-b4eb-66405d56760f", "comment": "Malware payload (XWorm)", "value": "272fe8ab670f76dbe677eb25af0f4970d296030b9cd7b5df161c079094ff0beff1b096cd65a8cd61631621fa9244c44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693641, "uuid": "cbec8724-fee5-400b-a7d1-4952cc923a53", "value": "T1A9059C066AEC01FAD2A2D33989E25982D7F73D5793151FCB02D58D4A3E9B1D0E87E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693641, "uuid": "52b00c9c-d4e4-41cd-a536-a01d9b85a7e0", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693641, "uuid": "e975c90d-a4c4-420f-a596-591a4d5c748c", "value": "24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNIp:N0o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693641, "uuid": "713db762-17d0-4ae6-a7ed-f6abde3b9dcd", "value": 839727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693641, "uuid": "56e8817c-c65d-4f44-84a6-36d20d6aecc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693641, "uuid": "14d7b66e-b585-4e7a-9d48-b982c9a7b88f", "value": "fb5d864ea260cea1e75d825d88d4152b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba388aa-7def-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712689, "uuid": "6ec35a7e-1a56-4e85-95a1-5d260a335e12", "comment": "Malware payload", "value": "25814f692b3255968c64b8e57efda014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712689, "uuid": "ffe42af3-67cb-4e97-a78b-4c17b656c02a", "comment": "Malware payload", "value": "486f6380bf22a131ddb76aa8beb9d6163a2c9b43d0c766be3702e34aa04647a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712689, "uuid": "273fc580-ad13-4140-a35a-016843b9b8a9", "comment": "Malware payload", "value": "59482b9982d1396ef9b2353358ee22f35574f377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712689, "uuid": "39bc81e1-8f15-4f2e-aab6-0ce02dd50031", "comment": "Malware payload", "value": "6eb4ae9d825c4e585d5c9dea3f5229eb1f869af5b6201eab8f240c33a294059262cd565bd04b2bff60da9797f6c4435b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712689, "uuid": "270ee1cb-a48b-481b-95df-7987534f3ec0", "value": "T12228334822E24E74F85482366FF5181EFA56A9151BFD8D8BE3DD274328E73C2C9396D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712689, "uuid": "a808f220-d0e5-43d6-9622-ff6e720ad4e5", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712689, "uuid": "f5272fbb-e273-4cd0-8e1b-becea754fcdb", "value": "1572864:RDTGDztnPGF4CU2Y2uuS66iVBlyEoOvPMIJSRRTIzQW23yGmIAgeMaXWIyW+en:RGNnPG0RiVBnoOHMI8RJyGNV1abR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712689, "uuid": "e97a766f-69d6-4c05-abdb-d8ffa78e151b", "value": 93643054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712689, "uuid": "1910dd64-4812-4262-96a4-48a6cc204678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712689, "uuid": "74d0ec89-9b76-488c-8e78-3a2a21cc3346", "value": "215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8eec74-7d6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755656913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656913, "uuid": "0f465d00-c043-45cb-b534-b1c85e162462", "comment": "Malware payload (Mirai)", "value": "bcbbcbc4d1bdbec86169bb3300bfb8f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656913, "uuid": "894693b8-c896-4409-854f-6e7ff87f3e5a", "comment": "Malware payload (Mirai)", "value": "487eafa10d7317704ae1e8ba343d502b1b9420cf61bbe7b4dafb4dd11eac949d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656913, "uuid": "781bc04b-9630-4f59-bf78-42a81ea2d3ca", "comment": "Malware payload (Mirai)", "value": "af074f3ab622e4272f0d4b0e96d182983ec763b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656913, "uuid": "145346f8-7c0b-41d4-bd0c-fd4dd80a35d6", "comment": "Malware payload (Mirai)", "value": "420e07b5a41d439155957549e1081780b9e97a75e9a6807b28790138d294e3f06b35dc04a20fa4195a18f4214f7b0702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656913, "uuid": "2f36a1d9-b7ab-4933-81d3-5e6bc2fe23d8", "value": "T13D83930D3E318F7DFBAC923547B79E20965833A527E1C585D15CFA411EB028E242FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656913, "uuid": "7a9ff940-d886-47af-af8a-422e09edf9ef", "value": "1536:H24Cw3dj66U9Hdp/b3C9E0sMv+LMIQEImxhR/Ezdy:HCcdj7U9//bosMvEImxhRQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656913, "uuid": "7f370270-2c17-4755-8dad-2a9f44e6870a", "value": 81388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656913, "uuid": "9de6c1c2-fb5d-45b4-824b-151b905efd26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656913, "uuid": "ec2b4af0-70c6-4b80-921e-58a486fdcd7a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043f21ee-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698853, "uuid": "ad258b7b-0c7a-4025-b6f8-b187f83cb9ef", "comment": "Malware payload", "value": "21f5d3035afb91717728cd4a002ffb9b", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698853, "uuid": "19f4fe1c-f8c9-437d-b8ce-a0748c873660", "comment": "Malware payload", "value": "488408195c5350867d83961672be879d386e7b016181e99dfa4431b5ddb9237d", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698853, "uuid": "de8c1014-66e6-43eb-9c64-bb5673c96b8f", "comment": "Malware payload", "value": "e06b8dc8c22612501e6fd6227ad839fff2655552", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698853, "uuid": "24e52cd7-a1ec-49d9-a4a5-36997dc68d55", "comment": "Malware payload", "value": "7700e3e511d0c9d5af36978b45431c5bb9a2e05767235f85bcbf5e650d6de22970a29920f83ea242bf799dcdbdd934fb", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698853, "uuid": "3f27fb39-3512-406e-8779-ff4fd224a00c", "value": "T1B74506D3B8888951FD2844374097BDFDEB169DCC9CB8A10AB24472F954B2D726237F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698853, "uuid": "7cfc87ff-16f8-4726-a84d-798534baf5a5", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698853, "uuid": "e2a1d405-1a37-4711-9961-a897e7b8a73a", "value": "3072:XY0M3Rq2uCyUa70j/9aRZ5aHa3rNEAYe111MUvdfg:I0+q10aaAPvdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698853, "uuid": "52387212-3135-4ef8-b64a-1810f5db95d2", "value": 1215568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698853, "uuid": "5c395d7e-101d-4c4a-b785-2643a55d4314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698853, "uuid": "692bbaf4-4e91-4338-8ffd-0d1c399dea7b", "value": "488408195c5350867d83961672be879d386e7b016181e99dfa4431b5ddb9237d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b2e0ea-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699090, "uuid": "ee106fc9-ebc9-4ff0-9700-bce19f11f497", "comment": "Malware payload", "value": "bb23d0e061a8535f4cb8c6d724839883", "object_relation": "md5", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodRAT", "colour": "#15DC65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699090, "uuid": "819da037-6b14-4f53-a900-65fe75a5ce96", "comment": "Malware payload", "value": "48d0d162bd408f32f8909d08b8e60a21b49db02380a13d366802d22d4250c4e7", "object_relation": "sha256", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodRAT", "colour": "#15DC65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699090, "uuid": "4eec1f30-2d98-4c20-a839-582ba9cff40f", "comment": "Malware payload", "value": "21a390cd3c56a5277c88f201a67b864e4511ee4b", "object_relation": "sha1", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodRAT", "colour": "#15DC65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699090, "uuid": "4cf84afb-c1fb-4964-b585-092dcff4da03", "comment": "Malware payload", "value": "d0eed7dcf402bd4faa6582af5716fa424d8bce5eb3270b5399b668bc7b6aae9ce2d2f0fae2f228637859e46be6ec4793", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GodRAT", "colour": "#15DC65", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699090, "uuid": "a62dc44d-7ce5-4c9d-998e-873058a7179a", "value": "T169E5CF03FF4291E2E89E403F51E3577B4E39592487349AE3EB8156BE88215C0A73F799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699090, "uuid": "012b50af-1a5e-4148-8242-7b1aba823fca", "value": "ee5ea868d8233000216e7b29bc8cb4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699090, "uuid": "45908d59-2f79-415f-bed5-cf501c2d595b", "value": "49152:EDrjFtzWK5brAK6qn+0QuKnIqjZuD+CPS1xz7ZGhztFKUKB3KH8e58:EDrfN+03k0+L15uQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699090, "uuid": "de4b3e53-60f5-4061-9c28-7143c2ba067f", "value": 3133608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699090, "uuid": "91f29657-cc36-46c9-a482-1e475a3039de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699090, "uuid": "d2460ba6-f5c6-437b-b6de-53276e36e396", "value": "48d0d162bd408f32f8909d08b8e60a21b49db02380a13d366802d22d4250c4e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f473fd99-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721589, "uuid": "969ade71-f4b7-46e0-926d-a98d5717b4c1", "comment": "Malware payload (Mirai)", "value": "52c4647a5ad51870ac4824b6f562113d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721589, "uuid": "239c0f25-772b-4b15-85f3-94e534800240", "comment": "Malware payload (Mirai)", "value": "48fdac886f19a0381991cf185b730b03d2dedbdca72cdf7696511c2c52d7ff41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721589, "uuid": "76015297-477b-4a5a-abb0-fd01cc7cf08c", "comment": "Malware payload (Mirai)", "value": "ef7e9287c4bcaf12b27dea245f6cb236be115170", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721589, "uuid": "8a3a169a-ae69-4968-b159-cc9546d5cba6", "comment": "Malware payload (Mirai)", "value": "236178f4df00422de2947f7610405f8ec84bd5e40574c0a5694ae8f957496e8651237c9d38dfce5574300065644c5144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721589, "uuid": "19d862f7-c7f1-4a39-869a-6cea19012363", "value": "T19C63C546BF610EF7D89BEC3745E92B0529EC560B21B97B75BA30D818F64B20F19D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721589, "uuid": "ea809a26-e3c6-47eb-926b-f97fca818724", "value": "768:YU6bhcgHSIJWB9cHlfD2wLX3YEwja6PN1oAg5oRKxeU3hVpxedxAxePx28szI2ZS:YU6bh1HFV2wEVjZPzgj1GCK2dFsTcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721589, "uuid": "58ed0ec6-73ab-4001-91ec-8b0ffe637844", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721589, "uuid": "bb74aac5-e451-4f54-934c-6eabf8645103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721589, "uuid": "9e3cdb4d-2c81-415b-80fd-b862fae86ce1", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdade5b-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721335, "uuid": "394dda94-5983-4bd8-b12b-6ac6726e2e89", "comment": "Malware payload (Mirai)", "value": "581f028152a8560774ce6808aab83f99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721335, "uuid": "b0552eb8-fe14-47d2-9e96-288cca7723d0", "comment": "Malware payload (Mirai)", "value": "491ce73cc7683ea2e39992e71183a05673954c02985d741e16e3fe76382b1ff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721335, "uuid": "a3ba1d13-5a2a-45eb-9b90-5928ed1641e1", "comment": "Malware payload (Mirai)", "value": "abb430439bc6d754dca0372a71cb3a13ec1e42e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721335, "uuid": "04ce5b97-af1e-4b36-b249-8bb6b5c9b77a", "comment": "Malware payload (Mirai)", "value": "20cb0a4dd2974224f95784411357602aa8cca1b7a63d8ec80e498a6d7662ba0f2205a1b164da8e5f36f31a69329eb2e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721335, "uuid": "b00598c7-1a1c-42e7-a91c-4142047f3d56", "value": "T15E4302FE8567BB23D5B32D35EA684163291F2BB188DFB1173456A6C90E8070CE75C887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721335, "uuid": "f86fdccf-dab8-4603-9003-9541631cae2f", "value": "1536:i6C5HDKQG7qVwEsqeQGDsXWs/kd9bvQ+hMG4:NCZuMwrbQGoXWsMd99hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721335, "uuid": "b00b2775-ee65-470b-b4f4-a40785f47632", "value": 58224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721335, "uuid": "8ccefa9c-8165-44b4-8bed-c144cb1c1a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721335, "uuid": "7d48686c-22a3-4325-807e-cd12a5d5406c", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c98b1fa-7d97-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755674842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674842, "uuid": "7236d71b-75df-40af-8dbd-fc0b1a89a8b8", "comment": "Malware payload", "value": "ba9ddbb012d42f77bd32df669a87e2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674842, "uuid": "d2368a17-ea76-43e6-b172-0785168317d4", "comment": "Malware payload", "value": "4957945a78d977b14b71852934cd4303528e5ecac6af4043d0a3057caf252da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674842, "uuid": "6f0825bf-89ab-41b4-995f-62567524ca9e", "comment": "Malware payload", "value": "6656df9788fb4dfc34a706b724c76c8da9b86825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674842, "uuid": "b9e8f7e7-d7b0-4dbc-8356-a4088671ec25", "comment": "Malware payload", "value": "2f48fe6407aa76e6e1d04d91ac5fa8a3dfc22e617ced1fa96ea05a8c9caecb71077bf218cbd4ed9fb9ba6ed797c31c30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674842, "uuid": "d46f8f50-07ae-4d27-a770-a13928a28dda", "value": "T1EE847D46F2A484E5D0AB917851BBB70BE675388C071046CF73E849582FE37E07EBA751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674842, "uuid": "618a0d75-b8b7-461d-b0d7-edb97fd9f8f5", "value": "dd26da0f16f12eb2ab1635dc1c672624", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674842, "uuid": "93b3a3b0-0e28-4850-bd2a-32303ee47c73", "value": "6144:HKJv3ufLthkvrVRZx31SfQhkPTgS3dnky08Rzl707PxI/Yuvtg/2fJBReWoZ7C+p:M37NZCPTlky0Szl707PxI/Yuvtg/Fx73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755674842, "uuid": "2b2c30b4-035f-4704-92f9-cdb28ecb9fb7", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755674842, "uuid": "84154a69-7d1b-4bd7-96b7-afd19abfd5ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674842, "uuid": "44857a89-1d97-4caf-9ac4-244fff337b1c", "value": "Elixo Free Fn-External.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58cff9d-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692735, "uuid": "17c79240-a476-4f87-bf1b-279bb6349d9c", "comment": "Malware payload (LummaStealer)", "value": "eb774e7c8fbc7976cbae2afc2a55f9ea", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692735, "uuid": "a46ddd62-af96-43a9-9fd6-834ac8d468a3", "comment": "Malware payload (LummaStealer)", "value": "49a3e94b5f1a0199ac0929428e4779451a3533e93f469cb1d832d44c590fe8ff", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692735, "uuid": "ff46b4b0-f840-4db2-9eb1-0436663f1c2f", "comment": "Malware payload (LummaStealer)", "value": "a78767479c092ef7f4c08678c4db16f44d0ef973", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692735, "uuid": "c684ccff-0746-4bec-8950-e512ef0fb9db", "comment": "Malware payload (LummaStealer)", "value": "c54ec7386d8376e7f28c00cb8d4f7095984cf2fd9c88318c0a380b62611468edf0059eea4b2431ba0c38cb9be9b6c00c", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692735, "uuid": "cf725767-ff6e-4bb1-bb2e-f7370dd164b1", "value": "T17C282281772C23CB0FDF47AE1509E96814F181C62861B22C62FEEC573572B9D2AE53E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692735, "uuid": "b003769e-32e7-4335-8e41-74135ea51dc5", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692735, "uuid": "c4cb5d25-d374-4746-9e7d-ce63019d3bb8", "value": "49152:6Fe1foVeiWTZpZvQScCQPTAy7Lwe1V9tD:6FeGVxWTZ0SyrA5edp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692735, "uuid": "da0595a8-55dd-48e7-a5bc-38a2bfad094c", "value": 94371814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692735, "uuid": "960ebecf-65ba-44db-ab14-a054f2aaf85e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692735, "uuid": "83c54b29-dc72-4551-bf85-af541dd39c6e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d603d2e7-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721538, "uuid": "a72bba33-3be2-42c5-a1e3-67f1454bb2a8", "comment": "Malware payload (Mirai)", "value": "436550e91910f0d49f3164e35bb3aaac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721538, "uuid": "32b9eb6b-e20a-44e6-95a3-2cdf3875498a", "comment": "Malware payload (Mirai)", "value": "4a9fddce413c8ae8176038a346deef0b3635151815ff524c32f9dbbc5b9d1c7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721538, "uuid": "9d745ea8-422b-4e66-b28d-e78d2ff58b41", "comment": "Malware payload (Mirai)", "value": "935d6b4281b596dbd3dc4491408228c8b67fd7d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721538, "uuid": "3b90a096-507c-4979-9ac7-3e22772b49a0", "comment": "Malware payload (Mirai)", "value": "fa1bee7e41b7ff05271f26213dbb21e39a25974a7a5922c9ae3a245c653c70d5d6293af90aface506430c2d7f29972e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721538, "uuid": "7257f92a-2bb2-4dc0-b4e7-162c70a53fe2", "value": "T1AEC2E1DFB49A3985CD0C5CBC219D5AD116A9A2C7234B8F0837202DCDA67755FB89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721538, "uuid": "3275d2b7-27c3-4911-a4e0-a08afdbf1174", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBJ2RtWR:5CrJgHiOJrfwmQrctx2RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721538, "uuid": "0d5d9484-e47e-467d-b0f7-b8f9e8b1f4ef", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721538, "uuid": "c256eb2c-0c89-4606-8ba5-390bf92a5f77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721538, "uuid": "e7bdabfc-5999-428d-a1d4-f61e81b8b9cb", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf72698d-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703489, "uuid": "ce2362f9-b4c4-4df9-8593-e5c4a65537bf", "comment": "Malware payload (Mirai)", "value": "3f172e044813fd3a987429e48ca6fdf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703489, "uuid": "89abf8b0-c4b0-40f8-8143-002b1518317c", "comment": "Malware payload (Mirai)", "value": "4c07e75e2af5f6c6df85426a1de392f170940959732682b45fa762a7d1504d39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703489, "uuid": "6a0f4352-94a0-48fe-9147-41bc32555c84", "comment": "Malware payload (Mirai)", "value": "f42f74b7bedfcb3ef28a0ac5fcea81378cf33a5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703489, "uuid": "eb58732d-592e-4e48-85ec-db6775ca91ad", "comment": "Malware payload (Mirai)", "value": "991eba5e6da0777c7654e82fe547fc3708491e2df37e722c9bf5013e0bc5b1bfd0b62fa804b7047230924f6e01869728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703489, "uuid": "1ac6016f-6c01-43f9-89a8-bb1a45944316", "value": "T181C2D05533A49B398BF0047FE9B4C2D76BBB47AC92FE31836210199CEFD280E3564956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703489, "uuid": "78cce2d7-3b10-4ed3-a422-4ed633e941ff", "value": "768:QDVCABEn/7pvK8RW9BT6UcBK/IUGs3UozA:QTBSE82VqITzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703489, "uuid": "21ff3102-d1ef-42a2-ba14-baf0687dc2b7", "value": 27848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703489, "uuid": "9744698e-807f-4569-a5a4-a36885c9187a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703489, "uuid": "6a3f40ca-eead-422c-96f6-d6a6a6f8a751", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78f47fb-7dc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755696630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696630, "uuid": "37232876-8657-4583-80f7-b964c2863b52", "comment": "Malware payload (XWorm)", "value": "fc0bf0571f17febe7fa85a759e41fa56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696630, "uuid": "de10eb99-0062-4627-b8b7-e0f3f1a49b19", "comment": "Malware payload (XWorm)", "value": "4c0999fd58331d7b3f971f3bfe4351b500d086eac555b81a5e7c7c41cb3eae8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696630, "uuid": "a043fe24-77ea-4718-a3b5-9d6652de48f4", "comment": "Malware payload (XWorm)", "value": "bc307ff0a5c99c1b28190b0143050e65e422cd70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696630, "uuid": "ad1bc063-f8fd-475e-b78a-a7a46edac7e7", "comment": "Malware payload (XWorm)", "value": "c78ae749af7dce6797a49261ddccce689b981f913d0f28cd5c52b93ed69575f75c97fa57d82ec2e29b1783202d93ecec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696630, "uuid": "faaa9d03-8b98-4739-ae8e-ae849f04c81a", "value": "T1D5C501017AED00FAE2B3973589E28992DBF77D6687205FCF02D04D0A2E675D0E879725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696630, "uuid": "f9eac130-daff-469c-9ddb-6d412863ef33", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696630, "uuid": "2b4b5acf-ea4c-43be-a70d-c33d0744378c", "value": "49152:T0o5663XqIl475RXcwviBeHBKFRgF1/F0DX3I:TH6sqmYNdHBeRg7tIX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696630, "uuid": "4b1ada5b-cf62-4db7-a054-05f2c0e2630b", "value": 2672110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696630, "uuid": "238c49f6-43de-4fbe-a127-dec8e645f609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696630, "uuid": "40d666b7-5268-429c-b210-c92551b0273a", "value": "fc0bf0571f17febe7fa85a759e41fa56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21f9bf3-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703493, "uuid": "5bce685d-2dfe-4bac-a998-1e3e6c0c2eae", "comment": "Malware payload (Mirai)", "value": "a4bf7f12e48088a8f24cff991d34c7bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703493, "uuid": "86b4bc24-0a41-492f-88af-672a2f60c4b0", "comment": "Malware payload (Mirai)", "value": "4c44810e1591a4f8db0683b218677a351255b8261a7b14ac41da20e965c4bd22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703493, "uuid": "a1ecef4a-1234-4dbf-af01-f3756eb2f0b6", "comment": "Malware payload (Mirai)", "value": "6e21ad6d53112896febb7106ecda64eeb62e3e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703493, "uuid": "06efcdb6-37cd-40ea-8889-0e61ec8c54ee", "comment": "Malware payload (Mirai)", "value": "661a08a55ec23691b534458a7b683680482aefbf69b16bf5af1a129e89e8df2ffee37f3d12923bbb2f5b54efb2277ca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703493, "uuid": "f2c2da73-4bc8-41ed-87d2-c69dbeb14a43", "value": "T1028383A9F0028A7EF48B9175289D9E1A7D3063D127C2661763B7AAF67CB30572C05CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703493, "uuid": "d82a9183-d841-485a-9486-c66e293dbbd6", "value": "1536:2CdhqpPcWIMpU2unvR8claUQeuacWjcW0JcWcBMN0sRCcdKTRu5Z:2CdhqpPcWIhfaUQeuacWjcW0JcWcBg0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703493, "uuid": "412df57d-1d47-4995-815a-d675950b44e1", "value": 83196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703493, "uuid": "2593c294-19f0-4aff-ae1a-359a49bedb01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703493, "uuid": "b271498b-ce83-411c-828c-c8befbd8291e", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cd5579-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703553, "uuid": "b9eba334-2790-4589-ac97-fcb1abb147b8", "comment": "Malware payload (Mirai)", "value": "430ee12a3a72704fe34a6cc2e1f8bdc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703553, "uuid": "fbf2be9b-b4ec-4d5c-a304-5f4e84249696", "comment": "Malware payload (Mirai)", "value": "4c9fc9e27a18d28b74050edfec369350370eb8c64403882da93ba79a35b37c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703553, "uuid": "328e4c77-de2d-409b-bb3b-0d32727e334f", "comment": "Malware payload (Mirai)", "value": "8bccaba441936852f92387119a083d6a1f61da1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703553, "uuid": "bd5f83e6-9f8f-418c-af0d-bef486d2d85a", "comment": "Malware payload (Mirai)", "value": "e6c94b2a322ef4b7898f46273db3bdf26c27bf5e9f7dfaf02eef7f4774406f4b9644bb75c2f96fa0d41b0d0e8b5c7ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703553, "uuid": "c7f48384-006f-4243-87e5-6c75317638ce", "value": "T13243CB69F8434A37C1D30179B5ADAF4A3F2013D563CAB213AAB047B03DE650B2D56ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703553, "uuid": "f9008fe6-e4be-4c1d-b72a-dcf7e6b96c71", "value": "1536:hla/84Yer2sJ6T2B1p2Bp7AQPV47mWUM1:hl94XN6QpFmY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703553, "uuid": "8ea15091-d12e-4035-b0de-6639c95c115b", "value": 56036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703553, "uuid": "e48ce026-e20f-45a4-917e-fd6bf2bb9854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703553, "uuid": "19b36f66-80a3-45d4-8595-69a419ee0ca2", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab15e99-7df2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755714218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714218, "uuid": "2c85bd65-5279-4f4e-ab86-d7b2c5fecfaf", "comment": "Malware payload (Mirai)", "value": "03f6a765f7bb551e266d9642eef079e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714218, "uuid": "9ca8640c-df3b-4996-bd29-9d53078e067b", "comment": "Malware payload (Mirai)", "value": "4e03fac4a0a16ca334ad6622a466a407febf8788c301cc81fc6a069a3eb071bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714218, "uuid": "f6bc9c56-95d8-4b96-afe9-67c1636fd031", "comment": "Malware payload (Mirai)", "value": "3d2607d13690dc65ad1dcf789eb0961648cad53c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714218, "uuid": "15d36130-cfa8-4885-b5e3-5c37e99aaeac", "comment": "Malware payload (Mirai)", "value": "c2e4141d15fe1c0b279159159aaf9971cf92b5492868c9ab6219b7a29dcafb8bbae6a766ac0015ce6f1feb99626ed048", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714218, "uuid": "9ee04a98-63ca-43fa-8052-b1796affe5f9", "value": "T1C8A3840D7E258F7DFBAD863447B78B259248339A3AE1C684D05CE9011EB024E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714218, "uuid": "19a3d1f0-558f-4b34-a1a1-9a4cc94dffbc", "value": "1536:RNpDUyaH1uaSF9LBenKjRoH1CoHnEfGgTO6W1wd3vdto0dhu/hy5WeN:VU7VuaSnVenK0YoHnapd3vdto0dhupxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755714218, "uuid": "0650d273-e0c7-4765-baa1-ee420ffbe698", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755714218, "uuid": "fa189fb5-9b20-432b-ba47-b92fbcd66ea6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714218, "uuid": "7c0c2bed-63cd-41d2-bfec-c1abc5d3ecc7", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f01ac07-7d69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755655116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655116, "uuid": "a1fcb4b4-3160-4a96-945b-c232051c3b0b", "comment": "Malware payload (Mirai)", "value": "abf4f17f96286ac551b1a02753318b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655116, "uuid": "08e1339b-2ac3-4155-b32d-b82d25e7248d", "comment": "Malware payload (Mirai)", "value": "4efbae1b7f5ce06625ef2b348b7d66b584c6a992f9f9b151a63c5052eb852504", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655116, "uuid": "fee13b33-a8d1-4d11-aa77-eee58d60b811", "comment": "Malware payload (Mirai)", "value": "235f5badc185e17d9d7d36e6b9a8855fd894a5d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655116, "uuid": "7f8dd9f3-82c8-4f38-b36a-b8e22ca0dcb5", "comment": "Malware payload (Mirai)", "value": "7ae957eb895a7b958b53658014169a0c6833daf56247cf6d9de21160051e02c4ac5355f789ab85f13d35b6688a4f93ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655116, "uuid": "83687b26-53b4-4ae2-81f2-937c7d18f0ab", "value": "T16824950E6E228F7DF6A9873547F79E209B5923D713E1D645E1ACC2101E2078E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655116, "uuid": "e8da8155-e02b-4c04-81ff-4ea99dcba5d9", "value": "3072:pvc6VCZDpCZ4wMdyWQes5ypFymeDQ7XEwN5jBxtC6hh1RjKYV:lnVCZDpCZ43zAmzXdjBjfjBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755655116, "uuid": "7da3a187-7081-4aa3-93c6-21c5cc56cc0d", "value": 223868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755655116, "uuid": "861a192a-b78b-4666-a365-31b35ac3fa74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655116, "uuid": "01c29273-40cd-402a-9be3-907d0b93388f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e4c808-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721384, "uuid": "9d5e7d1f-fdc9-4b69-b62f-9f0c9e51edae", "comment": "Malware payload (Mirai)", "value": "63e83fcdae02a092ec6392837fcbcb28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721384, "uuid": "22817497-53f3-4c9f-98ef-850f87060d8f", "comment": "Malware payload (Mirai)", "value": "4f7071ec1561ed5d900e2d9afbc49ccd5ad6537b97c2a51df1508afed0f12fb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721384, "uuid": "98ab3cc1-afa8-40d1-a333-d297d90d9500", "comment": "Malware payload (Mirai)", "value": "f365d0bf9e63a4ee0d912601d64c8d4938759db2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721384, "uuid": "91379cc8-6063-4d14-b9af-3a06e36940ff", "comment": "Malware payload (Mirai)", "value": "aad35e0a0798eea3b9034a958db6767c726c73f5d8c29946e867620cdd843f686e669486a6e1e871f9d8c952d527865f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721384, "uuid": "068d403f-be4c-4634-b8ce-2cda39a15bea", "value": "T1F9E34C46EA808E13C4D527B6BA9F41893332A764D3DB73069D185FB43FC6BAE0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721384, "uuid": "d1cf3c56-a107-43a5-8a15-603b85922e4b", "value": "3072:fkv0ju7fp130YZKl7W1hxG8HD8aZs/z9VoqD4umM/9vv8s2X0:8v0ypVKlqhNHD8aZsb9tD4nM/9vv8tX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721384, "uuid": "6e299f17-0dd9-4189-8c5f-82bebab1f7ae", "value": 157078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721384, "uuid": "7e3cdb4d-9c9d-4ed5-b3b8-9f9c583ae34e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721384, "uuid": "7968442e-ff0e-4bca-b87d-e12cf3a010ab", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0c0e64-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652480, "uuid": "7696dd8c-40e5-43ce-9c73-d2bebc3f3d28", "comment": "Malware payload (Mirai)", "value": "e1505ea18f134adbf2125bab472666cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652480, "uuid": "5622960a-ea13-4766-be36-4f7d69566ff1", "comment": "Malware payload (Mirai)", "value": "4f829e740c4815978a5cd2d2410c6e2bacb0811f8f40ae9c6b4b94f032fe8e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652480, "uuid": "bd11703b-5d6f-447d-aa1f-8d9e1367ea65", "comment": "Malware payload (Mirai)", "value": "f07c4df3e43ee6d828b18b5490b20edc765b1859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652480, "uuid": "419af76f-b03a-4d27-93c1-5364cc0ef728", "comment": "Malware payload (Mirai)", "value": "5440774f67ad03528923cf20a3f736bf5c6dde375fd20240c5662f932429e589c9561a8564b3856abd253e169d2bf113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652480, "uuid": "137eb998-ce37-4e2e-bb3b-a7e2fc6ce993", "value": "T18E042B46EB414A13C4D227B6BA9B424533239B64D3EB730699287FF43F87B9E0E67501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652480, "uuid": "75979870-e8a8-4853-8038-ce9e1fd02a60", "value": "3072:npoGm6qQeztpa1g5rvJ1/IR0JLEoQ8pnPkXQ7SpbWM/93v0OU:poGQhpaW5rvJ140JLNpPkA7SpqM/9cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652480, "uuid": "bce8dcfb-aec6-436e-8f92-c16f25c93d88", "value": 177811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652480, "uuid": "770cc5a7-3ef8-4078-9758-6c438f85c3a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652480, "uuid": "ff62de44-8f21-440c-84fd-f8861376e556", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439e789e-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755648708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648708, "uuid": "c804d9f2-030a-461c-90cb-5dffa4041096", "comment": "Malware payload (Amadey)", "value": "e8fcbc422ea458e9f4565937ec197425", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648708, "uuid": "9b348c5f-4015-4d45-af0f-48dbcf3e1b01", "comment": "Malware payload (Amadey)", "value": "4fcf4800811bb9eeb679a227190e79620829e9942de2d068c5e3a382bb982180", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648708, "uuid": "270ee95d-a393-4048-bd59-537c07e1e1b1", "comment": "Malware payload (Amadey)", "value": "b4a47f6ddf7fb696e2d04952ba789258afed0570", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648708, "uuid": "8c961992-db95-40e4-aa54-581b9f3293d5", "comment": "Malware payload (Amadey)", "value": "36878a1659ffc7d0df034bdddef5c15ccf41c8c2c0f30814956fc0fe338a6dc9256b5e38dc9b33e77630126315046096", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648708, "uuid": "b95c7158-ad08-4bfa-a478-61911412e124", "value": "T1EE145C11B9C28072D56708709CF9DB798E3DFC524B61A9DB73C41FBA4E206C1AB35B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648708, "uuid": "ebdd8bcf-d645-44b3-8af1-743645141db3", "value": "8a5941da1bc505b498d2948b163b71d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648708, "uuid": "8a7e7070-b92c-4fc5-ac56-cc758f6462b4", "value": "3072:17AP7NzfnlXRptIwF1dLlnwism2y7OyzpX2G9H1tiVu3vq7H0XC5ynfD+2X:iNfpqwF1dLS3HG1pJtqaCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648708, "uuid": "4a9082ce-7c33-4b2e-9353-64f4ee096c7f", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648708, "uuid": "110633d7-9cb6-417d-9b5e-1a96b23b3d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648708, "uuid": "0253bf87-c687-4894-82ad-cac41a74f45a", "value": "4fcf4800811bb9eeb679a227190e79620829e9942de2d068c5e3a382bb982180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29972ca-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755721560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721560, "uuid": "1177cbd1-804a-4ec3-b1d0-b43db5466562", "comment": "Malware payload (Gafgyt)", "value": "979f4db80e28969ba5fb5e04b8f5dc18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721560, "uuid": "be9f75e7-d622-4c87-8f75-9e5d662c2233", "comment": "Malware payload (Gafgyt)", "value": "509825824c5f60a8b420199f7b4976d28b3561e01fda31f4228a3f9c38f387a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721560, "uuid": "6aaa4252-8719-49ce-a5de-903f9f229244", "comment": "Malware payload (Gafgyt)", "value": "20427a40bef5f923b18465cd4a4b6589fa82f599", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721560, "uuid": "63fae7f7-c637-49ee-9334-9bed4e1bd57a", "comment": "Malware payload (Gafgyt)", "value": "71fc0941559af3fb0ac1102afe77a77030f2077c7207a7e29add8bd71e8f35e3977f7dfd4715ca8ed20ce99e792fc318", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721560, "uuid": "ea18ecb3-f4bc-4086-a93f-b5c1f1df30a9", "value": "T17E63955D6D228FEDF358C2344BB79A356798339A23E0D684D2BCE6105F6024D641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721560, "uuid": "d10f8e8f-5f8c-489d-9780-5e68884eb34f", "value": "1536:JJADiZSfUYK4jQpKc1iIhARQae2cAYdZiSK3SKJ4SKRaRbBMipQLJoQC1kS:wQSfUYfRQ+cAYdZWpcoJ1kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721560, "uuid": "7fa2319b-b630-4c63-a444-9adad9a94dd2", "value": 68920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721560, "uuid": "f3f0fe86-5c2c-4995-ae1e-6e563cb883cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721560, "uuid": "9fc8bedd-daed-466c-9374-46f607769321", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9815579d-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755652715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652715, "uuid": "3f33f23b-8a9c-4d1b-8df0-ea8f60366f74", "comment": "Malware payload (CoinMiner)", "value": "643e6ad61e82465f140cbd98ea8736ec", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652715, "uuid": "917225ac-f291-4979-9cb0-9db1278b6884", "comment": "Malware payload (CoinMiner)", "value": "518f170eae1267e460488ae406b092a33332901702b71279a2e26247c98fd771", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652715, "uuid": "1794a7d6-3e07-4714-ba30-4480a002d62f", "comment": "Malware payload (CoinMiner)", "value": "935ff873dc72e076b27f3cc5196ecd90f94581ea", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652715, "uuid": "7da54b5e-755a-4dd5-8566-bc67d6410a9b", "comment": "Malware payload (CoinMiner)", "value": "162db6fa78dff7bc09ccf334cae188237c48deb3f1d432b12fa064467cd4f2caad456b87c3e25fc216edf3fc890feb7b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652715, "uuid": "97fb74eb-41ff-44e3-8616-edbfc0f55087", "value": "T1A366237F19955980E4772EF73AE84065F0723E3622AA981602F31D473524CF2F9CA97E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652715, "uuid": "75e5af86-1258-40e8-9c15-5f8ced5900e3", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652715, "uuid": "87bfbb8b-1b59-47e8-9690-27799084ed57", "value": "98304:xgJO9W40r0Qy173DZo5ZzzUegIMQAABj1tKEAFMvYEK0dHqaX66ok8NN:xh96yR3No5t3M9H+xlqafok8NN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652715, "uuid": "d2a67242-5343-4c6a-bbe3-1b6df2f6c67b", "value": 6578192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652715, "uuid": "f719e8e8-53ca-4de9-91b8-5e440caabaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652715, "uuid": "3d35a283-bea9-4f58-b7a8-196dda120dc3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.41267996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3e6c0e-7d81-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755665421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755665421, "uuid": "9c0594b5-3f16-46f5-815a-ee31cc05c6d6", "comment": "Malware payload (XWorm)", "value": "c3e23625a5eabb94b82d79bb3f587bd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755665421, "uuid": "3aa52118-9511-497a-915d-b46c7e4f2d96", "comment": "Malware payload (XWorm)", "value": "5232d5f7a24e5eb3411e0fe65c2fb4a1615917a5a3e9567599df571f88353662", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755665421, "uuid": "4f1becb0-31b8-454e-ada2-836220619479", "comment": "Malware payload (XWorm)", "value": "e20892def9eb726ffc8236703ee1f550e911daed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755665421, "uuid": "07c776ac-fce8-48ef-aaff-d5c27771e6da", "comment": "Malware payload (XWorm)", "value": "32925dfa0e03d6ecfc9fe39a42be5fe37f0ed739c0d7565b2212bd20be0658a3a6e3dd49c73890294822932b5e3fc994", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755665421, "uuid": "f4748a43-09f1-457f-8fae-d3f72e8e76c9", "value": "T103937D2C7BE64129E1FFAFB15DE57297CA3AF3632903955F2485024B0623E84CD416F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755665421, "uuid": "c3b3a60d-d8fb-44d9-8004-f37556661725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755665421, "uuid": "95be1e10-201b-48ac-8d9b-d86c350efe51", "value": "1536:8Ob5LnMBZyVWDTq9rsykuPLoeeEYcRzvG+bTFSAS+Z7Khqs6UykpO+LU5eZT:8MVyZVm9xkuPD04K+bTO+Z7KMwhpO+QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755665421, "uuid": "1d12b85e-322d-4a78-9273-7cc2bfd09ff0", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755665421, "uuid": "228fd6f2-bf52-4a3c-a06e-90621f291001", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755665421, "uuid": "014f3342-e908-4dd9-a845-50e509a62871", "value": "c3e23625a5eabb94b82d79bb3f587bd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00983096-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698847, "uuid": "4e8cb546-13a0-4183-bd3f-71e63a9df0ae", "comment": "Malware payload", "value": "d5a6d822bb7ca03a04c535a2ccd71bc0", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698847, "uuid": "7351f207-516d-4bf5-9586-a2be4f77221a", "comment": "Malware payload", "value": "52657e6223b74eb78d092c09f8cc333b5a7fcbde7335ac11b5f37810dbb28a36", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698847, "uuid": "211a5754-0029-4a41-81a2-af7106e2ed42", "comment": "Malware payload", "value": "4306d259153a35e41d6e3337943538e3f9cff66a", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698847, "uuid": "cef8510b-f4a1-4dc8-8893-bcd350f4b770", "comment": "Malware payload", "value": "57689a92f394da76bbd59049d1ffc519874b2dcbd097f9f6f60ec2c86e9284fe26966f220615e93d12801ccb872eb973", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698847, "uuid": "dddae946-1db8-47f7-973d-d9977cd69940", "value": "T1B2C5F619FFDA9C3DF49CA478659CC130845FAE2019D28462EDCFAE5BF720A8049F195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698847, "uuid": "004579d8-2736-4a54-a353-3e06b8d05679", "value": "5316646cb658259867ef69d100f31589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698847, "uuid": "322affe1-4d1f-4af4-b0fb-b1c701e5cb93", "value": "1536:sEGD7BGHDHHE3fRwClexUeoaaaPPUZlz9KPQVsc71tsWacdv6aNMeBzTCpTHyizs:w3wIvRwCMaaPPeN9T7tv6aNMgGTH9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698847, "uuid": "5e1ca971-c6c6-44ce-9c97-7d2f45231451", "value": 2717776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698847, "uuid": "73b1a786-ee2a-4af5-bc77-2e4b94519df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698847, "uuid": "a4ffb9b4-7ed1-4c79-b3e3-ba57e43916e8", "value": "52657e6223b74eb78d092c09f8cc333b5a7fcbde7335ac11b5f37810dbb28a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2cd1bfb-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703494, "uuid": "6dfcc708-7a93-4da3-9c50-83bcc45e79b9", "comment": "Malware payload (Mirai)", "value": "5b87c8781793b8f150ed97019bb4b92e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703494, "uuid": "67819791-6a0a-4785-bc40-7e3237ac9fbc", "comment": "Malware payload (Mirai)", "value": "52ccdf11f27f8affb8bac47456d35c6e1b6ee9fca37586d24dbf3a378d0905cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703494, "uuid": "3dd8f2e4-897c-4a8b-98c9-5427124a7a02", "comment": "Malware payload (Mirai)", "value": "4fe72aa0a7635bb621f4947065b486fe8d9c2202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703494, "uuid": "8d3445e5-f183-40a2-b77d-13c7af59eefb", "comment": "Malware payload (Mirai)", "value": "57d693811b839bd5fb1e8efa6a79d16472de3178b37779cb3fc83ec3d51a0dd39daba1a35f3b10e3855a3bef1b9579fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703494, "uuid": "3a401943-519b-49c5-841c-b062c8f7359e", "value": "T13CC2E01CD215DEA3EFDC6E218981C3D713B11B8D335AC985148BAFB0AD21DE25268DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703494, "uuid": "b1cf78d3-fcc2-4865-b587-67bfc06a884e", "value": "768:cWQVel4zA82NF1l4jGCYlb29L2Lu4uVcqgw09m:cWQV+4EBTA04Buu4u+qgw09m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703494, "uuid": "7dd52648-6a76-4805-b5f1-2285cd08fef3", "value": 27748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703494, "uuid": "f6bee3a1-52a5-43f8-af62-0c3f8ac8966d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703494, "uuid": "215ccbaa-c82b-4d26-aeca-c3ccc62b617d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bd519c-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755677759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677759, "uuid": "16640a0b-53f6-48d3-98be-453abe4109a8", "comment": "Malware payload (XWorm)", "value": "2d06b0e5248eec44281a0d14ad49e22d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677759, "uuid": "2e9ccd2b-1d0f-4160-af2e-f01f55f6129f", "comment": "Malware payload (XWorm)", "value": "53536ab0e4cc3524089734d5e98590a2eae03d02bcf013eca6e28e6d07eb3e6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677759, "uuid": "7c36b157-683e-41fb-90e7-4ca4dabc5527", "comment": "Malware payload (XWorm)", "value": "0022fdaad07c1ca057952e767e82784a87b318f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677759, "uuid": "d9468036-4b69-4210-85d4-4ee3e2ad5f3b", "comment": "Malware payload (XWorm)", "value": "dac9bc560f424b574181ff1087abac62d23eec750fd836ec900f5330cd0343bba65cde57cc0c03dfc85dd584e8b1204f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677759, "uuid": "8709dc44-376c-4487-892a-7e847b478cca", "value": "T124E22B4877E44712D6FEAFF12DF262061270D51BD823EF9E0CE485AA2B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677759, "uuid": "ab655ede-e2cd-4419-a778-0302a6eafdb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677759, "uuid": "4523e202-1ceb-4bc0-8235-f69038a2d747", "value": "384:UlRmhGD91SluSWhnHHxzLmYV3Tm2eaFOYKdRApkFTBLTsOZwpGd2v99IkuisgXVG:gRPD9OQhx/BV3Tw4xKdVFE9j9Ojhgb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677759, "uuid": "5786032c-4101-4f26-aeb5-abcd6bc32516", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677759, "uuid": "7b012f84-ac7c-4af8-9d5c-c5a306ae4fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677759, "uuid": "75a32aa9-4245-465f-b394-ad7daf725b6e", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d4c456-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701810, "uuid": "1ffbe42d-6d2e-4adf-b9cf-0938d6a889e2", "comment": "Malware payload (Mirai)", "value": "9724207ec8ac9e2bba51a376881439d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701810, "uuid": "4fe9cf05-5c35-4587-a02f-7f7a182352b4", "comment": "Malware payload (Mirai)", "value": "54dd1e566f1724107bed730f1d47b640420c9f7d4cde19cb74fa6ddfa8d2bd3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701810, "uuid": "068cbc56-8703-4e33-bf51-b3dd2a961c6f", "comment": "Malware payload (Mirai)", "value": "acfc3aa1a1f4bf162605c093b623d46b2ab8e7c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701810, "uuid": "8cc2612e-5af2-424d-a6fc-5e3292191d6d", "comment": "Malware payload (Mirai)", "value": "a60e19dc20cdc6c8c08e6b1fff59d5fa82f5f8a6269556bc64b3a3e88342bd395b35ff11289b3b1b37d7abedd81df978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701810, "uuid": "6ec3c939-d571-45e1-93eb-0a19453f40ca", "value": "T180A2E059BF1C86CBCC32293545D9EAD22253FC61F2EDDC0D2540C16BB5A33A95470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701810, "uuid": "33de09d7-dd07-4e68-ba39-0ea1cbb1bdb5", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTp:k98o08kxofBE+ZkXaITbp2F2TWul0c51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701810, "uuid": "278d6622-1e83-4627-9c96-3ebf190e3e4a", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701810, "uuid": "464f60c3-5f10-4f62-99fd-a4754f25836f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701810, "uuid": "a231a4f2-8b68-4947-a9fc-e2db32d6f571", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be05505d-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706466, "uuid": "1539730e-9a0f-4082-890c-ecbe2972ebbc", "comment": "Malware payload", "value": "2dc9f38519e6f4da86c55e230bb80ba9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706466, "uuid": "0c67d4a4-a6c7-4803-830f-f9a28ec31702", "comment": "Malware payload", "value": "559c8be0f655d2ad99feff1ae5d9e25df5d73dbb68df8ec6a2f94fdbb7a21b11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706466, "uuid": "5a3bc37b-1e13-4351-a76b-5556e9a62676", "comment": "Malware payload", "value": "927e9c35a61a9c4c438d045f9dcc2005a9a93a96", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706466, "uuid": "c6826e52-be5e-47da-93df-1390fc8094e6", "comment": "Malware payload", "value": "fdb81d96e16bbf098692688e3790575c037fd510c9ff7d07130e3be16fca12c43663bcbbeb98e76e9ae54932a68c7c25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706466, "uuid": "260c410b-d282-4cac-b038-01e5bf864f49", "value": "T150136C4A774551A0F8A0C5B682AB76C0E27EF14B07A607EF53A0F1D52F177E09D3A392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706466, "uuid": "23cc0958-15d3-4cae-a9d0-68982909ed02", "value": "36e39c67b3ab391df98baf06980d49a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706466, "uuid": "4d06aab0-7633-497c-bb12-b44516e532a5", "value": "768:eCDmM5X8UsLAj+CMnF54da3Bt7hwsOm9OAhry8:eCmM5X8UIkXMvjlpOm9OAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706466, "uuid": "0dccba24-8eb2-4bcc-a66a-d09fab885803", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706466, "uuid": "11376f2a-f31f-41c7-9ca1-6439d5e75418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706466, "uuid": "cc2cb227-6702-440a-a1a3-2c98d1582c9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf984f13-7d9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755677263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677263, "uuid": "1350e9b2-1451-49bf-b5d1-f5eadd2f8319", "comment": "Malware payload (Rhadamanthys)", "value": "334f1c48a0ff9987fe3133258da91a82", "object_relation": "md5", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "temopix-com", "colour": "#FE429B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677263, "uuid": "6718b06a-2581-4024-ad6d-dd9f19124ed9", "comment": "Malware payload (Rhadamanthys)", "value": "560afd97f03f2ed11bf0087d551ae45f2046d6d52f0fa3d7c1df882981e8b346", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "temopix-com", "colour": "#FE429B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677263, "uuid": "ff92ea26-cede-490c-b948-dd66d0368bf2", "comment": "Malware payload (Rhadamanthys)", "value": "6eaf58497a9a73a4c3eb5dea54cf61fa17ada5a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "temopix-com", "colour": "#FE429B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677263, "uuid": "10779041-0890-4652-8b95-9bb104e993c9", "comment": "Malware payload (Rhadamanthys)", "value": "0d131c4e4bbf9da31172d07c2337ec47b8e4010e0a30bcd2c3a099a70c4fa234d3ccba6a6415297bcd2f0ca5718bfa29", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "temopix-com", "colour": "#FE429B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677263, "uuid": "f88d9590-2e70-4365-9194-a941a6d2a32c", "value": "T181D6330018D57E39F294FB74695BF6A68AF74C581FA886BB2B4D30C19036D70B3352B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677263, "uuid": "4c92dcf0-9042-4b11-b01d-17d3fbcd9544", "value": "393216:i2291Xa607bBNO79OiN9P9dpxsRQKZdmM:G87NNOZHPzpxsRQqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677263, "uuid": "8a47e3d2-30b4-4600-b4e6-df14beaa9eeb", "value": 13209600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677263, "uuid": "21ecb495-edac-4f5c-b843-6223fcc51d2c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677263, "uuid": "13c1931a-2fb7-43e2-822c-c8190b8fad94", "value": "temopix.com.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a4dd00-7dee-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712512, "uuid": "9c37ef07-2c5d-467e-a028-da470162bec9", "comment": "Malware payload", "value": "974c08df2a4b400fbb0e72412f793667", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jbsak-duckdns-org", "colour": "#5ECE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712512, "uuid": "f170d906-d395-4c2e-a5f4-ec4e60d1578e", "comment": "Malware payload", "value": "56486fd3ca25f5058e7ec9ae0612552034bcef0b38279097e4162c0175e8b58c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jbsak-duckdns-org", "colour": "#5ECE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712512, "uuid": "d8e2bdc4-e612-4f3a-a2e5-3b3c2cf86a94", "comment": "Malware payload", "value": "41ece36965ce08ae88e24bbda823097dc3bb3e7e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jbsak-duckdns-org", "colour": "#5ECE34", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712512, "uuid": "a9233325-21e4-46a4-aff3-253535346e64", "comment": "Malware payload", "value": "259bd479f2737653f0ffac31e4cd88238d9f64c5cd1783779b2fa629fc36952d1f3ccdf921bcee7309b50c30bfe4aa1c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "jbsak-duckdns-org", "colour": "#5ECE34", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712512, "uuid": "125ba1c2-adc6-4a2e-99f6-138645f16cf9", "value": "T1F8B176562E8681180574C376AB2C0294EE2E43EF872626D9353DD5DC2B1D1D7C1EF58E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712512, "uuid": "fbc4d00d-c973-4537-97f8-b3215ae4c8dd", "value": "48:tX60UjZjZCjbheI4MSu5dO6d4DeuNDqzZrPZ/m1KqwjA1KfG41POj8mr5M1KRYAp:UFMSuSeCm+QCsG808mr0cn42JpbUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712512, "uuid": "fbc3ca43-7376-4c6b-863d-b695a4095977", "value": 5194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712512, "uuid": "104be53d-47bf-4b44-ae6a-042e17bab486", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712512, "uuid": "e487d0fd-a0f3-440c-8372-d9d87fc37404", "value": "56486fd3ca25f5058e7ec9ae0612552034bcef0b38279097e4162c0175e8b58c.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189672a6-7e01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755720362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720362, "uuid": "0006baf1-d8d4-48cb-ad96-51d4710e3d78", "comment": "Malware payload (Mirai)", "value": "a83880f2a7dbf25839018e8f68823b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720362, "uuid": "9971267d-f269-4c59-b927-a74f4f1705df", "comment": "Malware payload (Mirai)", "value": "56a71da23eb25e18c43c8dafeab053beee372077f849e140db908e8c611f4875", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720362, "uuid": "f815044c-e3fa-4513-a1f2-843d811e9b84", "comment": "Malware payload (Mirai)", "value": "6d9acad54b3b888fae309a09c7cccabfff12e6f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720362, "uuid": "1343d70c-4691-4680-a1f2-c84157631414", "comment": "Malware payload (Mirai)", "value": "2794a56f0f5e5c07ce773209007fa8597005ce08c03a242282a4332f9dcc288a6af50a0ab24e6952e1f066b6fc04cf09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720362, "uuid": "8dddd532-87b7-451b-8f12-0064ee9b6bd3", "value": "T141831846BC92CA12C6D423BBFA2E518D332563E8E1DE7207DD105F2437CA92E0E77695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720362, "uuid": "2243077b-b3b0-45cd-a450-fea007e52a3a", "value": "1536:fpeqbUicjpR+d5xPZ1PE+50V8HkvhIYDykqXptXQBXcyM:fp5bUicns5HafmdXptghc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755720362, "uuid": "f569e635-353c-488d-ab2f-01175160a73c", "value": 83000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755720362, "uuid": "a914739b-8d26-486e-8635-e88a3d8b3c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720362, "uuid": "e05185d9-9773-453d-95b3-0635522fdf50", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81092bbb-7ded-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755711947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711947, "uuid": "0c290bb0-6434-42c5-b87e-4b7aea099649", "comment": "Malware payload", "value": "578f5c671a3fba025b38fca51db15a40", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711947, "uuid": "31a58086-02f8-4a5e-b04a-524bfd2df325", "comment": "Malware payload", "value": "57efd2e2060ece4c148a64fb5ad8584601435fd5bda61800b6369c537757e38c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711947, "uuid": "9a30ce72-ce67-4177-96bc-4e17f9e183bb", "comment": "Malware payload", "value": "b5badc333a225133bad6eb4fbf1113bb990518e9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711947, "uuid": "075cdffa-dfd6-49c7-ab9b-8384cae0373f", "comment": "Malware payload", "value": "79f38e2ed5a49ad286eaba5293225dadcaa256804ef5479e25262f4e49fbc5bc7aeca8028a1de4f52eacc8b2aaef3837", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711947, "uuid": "737a436d-89b4-4a39-a7f2-e5c61ac2c389", "value": "T17931ED013AF84335F3F69AB118FAB772CA76F856EA528F2F004182491E219005929F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711947, "uuid": "499afd70-2c57-4ed6-994a-a79c66e1666d", "value": "48:80mqdaPOUXkkdyDfkQOgTkQgkQklBcMpcW:80yU5fkQOgTkQgkQkbcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711947, "uuid": "fb1eba17-283b-4c95-9873-098961d3fdd9", "value": 1659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711947, "uuid": "8f64cd05-857d-4c9f-b30e-388a892aab7d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711947, "uuid": "78e8d71e-e76a-47d6-874e-3e4a6fbef261", "value": "83840287B730283_pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c7b79-7d67-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755654219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654219, "uuid": "7b0427a7-87f2-4357-9582-37606c4b13d1", "comment": "Malware payload (Mirai)", "value": "6b7d18f4039d0e55d04f3d88b902ab9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654219, "uuid": "e347c7fe-2222-49e0-985a-034093714cc6", "comment": "Malware payload (Mirai)", "value": "583ef664e2d68685e650745c61fd30d297eeac841870d8911ff2df5f44412c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654219, "uuid": "854b2b7a-c057-4881-bfac-2934561c2ecc", "comment": "Malware payload (Mirai)", "value": "245dc4a569cfb2bcea8778ee9d3c093ef67f13f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654219, "uuid": "273ab4d5-b7ec-44d0-a0f6-3a8d4c701149", "comment": "Malware payload (Mirai)", "value": "91ab525f7446a59174addc33386b0c8bbd69a862528175707765a98e8df778b707f7cee4d48b89c953d06ea43015deda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654219, "uuid": "cea1a820-a3a9-4aed-aee7-1f54a4a6f1ff", "value": "T1EC24E70ABB510EB7DC6BCD3702EE2B0128CC545722957B367674C528F54A68F1AE3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654219, "uuid": "1efac45f-c382-4681-9e6a-8433ce5162ca", "value": "3072:QwMMIzXAlcsleQqQT2Mfk0bQr6nIW9lsMsWIZ6hh1RiE6+lF:QwMMIzwlcsl0sk0bQrtAbZI+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755654219, "uuid": "a42e7190-1d23-478a-9593-f2c6e703e5ce", "value": 226624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755654219, "uuid": "b346f247-1fbb-4fd2-aaf6-fd7131a0edbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654219, "uuid": "a6634186-fe4b-4efb-b2bf-f6e93e1be8b4", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8035d9-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755701982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701982, "uuid": "4c1d3716-1eae-4a3a-99ff-2405ce866264", "comment": "Malware payload", "value": "1489f80fce3b61c58ef7bda72741e9d7", "object_relation": "md5", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701982, "uuid": "1b292096-6a1a-4ed2-b6e9-aacd6886aab2", "comment": "Malware payload", "value": "58fe2a7d4435c9c24c98d33aff1110add4bf95add31558f51289a028ddafcc6e", "object_relation": "sha256", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701982, "uuid": "44516548-9404-4628-83eb-a44a3c47a8e7", "comment": "Malware payload", "value": "fe0e5bc96d81c088f1a1388cd2d89133522254f8", "object_relation": "sha1", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701982, "uuid": "045aa381-a8f5-4de9-b2c5-8ef1e21b0a1d", "comment": "Malware payload", "value": "db48e049a13df1594a0c659bf52fe6c8002abeb0ad418baeec8d35a8058435cd17169ecbc56c1d833b9f795b6fb370da", "object_relation": "sha3-384", "Tag": [ { "name": "5-8-9-77", "colour": "#566C93", "exportable": true, "hide_tag": false }, { "name": "83-242-96-159", "colour": "#3E9B1E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701982, "uuid": "30dead76-8cd0-40e4-9178-7acf005ee831", "value": "T12DB73BBC01E84D8DC51EFA140DA5F30E61A956EA2F7541B07B6A787D6863FC482EC8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701982, "uuid": "c2b10eef-2b43-43c8-931a-3bf8be4d4ec7", "value": "49152:SOWJ6dlNwQBu0fqKHmwjuFxJAIUn21QIAehzh1GsuHH79s18m:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701982, "uuid": "7f2ad58f-8f63-46f5-953d-3bde114ff16d", "value": 50322681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701982, "uuid": "70cea556-043d-4844-acf2-db2f5038f890", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701982, "uuid": "ca3b22fe-f364-484a-90b3-5f10194e95a9", "value": "58fe2a7d4435c9c24c98d33aff1110add4bf95add31558f51289a028ddafcc6e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68002055-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755699449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699449, "uuid": "4f000b2c-493d-482a-a7e0-6749336e443c", "comment": "Malware payload (AsyncRAT)", "value": "98e56e0a9b35fd7990bdd8fbfd1268ef", "object_relation": "md5", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699449, "uuid": "fbb63fa4-156f-4785-a6f2-d9feae243a51", "comment": "Malware payload (AsyncRAT)", "value": "59afee68c53a871b7491abefe4e660b54b8aee1b3e4781b2aaf46c8b6af82708", "object_relation": "sha256", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699449, "uuid": "fb906f7f-f573-411f-91e9-202d0fcdb93e", "comment": "Malware payload (AsyncRAT)", "value": "1bafba4aac95b67e86519e393dc7df3fc648f5ac", "object_relation": "sha1", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699449, "uuid": "0f50dcc6-8f1f-4e3a-9257-10d94971a152", "comment": "Malware payload (AsyncRAT)", "value": "2eba45ea7e08054445597b169a07941e7c680a69f7c671d40e47b6f760e2583a8adce3e5c18aff7b9b8af374adda5fa3", "object_relation": "sha3-384", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699449, "uuid": "2762d824-ef28-4c33-b937-df6928468edf", "value": "T145E4E041BAC0C4B5E55F1A350224EE774A3DB4716EAFF8CB37844A2D8A372C1A764F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699449, "uuid": "46b44a40-490a-4cb4-87bd-3665cd376e60", "value": "26acef7e3c44d9d008d43029412ddb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699449, "uuid": "1b31dd65-0533-4c07-bc34-1e162b5f1252", "value": "12288:NfytRW1pIgYrTUdBUpuC6DcZKCvJ5UXaZmAbs8wDxp+9IUg6kMdXXEGAN10dVeM:NKjW1pIVrIdBO/6DcZKCvJ5UXOmAg1D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699449, "uuid": "71449b6f-a131-4c06-8a55-3a581fe1d2eb", "value": 719328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699449, "uuid": "f8276784-fb3e-429c-ae2b-d1542fa82ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699449, "uuid": "623e7711-ef6f-4ffe-87e5-82c1df631e4e", "value": "59afee68c53a871b7491abefe4e660b54b8aee1b3e4781b2aaf46c8b6af82708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fec475-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755692581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692581, "uuid": "4ebefa0e-4299-4ba3-a5c8-54f77f863235", "comment": "Malware payload", "value": "5bc5586afad90a7445e2ea63555eb2ae", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692581, "uuid": "3fc2beba-7e25-4046-91c1-e3821aec29ce", "comment": "Malware payload", "value": "59c59f59bb4115f9058b93ae9aa043e9dcceede155393b1372abfab8e262d92c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692581, "uuid": "f20350fc-c82e-4eb5-8474-56f4bf62318a", "comment": "Malware payload", "value": "bccb2e1134e4fe63045f14644df2ba3dc74270e5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692581, "uuid": "00fd1d03-5b8c-4d36-9b60-b11dcb08d446", "comment": "Malware payload", "value": "dacf362295d7cb4210b59090537d00238f0a856156a8e4a63780429e9bceffc82ba3816f6c17d7586d94dac09568ad9b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692581, "uuid": "696f99e0-09bc-46d2-88e9-b9fd9d27fc92", "value": "T11A028413BD870E6B90364638BE5BB316F98021271106CD15F51C9A978FB93DBE8A13E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692581, "uuid": "1ff9c204-cae7-43f4-9293-e80ece3ef5de", "value": "96:HAHELWkyyxTIb86pqK0kPrjMR7el2/J/XKFQtcXdtA103h3/EG/KC1:gk6kyPiyY/J/XKFdse3h3/EG/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692581, "uuid": "cfda9fac-2c0a-4e90-be75-61c56e49414e", "value": 8247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692581, "uuid": "ae727ed0-bd79-4d34-a022-56db1f92c732", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692581, "uuid": "9a45db68-516a-4a30-ad0f-9078604c28cc", "value": "_rootUAC.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd64b95-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755696054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696054, "uuid": "0a1e9c78-ba9a-4363-af20-6fa7c93cd389", "comment": "Malware payload (Mirai)", "value": "7eecaa17e24c3063c69648b76c83f466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696054, "uuid": "5fcb91e9-53ad-433c-819f-9cfae5d07be1", "comment": "Malware payload (Mirai)", "value": "59ef0b8da2099b4226704903122cf6382d4e43e1e4c24e83aa084ae5e3240a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696054, "uuid": "4a024292-ed71-4b50-a812-6b06dc295124", "comment": "Malware payload (Mirai)", "value": "8f18e7ce23c1f62d9a0b06225c3b4c5607f05537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696054, "uuid": "fc16c764-9278-47fb-86b7-3161ab42820e", "comment": "Malware payload (Mirai)", "value": "2467701589cf06b5ad594b8be35fc74eb2f85f78c45e95ec86018a8fbe83611c7c6fea315655c83eed03536045ad00dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696054, "uuid": "967526d8-e6dc-4247-b0b0-8ae4207908d9", "value": "T11453F238D7256ED8FEBE9E71B5BFC6C2D7811BC879A8CCB02A964F281542912100E5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696054, "uuid": "fc53f05a-0780-4313-abb8-ef46b161c15b", "value": "1536:duIE9pQ2b10qG26ohPgsCTElQU9karBObGPaZyitxrZeMgLc4u+qgw09A:8IE9pVT64fC4uArBvOtxte9c4u+qgwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696054, "uuid": "c73ecd3d-f4d0-474e-86ab-a87bce7a01f9", "value": 60700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696054, "uuid": "8a5d3fef-9356-48e8-9f1c-edccc7ee6cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696054, "uuid": "503a6900-f341-4052-b2f1-8347a6029d0c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37843de7-7dd1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755699798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "299a3e44-e9c0-4ae8-893a-f6f06ad1be94", "comment": "Malware payload (Mirai)", "value": "2423a3e3b969c2d7c4240185d6e98ca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "f8d7fda6-8be8-4542-8434-1c29b177c747", "comment": "Malware payload (Mirai)", "value": "5a110561e3893d6e60a60fb3437eb34a1436cdf1cb5b98cd6bfccecc9180476a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "1568d9e4-1f3a-498f-8348-c5eb1e316fb8", "comment": "Malware payload (Mirai)", "value": "08c304f3782d4d75cc163493085cb3abde476de2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "e826eb53-9dc4-4862-8d7d-766d0a25746b", "comment": "Malware payload (Mirai)", "value": "078f5d7ba407b678693f5cefa38613d20c575a9d3f0267642867490a38491c62d9cc144cafe54148f0ce7a9fe53ad5fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "58effbeb-9720-42ed-929a-711553381d40", "value": "T1916302AFE1EC278FCAA50C39B16D9535E51839D27238621F13628D1D3601EFE652D0A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "bcc809b9-7efb-4fdc-9d38-09772570603c", "value": "1536:qHrgc7W5xfHvij9kQ5DeU2rDw/p/oonHDlfT:Yr/7KRHYiQ5srDopRlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699798, "uuid": "2c6530cf-0e9c-4c3c-bc7e-f7f7a89b191b", "value": 68180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699798, "uuid": "76474b04-c642-4f5a-a358-f52538f0f4b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "95676916-dda8-49b2-a403-a641fec93f0f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e11686-7dfc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755718184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718184, "uuid": "ed76554d-e394-4bf9-953d-046774fcf8b8", "comment": "Malware payload (Mirai)", "value": "6c186a84ac20a3e99346d1f179052457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718184, "uuid": "4522546a-d6e2-4f0c-913e-717f61507489", "comment": "Malware payload (Mirai)", "value": "5abc44271f4b555e3f53edc89f2ba8d154e366b5fbe7cbb2dcb951c9e1ec0218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718184, "uuid": "ac7cb318-997d-4369-b191-7576cc22edbd", "comment": "Malware payload (Mirai)", "value": "9f1b1bd3cc8ebb9cdcfd1274ad3363e3ed794799", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718184, "uuid": "3632370a-a822-40a0-ba49-b2060d329dfa", "comment": "Malware payload (Mirai)", "value": "185fc04876612ead78f946464c4af3aed12e7cfe5180a4361091b731111627c7b3163f4036b8997744bcab7c6b38ce8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718184, "uuid": "60b0372e-5cb2-4b85-99b3-02df8f5d0518", "value": "T17F930846BC918E11C5D423BAFA2E118D331263B8E2DFB223DD105F6477CA92F0A77556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718184, "uuid": "283400ca-5ddc-462b-98f3-eea3395c7d81", "value": "1536:Jnwn2DS5tlc7QIsgA95Ckj5G5wEaG6klPETJUMay81juckIai2ZBLv47JuM:JZDnsI1C5F4naKu+MrtZBLv47J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718184, "uuid": "3ab6d16c-822b-4295-a061-4566b68d0d95", "value": 91500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718184, "uuid": "ee9a21aa-b0be-4c52-9692-f6dc0a8bdf2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718184, "uuid": "fc92dffe-f9d2-4170-bdd7-57c07badd52c", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7686b380-7de4-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755708064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708064, "uuid": "49944151-e659-4732-8e75-fc379c3d5537", "comment": "Malware payload (XWorm)", "value": "1a53348d6b559822d617a10b99d28cc4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708064, "uuid": "9b7efb29-92f5-46fa-a4ee-d8e6aab2fb97", "comment": "Malware payload (XWorm)", "value": "5c49dc57f84598db2248b83ee72cd4fc0ec09da742592dc7f9b331363d80ca4a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708064, "uuid": "d9632edb-54a3-45b1-8158-a9922374f2de", "comment": "Malware payload (XWorm)", "value": "ef2499b4e774ad5cc1be1b82d6151482b0bcfcda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755708064, "uuid": "6e544745-1906-464d-b9b8-40488f4f112f", "comment": "Malware payload (XWorm)", "value": "fe0a35eb3278d28bd727d94c8a7e8e983a6224f86c862eb72b69cfc08c4a01e26576f993e76de922a6b1f21e05f9a992", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708064, "uuid": "462f865a-cc47-494b-bf87-9f9172258fb6", "value": "T14805E04566FC10F6E5539439C9AF0417DB217CABA350DBEF83E066952E27BE0463CB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708064, "uuid": "d228351c-6386-4eca-823b-ac5ffa8c04fe", "value": "ea0073bfdd16fb2108cda58642a633f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708064, "uuid": "8f7a1a5a-b130-415a-98f8-6a9c9416ffe5", "value": "12288:lfGZYv4vQ4DLUkReNOzEqLMxFJQ40YmIycdPBBDu/0AOMreKI+YM27G2yZgT:lfGOv6rDAkRXgJ0hI91u/0ZMreK2B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755708064, "uuid": "c0a8d401-956a-4af4-807f-d467af2437f6", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755708064, "uuid": "30ff167a-20cb-4c75-8793-46dad88f1bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755708064, "uuid": "42daedcf-aa33-42ea-93d8-1c2326876068", "value": "1A53348D6B559822D617A10B99D28CC4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8472266f-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1755693484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693484, "uuid": "1dd9184f-bd90-4215-acd9-9418d3c914e3", "comment": "Malware payload (MassLogger)", "value": "ec2f01d7b4aff8d6c9b626be604316db", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693484, "uuid": "047ec60a-6db0-4f0a-8eb0-93b98451deef", "comment": "Malware payload (MassLogger)", "value": "5c82926dcfe153897efdded797f6b674e7b0430b2ec553667efd8158f3f34dd7", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693484, "uuid": "42da6314-4aca-4086-b433-c33f77dcf720", "comment": "Malware payload (MassLogger)", "value": "142093b1d772f593368bf2f3205f0b1160f7fd39", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693484, "uuid": "375ce3a4-5740-403b-825b-2f8a196c130b", "comment": "Malware payload (MassLogger)", "value": "7584ed4e399b209365d88d45b0fc0284e7bdf1fbc1a1c952c9715e320a6c17d660693c02182fc37ff166c27fbf2cbefc", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693484, "uuid": "420dcc82-1b8d-48b5-a43b-c46baab5a82b", "value": "T1B1256C9D8471ADD3A054FE70E540EB978CDB478412274B120FE5A8AA7212C47FFAB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693484, "uuid": "0adb2f2d-ea02-4a6c-9d63-b0f901b173bb", "value": "24576:ciVWmqx4kmjyJatanFRPx+4INQAw6OFXsbedsR:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693484, "uuid": "c8eae064-1910-4776-8aa9-d0491d0b8654", "value": 1009724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693484, "uuid": "81afd7c0-44e9-4f86-a7e5-900597c97991", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693484, "uuid": "210c7c8e-efd6-4a20-a0ea-3419d8c1049c", "value": "Ekstre_001908.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc211830-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload (SimpleHelp)", "timestamp": 1755723267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723267, "uuid": "72d8cd5b-95d3-4f66-a23c-da188dc2a046", "comment": "Malware payload (SimpleHelp)", "value": "4cdca87501e4c55cdf6e382107abf212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723267, "uuid": "8e618cb2-d9b0-45e7-8774-68d75a476b0a", "comment": "Malware payload (SimpleHelp)", "value": "5ffed2524c9e0451ba32c2f4aa00df28e2c0af6d976708da407eae708452d312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723267, "uuid": "9dd2b34b-9b70-4e91-bcb5-67077d4d003a", "comment": "Malware payload (SimpleHelp)", "value": "5453d8f2306df20a8c01865cffa5175162957b33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723267, "uuid": "8e6c02f9-f8d9-4607-9152-91e76cb03a0f", "comment": "Malware payload (SimpleHelp)", "value": "860e4ae5e7f438f5a1525b7263e4d0fed1b67c5b6a8a171b5d43f06219431d91fc00876272707829a5faea95bee1ba49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SimpleHelp", "colour": "#C5DEB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723267, "uuid": "8d4d178e-d82f-476e-a710-b928ebaca0fa", "value": "T120773324FAA16DBEDF33D5FCC0464147AA5AA4A70389211327F145E68F207D0862FFAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723267, "uuid": "892d0698-5fe2-4e7f-8598-fec0eeb1dfad", "value": "da7539752d4292fc084c7d813366cc8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723267, "uuid": "5e9472d0-d574-4d96-a0bf-da2cb83cd8c9", "value": "786432:OYO/jkCgBhtUKPUOFMJGe5cfD7aR65lIBE7ZVWhro/fraaXcS:K/jkCgpPUK8PyL7M8aE1VWhroHFcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723267, "uuid": "0e608c77-9e82-45ff-9061-4b45ba08011e", "value": 35601064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723267, "uuid": "dfe6ae1e-0103-4915-b938-0180282829d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723267, "uuid": "b97d166c-eb17-4c66-a694-ca181bee7f1c", "value": "invite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7846e31b-7d88-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755668553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668553, "uuid": "57fd8aa7-3e22-4d96-b145-6780c8e847f7", "comment": "Malware payload (Rhadamanthys)", "value": "3837ad530eeb7ab2e3a59388f7111ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668553, "uuid": "7868c883-9345-4f15-9de3-37a7b24afbd2", "comment": "Malware payload (Rhadamanthys)", "value": "603a1d175d58ae5c8bbec536aeea85ebdf19e10c2701384cd1f51c11aee2b660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668553, "uuid": "b8cdae1b-0184-4aad-9000-05346774ab3b", "comment": "Malware payload (Rhadamanthys)", "value": "2bc14742b0cb9dfe35f7f9c4a541ca34a5da9116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668553, "uuid": "b077a3af-5815-4a13-a0f9-d149356a01ab", "comment": "Malware payload (Rhadamanthys)", "value": "ba76141328ce5768fd2c725a03f907ee6e2a8f7572a6371115150ce1d06ad032d5faf1647278ef154b75153f6b8ae99d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668553, "uuid": "c83a6ad6-943c-45dc-be25-f756153819b2", "value": "T1B065D104E87970DAFDD740716F365201F8327C7F4F252A9B51E896B11A1AEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668553, "uuid": "407c4ae6-b383-46ea-91c7-e938a61c3e85", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668553, "uuid": "ace8a8f0-bba0-48fe-8d83-05940effce0b", "value": "24576:bqHhP0Hccxas/JLDBUfInhWoLoZs8EDeWavQZUsp7ht:OHhMHccxrcIhvIEZaIZJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668553, "uuid": "00880b0c-12f8-4ff7-9253-b7bf07e386ca", "value": 1522728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668553, "uuid": "d5793bd2-2118-4005-b579-e3cf0bcb92ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668553, "uuid": "83a0556f-025d-4dc8-a4c5-596442b2ad92", "value": "Arly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7838249-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701811, "uuid": "022a355f-405c-431a-b8b1-10e8b364ffa6", "comment": "Malware payload (Mirai)", "value": "e0355bf228770f897a8d35ae38418778", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701811, "uuid": "204d16e6-81d5-4ac6-b036-d0cada5d6002", "comment": "Malware payload (Mirai)", "value": "60ef1aed8beba471b60a91732ca799205393aa2cc75068ccca7fd5dbc9a96143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701811, "uuid": "ca38cd2e-0544-464f-b718-52348a1cec45", "comment": "Malware payload (Mirai)", "value": "f9257a1b2e94ff9d5a89ddff13a73496285c7f2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701811, "uuid": "40fdf69c-874c-4069-bf0c-6a40221f6594", "comment": "Malware payload (Mirai)", "value": "bdc7c65069010097abdaf80aad78557da43dd7d57c42a787e04eda7c29530ae571b529e3f0ba217deb5da614f2ae0529", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701811, "uuid": "f4896bbc-da0c-4b78-afab-828323c4a9ec", "value": "T1CA330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701811, "uuid": "4ac40640-ba9c-4254-81bb-bbaf82e867ad", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGc:r/hqaJMDg9eqK806MHdkfQX6HuCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701811, "uuid": "e1abdf0d-8d1a-492e-b8e7-313b7a2a69e2", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701811, "uuid": "da8ea0f9-48c7-4186-af8e-8fccbfc455d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701811, "uuid": "df3e8a1b-1a38-406f-a1d4-72504b6238e0", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe9d2d9-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755697154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697154, "uuid": "a8d95dc7-30c2-47fa-825a-71fd52e5d666", "comment": "Malware payload (Rhadamanthys)", "value": "09171646df7fea0df604bc551648c461", "object_relation": "md5", "Tag": [ { "name": "creations-tools", "colour": "#FE101D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697154, "uuid": "3b8260eb-4321-4ec4-b9a5-da2610ace604", "comment": "Malware payload (Rhadamanthys)", "value": "6107b788f33cafc43f8bc97f4f318c6322ac5afdc1da189ad69a064ad4b6dcfe", "object_relation": "sha256", "Tag": [ { "name": "creations-tools", "colour": "#FE101D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697154, "uuid": "68b094af-4741-4370-a07d-d27aa4360a26", "comment": "Malware payload (Rhadamanthys)", "value": "bede2ff0e357c15d5ad91d44e5b216995e2775a4", "object_relation": "sha1", "Tag": [ { "name": "creations-tools", "colour": "#FE101D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697154, "uuid": "fa087acf-46a7-43f3-8edf-825dd2d1e6ed", "comment": "Malware payload (Rhadamanthys)", "value": "c16fd88f13491778ec6a29ed30e9122321104d3bb31e40f74486bdbd625d0c07abdc6180f6c80b9b563c4bceb074d119", "object_relation": "sha3-384", "Tag": [ { "name": "creations-tools", "colour": "#FE101D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697154, "uuid": "95e2ec27-8a45-4112-98d6-3fc1cd018d37", "value": "T19C168DF1364BE2EFC1858874D495CA0FD1148EFBCE14E402DD1CFA2F56239A9E38A665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697154, "uuid": "994379ba-68de-4674-b1e6-5e0b81d90d61", "value": "979d4d3c19bd1d7e944b1ba868d6cce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697154, "uuid": "45055251-d5db-4e2d-a473-39f2eaf0280b", "value": "98304:j7w7Tv2YzQ+DaCp7m1iOInrmB1x7QkQL4hTRErRcOYzvx:3w3N1DaCp7uDInrcLskQnXYTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697154, "uuid": "584d3531-c373-4f6b-8f6e-6ed395bd63b0", "value": 4375944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697154, "uuid": "d0cd8115-e0a0-491b-8004-145e1acbed02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697154, "uuid": "8b4214cd-2854-4ba7-8d9f-4fac3eaaeec9", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b1e6d5-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721541, "uuid": "91aab248-a840-410c-8d58-2e7d4b875afe", "comment": "Malware payload (Mirai)", "value": "6cc4931259f413ecb42561a32d3a9c09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721541, "uuid": "bc8325a1-e55e-4277-9978-f4e551340e84", "comment": "Malware payload (Mirai)", "value": "612daed23df5516b5be330b23252a7e00fd834ebba45e51003c4f50fa682045f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721541, "uuid": "8e03db83-78e1-48e4-b44e-309aad3f221d", "comment": "Malware payload (Mirai)", "value": "8e2ef874f7127ea500a8e39d1047cf5ef36846e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721541, "uuid": "35c05a13-13d3-432c-b20f-0ddc7428f5e8", "comment": "Malware payload (Mirai)", "value": "0ba0956a69a66fce0b2aa46ab539d7532c030520be04106ebdca65312d0c7d6e01919e576ec8c8ba9690823089279f9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721541, "uuid": "4462b471-061f-4395-9067-b36bebb3bbb4", "value": "T1C1D2E0016640FEE1C5B00235E9668A9B72253D79D0E134FB873D0EFCA6E9A0D47F8983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721541, "uuid": "e13f5317-9e25-49f6-8991-d65060311302", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXg4no9q3UEL7LG:WRwynNIOQQ1KMw4nRL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721541, "uuid": "890b4fdc-3407-40ec-861c-9895989a7250", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721541, "uuid": "c6438b23-7a36-47c5-b937-b6fd33e233c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721541, "uuid": "f24618db-3b67-4f30-8816-33987acc9dd4", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc01da6b-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698839, "uuid": "90c154cd-2411-49c6-a064-3f374a7b24b7", "comment": "Malware payload", "value": "0249d93782dd692bf073bc2548b1589a", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698839, "uuid": "f32c148d-965f-4e11-b152-11774992ad19", "comment": "Malware payload", "value": "614807245c62f169684da5a40960d5bfac22efc0785317dfe28a76d35ed29f49", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698839, "uuid": "9df0cc45-6c48-48a2-b918-c4b83f6b4cfa", "comment": "Malware payload", "value": "d2419bf8700b67752e752bb0b0bf363d796efc24", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698839, "uuid": "1874e46f-c61a-420b-877e-30a7a0289431", "comment": "Malware payload", "value": "df1e6813d66b960086dcf047972a7ac48e2b29a1be9fed6bbcff69d4748b45abf99055e2f26207e2c63280adeafdb572", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698839, "uuid": "24df86eb-72c7-4ba1-8162-193983cf4e05", "value": "T150C5F619FFDAAC3DF49CA478658CC130845FAE2415D28462EDCFAE5BF720A8049F195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698839, "uuid": "6e7cd15b-e3a1-4aab-81e6-9315fbe5e112", "value": "5316646cb658259867ef69d100f31589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698839, "uuid": "8a967669-b01b-4c48-befe-07bb1d9d50b0", "value": "1536:zG84rkObizHl6KWGY5AesAnoT6K/PJ1ThMR/QVZ771tsWacd6qHoaNMeBzxTH2ig:jo9KOGY5Q6K/P7dM67t6JaNMgxTHZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698839, "uuid": "3418f75f-3d77-4265-bc49-86aada19b448", "value": 2717776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698839, "uuid": "5155b55d-993a-4785-a20d-c8ce9374162a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698839, "uuid": "b35879f9-f45d-443a-9bf5-9729ec31d639", "value": "614807245c62f169684da5a40960d5bfac22efc0785317dfe28a76d35ed29f49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3382c08c-7d9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677028, "uuid": "8c4d0310-451e-46b9-ad38-674e9998c733", "comment": "Malware payload (Mirai)", "value": "e586e24a10c0ac6249e7fd8531ae968a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677028, "uuid": "78cda9a1-dd5f-465f-af3b-ff970228324e", "comment": "Malware payload (Mirai)", "value": "61967c5a27c511de5ff08075873e0d144c4f6830ee7d348e72248b9460683e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677028, "uuid": "17f066f3-dd8c-40ec-9d7c-27c05d19146b", "comment": "Malware payload (Mirai)", "value": "e67bb7bee0634d33fcc147e3b9aaf28d60a94507", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677028, "uuid": "710b0af0-69b1-4207-bbbd-1b5b9dddbc09", "comment": "Malware payload (Mirai)", "value": "0119d26c451171f887728375c568638706464d0877b26778f6abb5de937e0820d3299b1cb1a9990d2975517552108cf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677028, "uuid": "06509c94-2da8-4c25-afc3-5a5e2a4ee4b0", "value": "T1B4833B92BD819613C5E023BBF66E018D376963A8E2EE3313CD256F2177CAC1B0D67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677028, "uuid": "5ca7aa67-2534-4194-817b-2f0344df01e9", "value": "1536:oaFYdcTW85cBW80sQJEfMqRF+tT7chitnwpAyxtZymi:oaFzTWTQukqRF+5cMttyxtZymi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677028, "uuid": "0ee622bf-c9de-4c8e-aa23-749184e8aa32", "value": 80860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677028, "uuid": "ec18412e-664c-4d87-9cda-d123db612d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677028, "uuid": "6b7b81cb-8bf6-4c72-a6fc-93a019fa11bd", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ce08aa-7d95-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755674340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674340, "uuid": "317448f3-9952-495f-bd3b-9e0715747157", "comment": "Malware payload (XWorm)", "value": "37fba0f69eabe5946ff9f63937ed8209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674340, "uuid": "d243f755-d7a7-4ca7-9a07-3ecfb704daa1", "comment": "Malware payload (XWorm)", "value": "649243059c52a8eec583ec9e6334aba54c59dcddf41a78a9ca836be6e6727f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674340, "uuid": "8e7698a3-2d28-4ea3-8b4a-183ac3e8bbb4", "comment": "Malware payload (XWorm)", "value": "c8e7950e3ddfd7bf2608a538342b3adf1db11335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674340, "uuid": "242e1564-14ba-4969-88e9-e48bcbb3bfdf", "comment": "Malware payload (XWorm)", "value": "7bd9bf580c08e1e38142cbd126ab680458df7b8720ca787943abc3344d48fcbf0e1786cd70bc45d4dbe3e3df5480e457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674340, "uuid": "57483668-3e82-4729-8f2e-5ab6aedf91a0", "value": "T126B4F151229AD100E5F63B3429B1D3759B7B7DCD7830C24B8BE4ADDF3E62B4164A03A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674340, "uuid": "e861a73c-81fd-4bd2-a61e-a1587e8fd45f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674340, "uuid": "478a4764-a60f-4f88-9d2a-9fdef0829189", "value": "12288:gzEwScNPel1bBEAoEq6YP5xnokjjLuDvZP0uxhan21QkR:gYwn9el1b3qp5xokjvKmuLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755674340, "uuid": "07ece8be-caa9-47be-83cc-d2128512fa17", "value": 529416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755674340, "uuid": "89b0974e-861f-4c18-ad78-a32a6fe15c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674340, "uuid": "02a5c3f8-4949-40e1-9eb0-af9952179333", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.1014.19178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760bb89a-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686159, "uuid": "bc78946d-4ca8-4c16-bceb-0217d555f4ce", "comment": "Malware payload", "value": "2333b79fa8818a052133872a3b5ca4a8", "object_relation": "md5", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686159, "uuid": "d6662695-987c-4c69-93d9-0edca3873434", "comment": "Malware payload", "value": "64d2ce24a6c6ab0fcff8715359541773fe1d40dfb896a28efd04f9276f082f70", "object_relation": "sha256", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686159, "uuid": "f3b5fdb5-1b21-4547-a6a3-5ec7ec0a31d8", "comment": "Malware payload", "value": "fbe7388836b83d34eca3a81b8cc6ec6dd2ddd9b1", "object_relation": "sha1", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686159, "uuid": "fe0ef777-dd36-4934-87ca-2afcdc9f2410", "comment": "Malware payload", "value": "ecdb1c1e3b863ccde355b85a106b2b91ab6fee7df3e60c3841349ca128ac94da658319d26337dc1e69a283683f2534cd", "object_relation": "sha3-384", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686159, "uuid": "ebe47875-290a-434d-a893-cb30a9974cf7", "value": "T105E4BFB55355EC9F0A1C0EA5F418074A5C6C48E7E6B8D2F87E82B8F985990A04BFCDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686159, "uuid": "10496322-9122-4654-89da-f063b1beb100", "value": "12288:7gVgX/uLmw+M6qunJGueRaQ8sPB3Klkfzy8265Z27FI:NqJynk/v8sPB6lkfzy82YwFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686159, "uuid": "67baa813-4ab6-4c0a-b215-06015a4b5ecb", "value": 666284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686159, "uuid": "a67387f5-b5ce-4406-89fb-5a92a717a1f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686159, "uuid": "e26ae999-3ba1-44ce-a4df-640bf66f915f", "value": "64d2ce24a6c6ab0fcff8715359541773fe1d40dfb896a28efd04f9276f082f70.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17a48c9-7de2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Pony)", "timestamp": 1755707411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707411, "uuid": "8624574b-0828-487c-9e45-59b7a61d5f8a", "comment": "Malware payload (Pony)", "value": "c93d9e4ca6ee41918bb01d5a626079cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707411, "uuid": "97f6ff06-7e26-4a4a-8bf0-a6f44edfbac9", "comment": "Malware payload (Pony)", "value": "65b7741ef37e9c2a17e120a08cc5c55828d4fb18c0f9aab55de0a57ca32b8fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707411, "uuid": "0c2ff130-329e-4e70-a9bc-69a69cbbc7d1", "comment": "Malware payload (Pony)", "value": "1330ec6bff670fd4ef6253e32733fb7f9ddbb7ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707411, "uuid": "2f5208d2-a2f7-4ab8-8b78-2dee5e5cfe46", "comment": "Malware payload (Pony)", "value": "8965ba8ab4666992d1f532af7cad43ae6849ee22812fb4d03e987d93451449558acd92e2e99153fbfa91efe649f362c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707411, "uuid": "34af768e-4f49-47ac-af3f-e8f2edcb931c", "value": "T1DFE49E63E2F0C57BC1271A3CDC1B9798DD39BE112E2899466BE42D4C9F38751392A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707411, "uuid": "55c3d2d6-fb19-4260-83ec-3bf41e82c66b", "value": "83695f0cf5ecdeaf5eb61e28b247d998", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707411, "uuid": "1cfa3733-ab7e-44fe-9b7a-0da334b3f1b9", "value": "12288:258LTA3KkEDGYwxFfdY5seVxXnvZxGnj2TtmL0zEawJ9LR7t54hKhBzMSocxaSs7:TfFFKYwx5dYnbXBplQaiV74hK3zMSbYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755707411, "uuid": "c6c8f34b-4676-4734-8d30-aa41f1093717", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755707411, "uuid": "aabc82b5-0d3a-4f7b-84a1-5d0b385d15e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707411, "uuid": "acc319da-efe7-4664-813f-c2f8885ab5c4", "value": "c93d9e4ca6ee41918bb01d5a626079cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5865401-7de9-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755710317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710317, "uuid": "2852dff7-affe-419d-976f-edf2b5c0e6c4", "comment": "Malware payload (GCleaner)", "value": "e9f58c710e2ced71f9b160f30177c840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710317, "uuid": "09b0cdaf-ae39-4d9a-a480-ba0e38322729", "comment": "Malware payload (GCleaner)", "value": "65bd0eb4a9c5160b367263e494eebd87dfb74a3032f7acf0f09bb707c0dc2ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710317, "uuid": "f0a64cf8-9eab-4358-a60b-19eb8b91fa10", "comment": "Malware payload (GCleaner)", "value": "0a2574bc21deaba11531831a468b9e6d95445e78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710317, "uuid": "57d72f26-20eb-4e38-bbb6-26e22bf07c6c", "comment": "Malware payload (GCleaner)", "value": "0e10de427fcbef4c3e5bd2da39eb72489e3b3c466b584952f8e40c09ad41856a95725f4f2452ff92201bd7a6db634c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710317, "uuid": "1fbbe8c5-b7c8-4eb8-a994-12e9c2ab2ce0", "value": "T11C06F1EA6D336832E6D7713FDCA7B570DDC9B6203C43A509EAA40744053364E670B9AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710317, "uuid": "aa8b9204-3c9f-4f31-aade-f65dfd82cf96", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710317, "uuid": "4807f8ee-faa1-44f3-83b3-4de37b3d031f", "value": "49152:fME5gdnArq2UX7IkKfNMmhJvjeMcKD7Wru6Vf752OTXifi8kH:fMUEnoUX7IkKBZcKQN9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755710317, "uuid": "871dff16-976e-44ec-b761-74b8391a3cc2", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755710317, "uuid": "9c45e18f-5cdf-4482-a952-ac4a74ec503f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710317, "uuid": "42a71e23-46ac-4c06-b88e-fa0b6f59dcef", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.27115.31015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "086fd41d-7def-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712604, "uuid": "b1211d42-7708-4420-a83c-28a6a3021de7", "comment": "Malware payload", "value": "12196adc783ba7eee8064015a17acaf5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712604, "uuid": "7a566b2e-63ce-472a-8c62-a822c9ae0b92", "comment": "Malware payload", "value": "65ff82b0a7775c1e017610e2968a6bc6d6bcc71bd0538466eddcd86b59286a09", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712604, "uuid": "4a7513bb-23ab-4a91-83a5-b0cf0beddd23", "comment": "Malware payload", "value": "6dada5a94b53053a8fb858a68418001267e81e82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712604, "uuid": "b486cd59-94bb-4282-b3b6-0bcb2f760154", "comment": "Malware payload", "value": "9036ded0d80a750a14ddbce5b689b57c86105f9f89d5b4aaf2174a9c5cb80a1b641d4af84552e9fc6e03f88faae38f61", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jul5050quasae-duckdns-org", "colour": "#1AF3E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712604, "uuid": "192c7fec-f48b-4148-ab4a-d13d59195e56", "value": "T151F343DCE26FB288DA6BCD0C8721DC49EC6D5D57BD012342E49906AC69E08702F5E7DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712604, "uuid": "bc138a37-48ec-4029-a5d1-11a0ccc1d35d", "value": "768:7VTEesMnqDOJYevilcjyYeFe5/ROj6qVGVdjPMumUjU/ltArl5Xb6t0BID4MauOy:pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712604, "uuid": "7583b30c-0d9d-4bef-b246-e349a7003154", "value": 161071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712604, "uuid": "79791167-acd1-4646-873d-e78058eea1fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712604, "uuid": "da878e9e-01a4-4d2c-bfdb-09e2152b11d4", "value": "65ff82b0a7775c1e017610e2968a6bc6d6bcc71bd0538466eddcd86b59286a09.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e817d548-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "d9e71ff5-d68b-4d45-8882-8e25212e5351", "comment": "Malware payload (Mirai)", "value": "925f586d422ccf7daf6abb2d28fa428f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "ca4689f9-3ecc-4cf8-b318-aef65eef6ba5", "comment": "Malware payload (Mirai)", "value": "6620853b03ce8e79cce8a9e5649cdc857c0a024a0a7e23b07401e00f105b563e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "a399986c-ea7f-4c56-9447-c833165fcbb0", "comment": "Malware payload (Mirai)", "value": "5099ea32ab52033c2158d36fb3305ad0428b9ced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "968b8005-45e4-4c2f-831e-6e5d28c2cf15", "comment": "Malware payload (Mirai)", "value": "cc0320f8cdcb646e7f7297a9801c96eb52c4c13d3f0213937087c38203d62c2f4bf84fc4b0e549f144d656bd9e006a04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "c1233544-6f0c-4938-8420-6b9b6fdb6131", "value": "T12EB2E189D6FB1BC3C3929335E0BC8A4DE1721AC00746450A610D728F92A760F8BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "ec9d7cc7-9baf-4403-8b09-df4cfd2eee9b", "value": "384:MVDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLz:w/QOC0Yhn6ROHWFlAcwNEFCnNBxcbcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721569, "uuid": "c13e3827-c4bb-4d03-89b7-7f136d78d809", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721569, "uuid": "7392be77-f106-4ddc-91d6-0e94a4ad4a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "97c62d5a-35ec-4369-96c2-4412d17b6887", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab8555b-7dbf-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755692179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692179, "uuid": "186a933b-de3e-4eef-bf42-acf5e6ae128d", "comment": "Malware payload (GCleaner)", "value": "acb29c97ebee5f59080292255f22b272", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692179, "uuid": "169a8df7-d425-48e7-afd9-c074c0c1c1fc", "comment": "Malware payload (GCleaner)", "value": "6621b9465a5a1ca10921c22b8a6403027eccea0c29f5fb72e8923886b7a8ae1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692179, "uuid": "50156e0d-f8a2-42a0-bfcc-5f48f297a53b", "comment": "Malware payload (GCleaner)", "value": "ecbaf1bafe840fe217e91f94d63a09ae50b95bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692179, "uuid": "3d83da2e-8978-43f5-8ad2-250889bf6249", "comment": "Malware payload (GCleaner)", "value": "ea122cad6cdfb94661951dc42fb337f83699504659b0c7575defd72f0c0a3ddc0fcfeb0ac1577fa4705b970d889d9c78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692179, "uuid": "3d94f8e1-d67b-462b-9188-f37c517229bf", "value": "T1F006F106A6E4917BC0537E3ACE54D3778ADB2D00757B8A5FDA860F851935333AEA00ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692179, "uuid": "da272bcf-e80e-4216-8df1-0991f47cea34", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692179, "uuid": "dfc11638-fcb7-467b-9339-c2d245b1ab19", "value": "49152:FME5gZsvyP0L137NaTgoRaoOBl0yxi6KdlC4OoKyzsNq9KXdWVJPbd:FMUEyyPVjaoOBrmCBZyf9KX0VJPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692179, "uuid": "9de65d63-00f2-4490-a3e7-e0bb77079e61", "value": 3662112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692179, "uuid": "5e963cb6-559d-4ee3-b85b-99a70227b460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692179, "uuid": "0eea735d-74fc-4426-b807-8fafa41fde0f", "value": "\ud835\ude9c\ud835\ude8e\ud835\ude9d\ud835\ude9e\ud835\ude99 \ud83d\uddd2\ufe0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1717ef4-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703492, "uuid": "1a7de61d-6305-483c-a1de-b84820660950", "comment": "Malware payload (Mirai)", "value": "5b70d982e1d8e5a930b5fe1a4dfe8aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703492, "uuid": "125e85ce-31c6-41eb-bd0f-92a9544a588c", "comment": "Malware payload (Mirai)", "value": "664a1eb8c25ed7d70b4dd8376830bbeaf879d45bf9885d3a6279fa938f8470c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703492, "uuid": "3acb9c2c-acbb-4614-88d1-8fbb0cb6f499", "comment": "Malware payload (Mirai)", "value": "88d38a6df73ab79728675902cc8479e57aa13879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703492, "uuid": "3bcf2cda-0772-4b21-b71f-d8f32292a168", "comment": "Malware payload (Mirai)", "value": "5190dfb03c38beafa6ef502bd251dcca4f9665d6161a721e4ca6aa2ee7a6c6a5ae35e5b35e7168fadfb4612ef4a3bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703492, "uuid": "4e2c8c71-06ea-49d8-92de-c7aa3e2fb651", "value": "T144834E39F6321723C0D3607521EEAF127DB557C92394E54B3AB11AB97EA25233902DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703492, "uuid": "af8c29b6-464d-4d6f-b322-a9b14c5d4517", "value": "1536:P2RtbU1cZZTENhZJaZrzGfZokwhsqn59ubz3IpD/5L1tlYO2:mt4Vdfs9nbFpd1QO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703492, "uuid": "d6fc4b34-13d2-48e9-a8eb-19363c43825b", "value": 83808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703492, "uuid": "b4b59eb8-db7c-45bb-80aa-0b932db8fe14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703492, "uuid": "9e9607f2-976e-4db1-b0af-6ee845c8e2ab", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98452177-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755699530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699530, "uuid": "8c7ec128-f5f5-47ed-808b-88d81a81b1ae", "comment": "Malware payload (AsyncRAT)", "value": "c893d6de622dbc4b2d70170af6044986", "object_relation": "md5", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699530, "uuid": "70bd2b27-8b45-4a34-b6d6-8b5ac18d8d83", "comment": "Malware payload (AsyncRAT)", "value": "67c0645892b01e1f72ef11e706902a7f465f005fac695806ba686528439a184c", "object_relation": "sha256", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699530, "uuid": "037fc515-118b-43dd-bab6-1178c9af5e64", "comment": "Malware payload (AsyncRAT)", "value": "e022057c76224366b2fa5cf549eed0c4aba33dcb", "object_relation": "sha1", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699530, "uuid": "2129a34d-7c89-4710-8d2a-7c26493e933a", "comment": "Malware payload (AsyncRAT)", "value": "2eab231336269b58c4a2d214ddd1b1f24402325dade0bf128b33f25b6a39a60a656a4591b9a005dac35dfb653b1d28f4", "object_relation": "sha3-384", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699530, "uuid": "4e9d3717-e51b-4f22-aa8a-41225e751faa", "value": "T1FCC5BF0BFF8255A2D8CE417912A757BF4E398A189724D9D3CF9118ED98306C0A73F399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699530, "uuid": "a5e904d2-b845-43df-ae8c-ce465ac6af7b", "value": "cbc2ed6d17f59687b4e5ad86daffb4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699530, "uuid": "958e2fd8-2ffb-4e6a-9681-a3f69d0dce57", "value": "49152:korrnPEaMqXXX+FNJhZaWovsr8POB92zqtMZZZcgazyUhG:korboNMJElB9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699530, "uuid": "363d0937-d3e4-4a13-b2ad-cf00e7108649", "value": 2744080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699530, "uuid": "17295a25-b6d3-442a-b32d-391cfb347c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699530, "uuid": "b77a3c61-e5e1-49c4-a9da-905daf53b42e", "value": "67c0645892b01e1f72ef11e706902a7f465f005fac695806ba686528439a184c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a32b4b-7d67-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755654317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654317, "uuid": "6016164c-bcd1-4901-954e-6f043dc97e9d", "comment": "Malware payload (Mirai)", "value": "3bda824d69bac9908274b13ab05143b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654317, "uuid": "e52e3899-ee2a-48e4-9800-0c331e13cd71", "comment": "Malware payload (Mirai)", "value": "67c20358b45a2c644e807254259fdb695c6c3b93fe2791d8693e66988d48f116", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654317, "uuid": "b4e711e1-0cd0-4864-9366-dff19ddf3fb2", "comment": "Malware payload (Mirai)", "value": "80fa981c6be403dfbacb14e92895edab6f876676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654317, "uuid": "86752646-a9ec-42db-8521-754cf197813e", "comment": "Malware payload (Mirai)", "value": "2b6ba4ffcde1264a9e984439d79288d139d0a438b5e9042a44110de6a984a52c2b8e22eadaf405a7c0f4ce5d90572e5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654317, "uuid": "ae94b6f4-a9d4-4cae-9f46-7e710f1446d9", "value": "T124430126E4631FF1ED7B60F2E3C498853268E90A18CD4FA3E78FCB56065652A53646C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654317, "uuid": "f0163a9e-8e2e-4eee-9226-32a879f6bf7f", "value": "1536:cwCSCsiYriwbmxphV7WHJz8VLPFHC7bZZCpKWw4u+qgw09z:njri4KphJAJz8VLPpC7Vkpu4u+qgw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755654317, "uuid": "ed2cab5f-03e7-4715-a0b3-e758e7d95793", "value": 58220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755654317, "uuid": "91fb832f-7ff6-43c1-9d59-16987d2ef8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654317, "uuid": "311b22d0-d91d-4c40-b936-f6e090d7da9c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0996b31c-7de4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755707881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707881, "uuid": "2baf821d-a857-4844-acfb-2717db8ad6a4", "comment": "Malware payload (Mirai)", "value": "6df3c0f8f6ca1bab79e08405cf3ce02b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707881, "uuid": "02f60bf9-707c-432c-ad98-f198c23d2b39", "comment": "Malware payload (Mirai)", "value": "67d90afea2b6964a1ddc1705cb251b034bf7d2931f5952354eee499715155de1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707881, "uuid": "b0867669-746e-48ed-893d-699ad9ac2033", "comment": "Malware payload (Mirai)", "value": "89fe70e052fa15c6b6039cd2efa8e3551d8dfb75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755707881, "uuid": "eb4a2066-7fb1-46a5-b8f9-27ee044c1214", "comment": "Malware payload (Mirai)", "value": "2a9fbcc7b856dc172ef2cc1b28751901546275dffd1a40ce8e82eed7642f290d22649bdaf0d4be1d4c14bb9d21312c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707881, "uuid": "b4d68334-57bb-4524-af0c-af05295c6356", "value": "T1F104981E6E228F7DF66C873447B78E259B6923D627E1D644E1ACC1105F2028E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707881, "uuid": "64fda008-39c3-4f98-bf2a-ca28b7b7c8e5", "value": "1536:GJmJ7rrbgx7y74dN7/5tnHBezjx9uIfUk8e0GOYeTepsTMYCI/vmTmT9KQpb3:GM7Dgx7F3Bezjx9uIsko3YNwT/vmCT9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755707881, "uuid": "91373c61-f115-4ee1-aa01-fadba7ddf746", "value": 177896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755707881, "uuid": "e95eae6e-227a-4038-bce9-1d205f57493b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755707881, "uuid": "a3e07282-0158-4625-8a5f-1be5d0dcbae0", "value": ".udevmon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84be7dd1-7e1e-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755732998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755732998, "uuid": "0d6e4648-4275-47af-b88a-48faacdc33db", "comment": "Malware payload (GCleaner)", "value": "dffa147d35f5e3c93c28e39d95a3ec8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755732998, "uuid": "32b09861-b712-4b00-bc69-cd99d9e5ca97", "comment": "Malware payload (GCleaner)", "value": "67e77189393add966f9e78d19ae43c10ac6b4e8a1db113d04d244e54176985c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755732998, "uuid": "68dc282d-0940-454c-8ba8-e44752ed272f", "comment": "Malware payload (GCleaner)", "value": "675830751481bc31dd30435d17db8003718ce08b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755732998, "uuid": "2e60545b-2a8d-48ea-b104-601bbbc77e75", "comment": "Malware payload (GCleaner)", "value": "3326b6b0b1d6a460bbf94af62e6b4cba63826528e5fb469a6589782bc13e01c769e2d97c54ecf50cf343509e3f0be2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755732998, "uuid": "a8c3fa0e-5aa6-4c3f-8b6a-6c1a3abf8ddd", "value": "T12706F12B65E0843BCD826679CA3F827558DDFA5036476AEC1FB9DFCC1E069CA3124193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755732998, "uuid": "365cf4f6-ca2c-48a6-907d-32d293b8f592", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755732998, "uuid": "5b38e617-3a1b-4482-a3d7-c4c2fdebe7db", "value": "98304:PMUH8GGzNKQ9OembpR6uKEaHJK/zpfz56/LEgwpc7T:PUGGzNKyOembpRQK/zpfz56/LEgRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755732998, "uuid": "4eeab44d-4755-445f-95cb-315758dcfca9", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755732998, "uuid": "1966043f-2c94-4140-aea0-e2809a6d262e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755732998, "uuid": "3bc1d680-5c66-4f83-8450-b61d588094af", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.28132.13202", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b63a3dc-7dfc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755718299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718299, "uuid": "090f1abd-51be-4a80-b0ee-23cab1726f01", "comment": "Malware payload", "value": "c53d228f3366421d5bf4b5ae50491e7a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-684T6RFT", "colour": "#ED2EB2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718299, "uuid": "0d46f326-4817-40ed-bd2d-ba2058b223d0", "comment": "Malware payload", "value": "686012c04728b36ddffe4b7ad6b00e8c75d5aa8f9af197b9b5cfe3f1fb20cb29", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-684T6RFT", "colour": "#ED2EB2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718299, "uuid": "535acf3b-c897-4116-8bb9-338c8110ed50", "comment": "Malware payload", "value": "c43ced0260422643c29a1848c4d9a9fd6f04e5fd", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-684T6RFT", "colour": "#ED2EB2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718299, "uuid": "c2e2d835-2e2b-42cf-942f-09924e1b6cef", "comment": "Malware payload", "value": "e3da081a60f898386062b1623941c0bc4a05a2bb56dd23d689cc35bb9d37f282d007136bac86f1698317f16aeddfa91d", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-684T6RFT", "colour": "#ED2EB2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718299, "uuid": "8c881c67-914c-4b9e-9341-5fcd9e6936b4", "value": "T1DFE633D382F84CB7B5AD7B68E3F0FA1A830C65230BC5D49A16A249C125DB92FCDE5C15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718299, "uuid": "271f165f-7731-45ec-8dc1-b8555d0cc54c", "value": "393216:vj/m9oVu8qRKYWSwi70cGCjw16yiMb8kKcNZV:76oVu8qKYs8t3wDiMb8k/NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718299, "uuid": "0939abd7-bbf2-484d-8c2f-5d9a09984ceb", "value": 14087060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718299, "uuid": "ba1170ff-b329-4777-ae2e-56bd688e4110", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718299, "uuid": "22a83a8b-9bc0-4fb7-8f14-778076d782ff", "value": "BOLETA JUDICIAL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bfa0466-7d5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755649098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649098, "uuid": "4fd9ac1d-c465-4ed4-9d24-e37230888abb", "comment": "Malware payload (CoinMiner)", "value": "128c7440b53d0e5cec3e9b574c8270fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649098, "uuid": "3329ca0f-4db1-48f9-8e3b-4694912f4b28", "comment": "Malware payload (CoinMiner)", "value": "687b1f41f116f49f5c18e7823a52ab07403c269979dbefd245781a5ef519151a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649098, "uuid": "aad6707b-ce61-463a-941b-7fb16bef1e20", "comment": "Malware payload (CoinMiner)", "value": "5c8aeb4829a0f935b7fe19df5b438effe74d5548", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649098, "uuid": "2fcef2c0-ed52-426d-a386-140d1f36550f", "comment": "Malware payload (CoinMiner)", "value": "c9c04db33f8c7acfd320de12aaa6cc9c6f97f189e5a80c9431f468e3b3ffb0b8370dfa48ebdcc8ec4804f7ac8c00f5c4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649098, "uuid": "bdc48b90-eb9f-40e6-b575-b65766e1681c", "value": "T19B66233397614900DDBC96BA5F8EF7BA07C028297C5DD2D85E329E050AB8C38766357B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649098, "uuid": "d395ef75-17df-4bf9-b252-197e2780ac8c", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649098, "uuid": "0f22d120-3b97-4258-9206-367f8290acfd", "value": "98304:emvFFfcJ8PSZi7j6VC44kapZzqHiClmB+G+QX9ilLF+yI0vdvVGQgusQ:hPfcqPX6VClx4iVB+3QNI0svVGQgusQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755649098, "uuid": "950bc688-9da8-459c-8c8e-6b7d00793245", "value": 6512144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755649098, "uuid": "757b5ed5-3066-48f7-be69-b025649ef202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649098, "uuid": "b77fd88e-ffa2-47b1-bc43-84a8ee42cf11", "value": "SecuriteInfo.com.Win64.MalwareX-gen.13496742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a67112-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702430, "uuid": "506100b6-0382-455d-bde7-026ef1b8def4", "comment": "Malware payload (Mirai)", "value": "7ac2bf25c6c3992ed5bd97093e4505c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702430, "uuid": "a7f0d814-ce87-47a0-8171-6482f2b35d02", "comment": "Malware payload (Mirai)", "value": "6a547b71019c770a05a37e4b1bc22d976340c5c6b02871a1e704d62e521e24f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702430, "uuid": "834eb1b9-08e2-4dac-93e8-327b2ddcda38", "comment": "Malware payload (Mirai)", "value": "8142b3092f2bb5195462c1e604dd4688146700fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702430, "uuid": "65b99588-d6ba-47e7-a7ca-ae1667c245d1", "comment": "Malware payload (Mirai)", "value": "e282969e147d3ae37571b59d75c3760bd5198f2ff0b42da4aab226d2046c6b67d2853c1e154d81ca03326b885b9f0eb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702430, "uuid": "18e11d3a-443d-4f29-ba7e-adce861765bd", "value": "T13CD3D569F6424B23C0D30775B5EE9E0A3F3197D163DBB3026A345BB03E9265B2D12D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702430, "uuid": "4ebd71ae-f067-47aa-abc4-b83807f64f72", "value": "3072:XYfznIooLPcRGCERRJ55P3K8u9clM/9GTA5:XYfzIfLPcRGC8J59a8u9qM/9GTA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702430, "uuid": "ac75136e-0017-41e1-bbeb-8bf9d2930808", "value": 142135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702430, "uuid": "6bc16c7a-10fd-4291-a761-b3290c941faf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702430, "uuid": "65baf1e7-e222-4a94-bbba-412b6ae52977", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0198dc0-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703490, "uuid": "cb12a756-538f-44d4-a586-53f564880868", "comment": "Malware payload (Mirai)", "value": "bddf888f555c824bd21a4142739a9879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703490, "uuid": "6aca8516-8cee-433d-b58e-9ea8864d1bb8", "comment": "Malware payload (Mirai)", "value": "6a8d0995d75b3b3907ad732060e3b1b7cb465b005e75efb29605add1061c7ba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703490, "uuid": "5666f4ea-fa24-4390-ba77-34cc0f1bb90c", "comment": "Malware payload (Mirai)", "value": "d7c5bfe92ed90869fbf8f58614453f18311cb1e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703490, "uuid": "ef514aee-f09e-4bcc-a8fd-de00a6b2b062", "comment": "Malware payload (Mirai)", "value": "0eba629a78c7813b63b4bfedc8c29c61afc49973f88ece71b310c2afc7733482b0b586718d8e8c4f8ef60d818a028208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703490, "uuid": "148dbef9-ba98-4e96-99b2-7c76b2c243a2", "value": "T1C7F2F29BD9768A2BC4405D3734AFA4A1BB5980E20F4EFA74C9CC1BD00B83461C5DB4DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703490, "uuid": "ae0e3560-22f1-4eec-8f51-7bf39207dbc7", "value": "768:tIPdN5BjcFnT/jIvcnVk5bSEf9Ly3lo8Omjv4mc+UeHM22e:tKd9jcFn/VW/f9+dbZCxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703490, "uuid": "15f39228-7fb1-4cca-90b3-072f092ff8b7", "value": 34576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703490, "uuid": "50eacc10-733b-4ea9-9f26-cdac43c9c9bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703490, "uuid": "ed7166a1-3f54-4d74-8f4c-e7e296da810d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d2cdc7-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692433, "uuid": "16d61bd2-772d-47a3-bba8-e993d134a986", "comment": "Malware payload (LummaStealer)", "value": "baf9949e853bc2a3479b10e6335e1bd2", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692433, "uuid": "dbd85f3f-35a5-450a-9074-53a8a683e68f", "comment": "Malware payload (LummaStealer)", "value": "6aaa12302d88ebf9486d546f7c8c5ea0930ae6e5db2b70cbe0552dc3f57ee2e2", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692433, "uuid": "d2774dfd-5f99-4819-9f94-72672f64989c", "comment": "Malware payload (LummaStealer)", "value": "33bc48636e242db9bf5efbaebb53ef64b5f10276", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692433, "uuid": "309145a6-1302-4416-97b3-79648a4e61f7", "comment": "Malware payload (LummaStealer)", "value": "052c9fc75afcee964f590e92d181182b48f4d0a650444e242d4628a6ce115e5a2c0a690bd2159f053188ae90532d6b86", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692433, "uuid": "8f05721a-667b-4db2-bab9-f45488396ee9", "value": "T1966533D3456293A7DDA12876B4706B051FCF25247DC307BE479835783A33A909A1EB3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692433, "uuid": "fdb63022-8c90-456c-93b2-264b6a2dba06", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692433, "uuid": "e89b3b30-26d2-4623-9dc8-72267f544cec", "value": "24576:IVD15G5gV/Sk60C2Vf6ugOFhmWGCPguQh7Xz8AFYklnresL7c/YyU:IRG6V/SkI2l6ieCIRn8AFYiCsc1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692433, "uuid": "fd5635e0-d5c8-4469-b6a8-24ae5b245d82", "value": 1457941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692433, "uuid": "7c11a6f3-8947-4906-b9ba-644d78da2c8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692433, "uuid": "4bdf14af-676c-4b6c-b744-bc190c6aa04f", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009153c9-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (OdysseyStealer)", "timestamp": 1755695410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695410, "uuid": "18b7a5be-6321-4865-a094-c88d40c024e5", "comment": "Malware payload (OdysseyStealer)", "value": "26f52cc4fb475fc45a3b1836014e4943", "object_relation": "md5", "Tag": [ { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695410, "uuid": "a266fd4f-68e7-4c9a-aff6-8e54861a69d6", "comment": "Malware payload (OdysseyStealer)", "value": "6b581bfaac26648a4c6c2d9fb53778730eaaf99919b7f2796d178f6209065b8a", "object_relation": "sha256", "Tag": [ { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695410, "uuid": "c11a7533-455d-4178-9612-11ee370248b7", "comment": "Malware payload (OdysseyStealer)", "value": "9c9286c7527720e0c91aa441d57c348ef9c971fd", "object_relation": "sha1", "Tag": [ { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695410, "uuid": "1821ebab-f756-4a0e-8273-0648d1d53407", "comment": "Malware payload (OdysseyStealer)", "value": "582602c914f20fea4672d1ea32d4a8e3cac6f8952592ba5c4c820db0f14fe87642b350655e266080ae2a4822e7c0fe17", "object_relation": "sha3-384", "Tag": [ { "name": "OdysseyStealer", "colour": "#833C21", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695410, "uuid": "f65d8514-6e05-466c-b5ba-b15fa269b804", "value": "T10514121DA0E66BE2DD0F49BB85E33186B4AE0DD7A03CDE67CB80C145B153AE8D935744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695410, "uuid": "6d4481a4-69e4-4462-bd54-f4793aa76102", "value": "3072:vFZO/T7jb1ljDfvubsw0S+L3YfVRMa/qxSer+NJbv6jyo4WESMh4C38TFf3R55/Y:vH47jb1ZfGbswS3IV/qsN76jyo4jSe4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695410, "uuid": "085803c4-eb92-46b0-9d9d-fd2cb0a124e0", "value": 194220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695410, "uuid": "c58e30ba-cba8-43cb-8d34-d10ce7241241", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695410, "uuid": "69e89ba7-85b5-481b-94b4-7453d0701963", "value": "ledger.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48143c1-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701806, "uuid": "342147f8-1e93-4d8f-a6be-37752bb74d31", "comment": "Malware payload (Mirai)", "value": "8958926a0f9ec597c14be3aaa8fd06e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701806, "uuid": "44acecb1-0cbd-4908-a055-b085b845d43e", "comment": "Malware payload (Mirai)", "value": "6b758be7872983a95bc18fe1729b17ab9b57333b4264bf1b5896d5e4ee9a9d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701806, "uuid": "2c56e369-3f8c-4471-9c15-8059b58ef2d2", "comment": "Malware payload (Mirai)", "value": "1df4c8c344def688280ae76f527786c8173f6c64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701806, "uuid": "4a8058ef-e6b2-4132-a2ea-352ad747dab8", "comment": "Malware payload (Mirai)", "value": "b20b472f7c8d54873415ebf716ddfadafcd3ff8367aff3a8dcc162e35827c0b2e516fb87d0339418fb09a70ab2f28307", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701806, "uuid": "8d31d902-e3a9-48f3-8f56-ebbf953a7d49", "value": "T192432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701806, "uuid": "b6244b29-4412-4b8c-90c7-0567dc877982", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAws:RqtmZPuutfbltZFBSJsBcfDSTFI+BEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701806, "uuid": "6e307fb8-e030-40bf-a466-b232aaffb7e6", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701806, "uuid": "1f0d33d6-55e5-49ed-8a57-23af3b8be5e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701806, "uuid": "30f9b971-7e31-4ce3-837e-016c4e926415", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d81825-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679689, "uuid": "55cdbe54-b76c-4aca-a806-6e254942d36c", "comment": "Malware payload (DonutLoader)", "value": "100bf13131e4083378dd08459bd10e00", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679689, "uuid": "b0890632-f295-4e3e-aa22-7b1c32d5c820", "comment": "Malware payload (DonutLoader)", "value": "6cc03fa47b872305a66b60e4aa20ad17960076376b0f5fc57961b152c4890ff2", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679689, "uuid": "b480a237-7c87-4334-849e-a5420d9bca36", "comment": "Malware payload (DonutLoader)", "value": "503f9a6a9bbde5340a3fa5a841f508f32794414f", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679689, "uuid": "f362c6dc-8ea0-4619-b54c-b3cffb47c164", "comment": "Malware payload (DonutLoader)", "value": "110578d1bb980817a810f34790d0e9c3a95263bc1e2e07a109a3e11d30f7ade508ef94beff0cdc2f62d09b40127255d1", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679689, "uuid": "a5727407-0d76-43f8-bb34-bb2151503bf5", "value": "T12685F073BB465AD3D48CCFB928AE7394F76DC1A95A44032BB7858212ED801CDACCC5D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679689, "uuid": "14268dae-5372-4cea-92ba-5e0f87df1c41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679689, "uuid": "01a3cf91-279a-483a-b826-b5deb6a9aca7", "value": "24576:4DciNFMNL82Tbc8tYc0gaxEV5FEldYgouoZ0iygucOo2HOrDE2t6cN9jx9E:e7M5bTjba624goN3bV2eDooP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679689, "uuid": "5f52eceb-b0ae-4203-892b-83f4f74c129b", "value": 1725440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679689, "uuid": "f287ce5b-187d-4177-986e-c3d25715f49b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679689, "uuid": "ba21190d-3033-4a4f-8e3b-12af6a655a68", "value": "6cc03fa47b872305a66b60e4aa20ad17960076376b0f5fc57961b152c4890ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf50eea-7d74-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755659996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659996, "uuid": "ea2b9d2a-775f-49ac-990f-871f0b7b6d43", "comment": "Malware payload (CoinMiner)", "value": "5025b68f7b93da9ea63cd58515f92753", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659996, "uuid": "22a50ade-9670-4295-8dcd-54bad4b2d1f4", "comment": "Malware payload (CoinMiner)", "value": "6d7f49b0381e41680e2131791fbf30ceb581f85d9e2ed862c24dd622cb526188", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659996, "uuid": "2b36a41d-4c2d-4261-a676-db7b8737c2f2", "comment": "Malware payload (CoinMiner)", "value": "2dfa961a1df9b3c9d1268414e74f1a1569e6d7ba", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659996, "uuid": "c9e41cca-1891-46df-9e1d-f71b70b5cb10", "comment": "Malware payload (CoinMiner)", "value": "3528414311dd1860298da6ab44c2ddb4b461d75a25236235696e4864e8205fd410820863479bd41aca7b37ab9317eb35", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659996, "uuid": "d4ddaf72-897a-43b9-89d5-1710ae71f2f6", "value": "T1E9662373369FE3DBD967693431C955D84F6A8837C50C80427EEA30397236B2B6790A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659996, "uuid": "bbf074a2-c0b0-41f6-b6f0-0bfc958775df", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659996, "uuid": "0e837685-f2d5-4a3b-87fb-1228783ced84", "value": "98304:RneBF75lelsYAEcvx0OAJ3gTyYLLY5TKNNnoI4Jq+vv/5HiH/Tmn4TQ/S78+PNR6:RynFHibBuY5mNNN+3/xIyGsSdPNRCCeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755659996, "uuid": "cde74307-2a1f-4394-8151-bd0a156e9895", "value": 6770192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755659996, "uuid": "b48e9998-06e5-4005-8b4d-298e29c1d1b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659996, "uuid": "edddef0f-b485-45ca-ba56-9c27c944f081", "value": "SecuriteInfo.com.Win64.MalwareX-gen.55157895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7273171c-7e09-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723948, "uuid": "02a3885e-6985-42d6-80e6-d55eec940171", "comment": "Malware payload", "value": "0887c1af56000916f5994ca3321131ea", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723948, "uuid": "9cc63354-4850-4078-95fd-756fabdcf1c8", "comment": "Malware payload", "value": "6dabb371582ce6c2d8c4d57dffb739d5d2a003296ca988982fb598a17eb81975", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723948, "uuid": "5b960996-685f-4aaf-b9f2-f881853681fd", "comment": "Malware payload", "value": "39f3452d82b77540b8c61f80d818d7018c8f05bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723948, "uuid": "01abfb72-de5e-40f6-9b6f-ddfa4277e60a", "comment": "Malware payload", "value": "b45d980dcc3d5fd27be1309bc94064b31dae43335f6699ed63e7210d01145ff2c523567e5844b5b901e8f4ccf9e54216", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723948, "uuid": "3df5e3a2-77be-47db-b4ca-f348499cbfb9", "value": "T177015E8C71A01982D913CEC272646541B2DFFDEAA9D58AF1A8EC0C33F55E445FC1BB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723948, "uuid": "eddea9eb-6d7d-4620-9a82-a90361ec84bc", "value": "6:SkLnFL6LlyKt5Hdt0L2H6LeoKtivL66LB9KtkBLVnx6LQ9KtxKpLxi6LyoKta+e5:j5SRAPu2Fbx3YrIb+FSBJCirc6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723948, "uuid": "d4d2668e-1c4f-40ad-ae58-34aa9cf7583f", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723948, "uuid": "76fadf26-83a3-4a71-97d5-1f821b5eb2a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723948, "uuid": "971135f0-a510-40f2-b2d4-098563a96505", "value": "s.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19fd34b1-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700607, "uuid": "dcc24ca3-16a9-4c07-ab93-ac71c5b98b09", "comment": "Malware payload", "value": "3c4545db79259f5060d2484275b9dcce", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700607, "uuid": "5704ee28-7baf-4328-af5e-2db01d7928f7", "comment": "Malware payload", "value": "6e607e2117e4d2b6a81a42ca9960e5e26031a835ef3f26875c3d53cabdbdf31a", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700607, "uuid": "44967973-4e59-4d38-b22a-00d3153e6343", "comment": "Malware payload", "value": "515df7c3691929ef4e991c31dad26d6bab9f6aa8", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700607, "uuid": "c1e010f8-a230-49ae-ada3-0606039713a0", "comment": "Malware payload", "value": "89227d52a348e5e2e161a826069f68c9e692798a07c1be248aed93d08a2a420c0a0358a3819f6d0a1214ceaa1e291266", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700607, "uuid": "4f95a965-74e2-40ef-a68c-16912160464d", "value": "T164D55943BFDB11B1DAAD053B52B2A33F5B398D484B65D4D3DB911F6AD8A30C26239384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700607, "uuid": "02350101-2081-45f2-8812-b8a0fbaed433", "value": "f93238c3177089f43b50014099608040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700607, "uuid": "849ae7c6-1dec-4bbf-a9a0-89e0ffeaa8c2", "value": "49152:7rfvY5f4Yg7kC2IKjbWY0uY7PIjlzMdjnbQys9QGoQNDHmQ:7rfvf7Av2Y0Cj2xts9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700607, "uuid": "45fd0609-45e3-44e7-9f19-1c9e8ac951f5", "value": 2979600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700607, "uuid": "c1e27647-0c49-4f35-983d-4e58050b8e2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700607, "uuid": "26ceaabc-fb2b-493d-a44f-c40364eab49f", "value": "6e607e2117e4d2b6a81a42ca9960e5e26031a835ef3f26875c3d53cabdbdf31a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f597ae3d-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706559, "uuid": "9711ae06-3a7c-4e80-9f3e-6b9672e3bec4", "comment": "Malware payload", "value": "3400f2d7cc9ad0dfa3db6a3e2c422ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706559, "uuid": "d9c30c90-6aa9-40e1-bc74-95fbdb1fa71b", "comment": "Malware payload", "value": "6e60b66a37e7efe0ded2e3bfb06ee258d9c0b5aa730d8de055aec52196369294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706559, "uuid": "e0c440ed-bbd1-4d16-97c2-c73735cbd50c", "comment": "Malware payload", "value": "071f74fed96a9597f73f615599d1c5459b2b8083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706559, "uuid": "82cdd4bc-0251-4c21-94da-ecec8d4a1f1d", "comment": "Malware payload", "value": "6718d9fba54cda9bb3094a7d496d3996b5d65f7d4a093f35b9123d8857dfb9620c6b6ba0be0cada88fcf6a6e83d2471d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706559, "uuid": "c20799e4-34c2-4c11-9c07-cfac51d896f6", "value": "T13B268D23FE81A1A2DCC68174AAA9BEF718701BB0038591E3DF454DD55D34AF293393DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706559, "uuid": "8a709a69-684d-4128-a366-ed99070bf613", "value": "0ae40fdddcdb5a3db102d7747a4f3ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706559, "uuid": "032fcff0-a18c-45fb-b143-911b905f9b68", "value": "49152:NS7WOfuebChcWEoBVSa0ey6vgHrGMuZTGRPFmHkAhBQ:yWUbCeWFBVSJey6Onm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706559, "uuid": "9d699743-f398-4b9c-bc1a-8af678946c6b", "value": 4459008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706559, "uuid": "a8ccf720-7b32-492d-bb2a-01d35f5ccac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706559, "uuid": "b634411a-5dde-48bb-935e-c201de5fd793", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e69f78b-7d6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755656430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656430, "uuid": "79530066-0a71-4e49-a109-2a9175b9f638", "comment": "Malware payload (XWorm)", "value": "a7794c50b6fde63fcc5c9ef35e65eee4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656430, "uuid": "a475e9de-ede2-4100-a352-39c6a4b60b2b", "comment": "Malware payload (XWorm)", "value": "6f49f3e8b829105c5a9831803e3463f00a2ec47e61880a02ee1ca964a16b2769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656430, "uuid": "31e8d1a3-884d-4a72-80f3-d394b7f57658", "comment": "Malware payload (XWorm)", "value": "40938674d2afc4f51faeb07bd3a08c9e417a42f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656430, "uuid": "6476fe7c-fb79-494d-a14b-99eb8348a879", "comment": "Malware payload (XWorm)", "value": "e7641121345c2a99133a93a7313cb27eded5536641c08b89df65feeac1cc7b8428a26c05161a5af28f2faf945d69b733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656430, "uuid": "b8335817-2e82-47d9-a8ed-a295cb57e723", "value": "T1FD133B453BE44216D5FF6BF919B362060A71F6038D13DB9E0CD89A9B1F377808A11BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656430, "uuid": "2cd1efc6-d88c-40a4-8d68-41e1ba87bf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656430, "uuid": "138724f5-2379-4b2a-9088-8b7eda1158d5", "value": "768:UZLEOU7+jFxa+nCAr43MQfJF5Pa9p+26iOwhR3/+bl:UGr72FIYRrERF49I26iOw/2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656430, "uuid": "b319b11e-1051-458a-8d4a-2e492d9b2aee", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656430, "uuid": "6357294c-fc01-4c8b-a769-01c295170d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656430, "uuid": "9a111fe8-28ad-419d-865b-45215a01df33", "value": "a7794c50b6fde63fcc5c9ef35e65eee4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06be9508-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701863, "uuid": "e9f53ea5-553e-46b7-921b-98c4847a1a6a", "comment": "Malware payload (Mirai)", "value": "200274b8ccb9f2db1dbac62c131db1e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701863, "uuid": "f09485ef-6483-487c-ad45-80626b1b5d8d", "comment": "Malware payload (Mirai)", "value": "6f860a4354aa09051d20f7ac7a8cf59a7d0a7941ac914ef0c7995f302513a946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701863, "uuid": "cee47d82-01f4-460a-8853-567a34adb122", "comment": "Malware payload (Mirai)", "value": "0d993a3598347d4ad7d861f8d82682e22a14b8f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701863, "uuid": "0a9c8fbf-08dd-4680-9ce4-94f65df1261b", "comment": "Malware payload (Mirai)", "value": "739dcd588b5dfc33758699a61e67dc7d1062e481e819f292b209cdc53e7fa72121d1e608e2bef3c5b26a7b545f90f477", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701863, "uuid": "f23e85b5-0143-4157-a08e-9498d1c38c65", "value": "T183230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701863, "uuid": "74a5fe4e-f685-4a29-8248-bc7494b746ff", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THl:5DmKF7Gxyk8cqoHAmWurAufsG5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701863, "uuid": "c8ac1fde-a1e9-430c-956e-1587d6cd88a1", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701863, "uuid": "47cfc620-6580-4457-86a9-7e9aa4d29182", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701863, "uuid": "d0a2cd7f-2249-40e9-81b5-1ec168af94af", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0177248d-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755702284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702284, "uuid": "832e076b-8ef2-42c7-89a3-4d308f457eb1", "comment": "Malware payload (Gafgyt)", "value": "ca4b6340dd99ae7fc5658a131f6eade2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702284, "uuid": "b7475fb5-b27f-4d6c-8d2f-7f92fd8d8a7c", "comment": "Malware payload (Gafgyt)", "value": "6f8fe90d824304464419f39ad4310e740e9bf252ff7a6cf4a87f2b05c0ab383d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702284, "uuid": "fd87fae5-9d01-4531-87f1-0b3a43a26419", "comment": "Malware payload (Gafgyt)", "value": "afe1b622f4902dfd87c553aef9dd7b6a00781a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702284, "uuid": "43a6b651-50df-4ca7-91ae-1c93ee5d2c79", "comment": "Malware payload (Gafgyt)", "value": "9ec31bbb923dd4d5c2811d8856e61d1e379d97edc0bfcfe1e38bf77f7ca26a30ef7901e8bedb994d6b16e45d7eeab700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702284, "uuid": "58396120-56a0-43c3-8807-19edb200ad06", "value": "T15F63B508AFA10FFBDCABDD3386AD0B4525DCA51622B86B363534D824F54B64B1AD3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702284, "uuid": "18398af8-61b5-4d8f-ab79-1497833dccdd", "value": "1536:SwuHLbNrfn5aDIKbYTGtzY67cIwyW4Z8rIykWO:YJrnQy6+F4ik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702284, "uuid": "536e07bd-3455-4499-8e90-27234247b2da", "value": 68920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702284, "uuid": "68e95935-aff8-4d9d-a277-53d69946d14e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702284, "uuid": "ad435347-007c-4e5e-952a-6bde8af2c823", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d6b8ff-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755704330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704330, "uuid": "e366417f-f5a2-4e29-805b-8877bfadb6a7", "comment": "Malware payload (Mirai)", "value": "d382dcdc042e1a5fb71ab168146ea741", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704330, "uuid": "d5349ab0-8fd5-472d-8716-5ade46714221", "comment": "Malware payload (Mirai)", "value": "703f1af44d18abd6872c15ef61f456e8819315316bfdf7d3bd8473a7d5683836", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704330, "uuid": "01ed6fb3-6b19-4a8f-a520-b18fb4811931", "comment": "Malware payload (Mirai)", "value": "6f56f8524e22d7889a7ab085ba3db4be2e0188ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704330, "uuid": "7a92e4c0-cc1e-4d34-8e37-01a550bbb8e6", "comment": "Malware payload (Mirai)", "value": "51263810b8d67cecb098ca24062a173e39bfbd43de9e50511f372be1661f28ef8074fa6dacd891827fb1f93a4259d8aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704330, "uuid": "f7a84694-bd80-4d13-92e5-37f14f43ed05", "value": "T1FEF0588EE42027C3040CEE0FB16348596026D3CDA4B78BADBDCE8569B8E8525F514A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704330, "uuid": "a06ffd09-20aa-40cb-a0be-b0a6b433f0c6", "value": "6:tfLwVIjXWBYzGgyx0FXWBY3SAjXWBYTNNIl5sz5XWBY3a0LKiSLSXWNM8NI3XXWU:tzwil39ThNIl5sZq0LKF6j3P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704330, "uuid": "1cc7e05b-d0f4-40d1-8c59-02c2c597197d", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704330, "uuid": "6077b23b-7e15-4d1c-886b-1c4596ac7f39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704330, "uuid": "4459a3c2-dd2a-402e-a97b-ab83dcc9d403", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae7e94b-7df9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755717037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717037, "uuid": "f762eaa1-ac50-42f0-bd2f-4d4e40f8a4ee", "comment": "Malware payload (Mirai)", "value": "cf7268c51df1702f56311a51dfa6b254", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717037, "uuid": "de2a6edd-50d1-4e20-b0d2-19d2d1b552bd", "comment": "Malware payload (Mirai)", "value": "706f3b53b62c36208fb1d2f363787fbabc26d096b222a2ff60e798398c376053", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717037, "uuid": "033eae60-5978-4eae-8531-9c89317e827e", "comment": "Malware payload (Mirai)", "value": "f5ad54463135bf776bcc93ace9136155a6856685", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717037, "uuid": "83ef4fe2-c301-4a83-862b-48ad42916db0", "comment": "Malware payload (Mirai)", "value": "59fdfe7b62ac38841302b0e5316f7db27f5756f6d2eb9a2afd051f243e7e5c33e2f38c5f8393678d8fbbe1eaf31bd7a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717037, "uuid": "107b8bcc-2e8a-4d2c-9ecc-513691afdd5a", "value": "T1E5F2E0DA929BE3F5EC3B5A7346E90384FA752402910793431C917B78D9A73A4DE60FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717037, "uuid": "bc71912b-2036-42e4-a740-331a7b48ec4a", "value": "768:3QJ/qVUDzktYhjDJ7lzxDnenk/d3PmUj5XUG5pwIv9sPw+:AYUDzkmhdnekl+Uj5XlpRFuw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717037, "uuid": "020d69c3-c82e-47a0-bf45-1c398bc749c6", "value": 35160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717037, "uuid": "7257a710-e13b-4bdf-87ad-8ed26cb01c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717037, "uuid": "14d65dca-b8d1-4d8c-9316-ed8b799c6294", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005e99c9-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755697128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697128, "uuid": "4de37d33-3032-4699-859d-52a50cf3ac9f", "comment": "Malware payload (Mirai)", "value": "8c0d9465dd8bf11c1abdd8a7f6d2aff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697128, "uuid": "06eee5b7-b3c3-441e-95a4-0737961722fa", "comment": "Malware payload (Mirai)", "value": "707d26bff1f2b3acca0fc218552ad879c3f03515c98eacc1087dd4a7e787d97b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697128, "uuid": "839194e1-bb01-46bc-b808-39175fd46cd0", "comment": "Malware payload (Mirai)", "value": "cbe7a44c3e7ecfeaddb5ab0ea399d6f9aff1f05c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697128, "uuid": "e6fda2af-3909-4624-97d7-62e3363bb151", "comment": "Malware payload (Mirai)", "value": "dc8bd873b9d1f2eb9f3d2b38dc072c2cb819f58ba2615d1f398ec764577a8bcd5955f14d5bb6edd92b07d30d02fc298e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697128, "uuid": "768a2479-d9df-47b9-8ba3-cb178f7eb89e", "value": "T15704E81AAF560FBBDCAFDD3306E90B1139CC954722A83B363678D524F54A50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697128, "uuid": "d23bf1b2-0162-429d-a63a-3b6fafa09514", "value": "1536:RGMSSsLsPTTIgVSwmyasURKip9yDFzbwplCWtjRqG2a1ZwQP4Vo6VLg+ZiA3nNfh:RGMSSsLsPPS467pkO1P1SHVL3iWL3iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697128, "uuid": "c3579a27-39d8-4668-a833-a48c43b09fb9", "value": 177896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697128, "uuid": "a4f3fd06-f2f8-4ec2-b7fd-fe8e807aa637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697128, "uuid": "117060a9-827a-43ef-8f07-bf5288a91636", "value": ".upstart", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc90e0d1-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755678170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678170, "uuid": "00b9c8b4-b870-45fe-b56c-ce83a1ce33b7", "comment": "Malware payload (Mirai)", "value": "a43d93b64c844e0050e874c3c1069a37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678170, "uuid": "3748929b-4c84-4e15-8724-fae40ba9aed6", "comment": "Malware payload (Mirai)", "value": "710873a7ea5fc11bc617de7f2002d45c823a901638302c1ab58b0135b9047b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678170, "uuid": "23f86617-e291-4efc-8920-cc0851ed1b2f", "comment": "Malware payload (Mirai)", "value": "ff3668fc9f7be330f6a4e660b9e150b9d9d731dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678170, "uuid": "28a68c1b-7cf0-45c1-b14f-9e65c6e763ef", "comment": "Malware payload (Mirai)", "value": "800cddbd8e3bf65cf509d5d4ddd5be4a6b698f4f2bc5557b68b928f736fb8cfe322bb3ec50c577f67cc6ba6adbccef7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678170, "uuid": "45b10b50-ca0b-4b63-891a-b93e47faadfd", "value": "T1A4834C91BC825A13C6E513BBF66E028D372A13E8E2DE7317CD15AF2133CA81B0D67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678170, "uuid": "f0485df4-0755-4f41-ab43-aae9a11033fa", "value": "1536:Li7G1hswhTnGb6WuDAo/ay+sOCHyjQOhv26K8v4yxtZymi:Li7Uy8TVYoiZIHyFhOW4yxtZymi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755678170, "uuid": "d611bc1f-3e85-4f3d-a7a8-b6dacec2e643", "value": 83956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755678170, "uuid": "59ce48be-745e-47fd-86f0-dfdba04d2432", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678170, "uuid": "93778b7d-e8f6-49e4-9fac-ad5fa43fe5e3", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f785dbe2-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703556, "uuid": "04e7b87a-a0dc-45ac-b726-de2abeab12b0", "comment": "Malware payload (Mirai)", "value": "7f9e6e989030ea0c3fe76d3f56eda31f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703556, "uuid": "43650d86-90d1-484f-8336-77715e7770df", "comment": "Malware payload (Mirai)", "value": "71750d7679f140d830bda8d4c5f52536bb413c2761e5623b5de3626137bd1e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703556, "uuid": "d91ea82c-23a2-478c-bd79-87ee82350dc2", "comment": "Malware payload (Mirai)", "value": "9134d8a9540cb1b40da20cb4f80f13ead0807b03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703556, "uuid": "42282fae-af01-4078-9610-6a54968954b5", "comment": "Malware payload (Mirai)", "value": "45c4afac2ef9bc7a7a976655055116d5e47caf2ab30a650f6f59bc81a827085eb648ee4bfc158f3a3b1559c4bdd52325", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703556, "uuid": "701b101f-eeab-44b2-b791-d76482d70fdd", "value": "T1B6A34129FB521F73C88BCD36109CAF022D9C56C63396B7267274C574B9A711B2D93CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703556, "uuid": "13885a52-01bb-4803-819c-608eb7bb346b", "value": "1536:qSeskykMPGNOkxvk/khNGe0leMzuAVXAnHFZMRBLHrqY98gFqgtymP:qSeskykMPGgkxk/khNGECVqJgLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703556, "uuid": "27553d6a-7240-4e5b-bce9-85b601e5d364", "value": 105024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703556, "uuid": "d4e89cc3-0a66-49b8-9bdc-30899659e43e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703556, "uuid": "560f7e54-f9a7-4e0c-896b-3d7f78c2094d", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0570f8ac-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701861, "uuid": "962cddf7-9789-44d2-88ca-7df07afa6e80", "comment": "Malware payload (Mirai)", "value": "db71f1f1d3ce2014578c3ce104b2e0a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701861, "uuid": "b1e31bd2-76d0-4939-ae56-b74b8f6e4f23", "comment": "Malware payload (Mirai)", "value": "719930bd0437838f6f172b05c2944b80e49a8287ed9fc92c3966c530429a00ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701861, "uuid": "084f2e73-a40b-46aa-abfc-c55d83f054bd", "comment": "Malware payload (Mirai)", "value": "e4f634bb4f16cf73409308f35e7c41bea0bb353e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701861, "uuid": "badfaa1f-b40e-4024-b928-7272863ea35f", "comment": "Malware payload (Mirai)", "value": "ec5aebe000af77b8b4c27a199743597e3d72098b6c7ea4801d661f2818e8a5d54e43d9abfc507f17e10961f6c934f554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701861, "uuid": "cb54573f-d88f-4eab-9832-305ed0ee439d", "value": "T135C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701861, "uuid": "acdbe72c-ab06-42c7-952a-018f86d247cc", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoOrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIOrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701861, "uuid": "4108a56a-49e5-43c0-872e-b938a82ecbcf", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701861, "uuid": "0a0f934d-68ee-4b78-bf89-45ca46c89508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701861, "uuid": "aa5f5005-64e1-4386-91fc-cf6cd0a5ce3f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d37711-7db8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755689192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689192, "uuid": "29ee09c0-fc50-4fe0-bb1f-d7b5d2caf942", "comment": "Malware payload", "value": "448a73d92c9861123b4fa4aee3512d77", "object_relation": "md5", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689192, "uuid": "8eee2a62-3d4a-4957-a77c-5e2eb3b63b50", "comment": "Malware payload", "value": "71bd115560ff11f812f43054bf0a09a6a5eaf326fa0f274ef7653c2a4d976f89", "object_relation": "sha256", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689192, "uuid": "d61426bd-842c-48a8-8607-960c563c8c07", "comment": "Malware payload", "value": "d698c0ed6f9d2ebbf03bb2ee6adac7260ce59462", "object_relation": "sha1", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689192, "uuid": "91c82032-f560-492a-a18b-572935243517", "comment": "Malware payload", "value": "af17157f1a4fc85722b94b15574ca2b5ca8753f302342f417cc1c9ea58f8e696be075c65b7545c54eb7df55d86269a88", "object_relation": "sha3-384", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689192, "uuid": "da2afa65-e308-43ff-ab3b-f0573645c31b", "value": "T15EB508EB615C96E9F57DAF3ED0929B40983FAC77DF32C4DB329035689A064C04E7A610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689192, "uuid": "aa33b187-b962-4cc0-a98c-44d6976aa2a1", "value": "93f34819d960e9f18a426808b2fb49dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689192, "uuid": "eeebaef0-0df6-4ff5-ab24-0e55385444a0", "value": "24576:o7jzhIHR+ArYIxoxl/7C3yzMxOhg5nyQ:Kjzhw7rPuxN7CCzMMhg5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755689192, "uuid": "e08bc8b6-62b1-4c23-baa4-ba47fbdddf53", "value": 2408448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755689192, "uuid": "1f87d993-23c6-4272-af04-9a5c881fe088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689192, "uuid": "9c48bd94-af6a-49aa-8a2f-0a96525a051b", "value": "71bd115560ff11f812f43054bf0a09a6a5eaf326fa0f274ef7653c2a4d976f89.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b7ea33-7d89-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755668866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668866, "uuid": "5ea1aeef-d491-4725-ae2e-2aeadb9d0ead", "comment": "Malware payload (AsyncRAT)", "value": "4eb1dbfdb72a87379d7654dc64247695", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668866, "uuid": "84ecb1f1-6093-43c1-9eac-f30ad6268398", "comment": "Malware payload (AsyncRAT)", "value": "7227f318d4249cee1b216cd4ec0e0d008872850a1457d729250bd76cbafb93dc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668866, "uuid": "491e4efc-9d4c-4ca3-9e30-c85b5d62e67e", "comment": "Malware payload (AsyncRAT)", "value": "07b1d7723014055883600a5418043d1e49799b5f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668866, "uuid": "4fcbff15-b80c-42bd-a635-855b13840ddd", "comment": "Malware payload (AsyncRAT)", "value": "fc6d4ebbbaa71587e8a8eef48fde84b2dbba496b58c444ed193400f9f3b74fbe365b85dbbf47c5da7215ec3f8980c7fc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668866, "uuid": "1105d362-ace1-4c1f-8357-519ecedbd3ff", "value": "T1E0837C687BE50129E4FFAFB01DF07152C73AF6636903D15F14D9028A0A2B685CD91BFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668866, "uuid": "752109e6-be9c-4c69-94da-83b8ad1e6dd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668866, "uuid": "aef51be7-97a8-472d-9158-7cc5cc9679db", "value": "1536:ic5plsuiS7uzgmkasegKGxfjLLfjEEbYRruV86aQZkONPhYddb:icxsubC8hasegpj/fNbYsVdkONPhYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668866, "uuid": "976772c4-d965-40e1-97da-e9068057c93a", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668866, "uuid": "9faf6c49-173c-41d4-9c10-e43ab7a9711c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668866, "uuid": "efaabbc5-4cab-4966-a9b0-9883cdbd9c41", "value": "RC7_bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65184342-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755671098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671098, "uuid": "00d81ee3-3513-46aa-9a19-e2dad68f6fac", "comment": "Malware payload (Mirai)", "value": "3732a22deb1972af6e8fea318cc23f74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671098, "uuid": "30d5a323-3428-4e6f-8df4-d00350cfa4f9", "comment": "Malware payload (Mirai)", "value": "72854a8a556bcc78833b414e1e1311e289feeaa70e3189db0cf6dafdf69ceee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671098, "uuid": "ddfc1427-b316-40ca-942b-b11041fe6665", "comment": "Malware payload (Mirai)", "value": "8ad8221266604fe11bf8d600f469e58e584775cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671098, "uuid": "10dd1bdb-be00-4560-a96e-b4896dbc504a", "comment": "Malware payload (Mirai)", "value": "b94f236de2f48488d7829de6e58d6e02abf080db2cf6cf04a6b2d294ec1fecaf655b5388eae0bd6bc7b24d36c9047705", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671098, "uuid": "a5c058b0-07a1-461f-8b31-67bb62baa807", "value": "T135B35BC5FA43D4F2FC4705B11036E3329732F539102AEA42E3A9DD36ED56A51DA1A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671098, "uuid": "73426dac-f11f-4a26-94b4-455e128d0b2f", "value": "3072:WlX7gSezLcL2bwA+6qRtl0Ep4GMeNdTDV:WlLgSezLcL2bH+GrwTDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671098, "uuid": "ecc879bc-fd92-41cb-8c87-26654e4dc4fa", "value": 112844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671098, "uuid": "3391761a-9d2c-489e-a887-cc0956acf366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671098, "uuid": "2dfa97a2-dd9c-47d2-9548-b156399aa21e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeec4028-7d6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755657048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755657048, "uuid": "08fcff1d-0c7d-44cd-bfd8-7d7fe4981077", "comment": "Malware payload (Mirai)", "value": "b40cd76ae91acc1d7870b65ec2d8383d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755657048, "uuid": "a8d5047c-6588-4f18-8222-0feeb08aecc1", "comment": "Malware payload (Mirai)", "value": "729c64b588b4d4413cb9f50ee0666564dcefe6c6642dc0c4e36c3377d6499fcc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755657048, "uuid": "3f5291f7-d39a-4fdd-8c4b-c67c9ef67aaf", "comment": "Malware payload (Mirai)", "value": "b3353b618d8c3550852da159c1e439715d979f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755657048, "uuid": "f11e53b9-a73c-4a97-a391-72e985c95daa", "comment": "Malware payload (Mirai)", "value": "8dbdad44db3448023c88fa33c773de3dc854fb487a552180fd6eb8c6d8acd124a9fa2d9ac9cc9b250807af4f6c107b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755657048, "uuid": "db84140c-872a-471c-b8ad-bf5aead66e04", "value": "T1CF835B8AF743E4F0D95505B1015FE7BA8630EE725160CC6AEBD4BE75AC32912B11BB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755657048, "uuid": "8d4d73cb-bf9d-4395-8e27-06f5d10e8b5b", "value": "1536:WVLDP59aTyXRzbtQoVQWKS2oBufGhHjUY31AYxzqVgIAU3fr:k3XRzba0QSBuf0KUkPAU3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755657048, "uuid": "cb780d89-462a-4555-b292-2477ab6a2ff3", "value": 87864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755657048, "uuid": "6a920c8d-35b0-4b13-9c90-9314219fecd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755657048, "uuid": "08bd2028-883c-4479-b82e-fab2e8e1f493", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df179095-7db3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755687194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755687194, "uuid": "bd693873-ae69-499a-9f4a-36c8f6e72157", "comment": "Malware payload", "value": "027bba666d9b5ac6adc722b7452c470b", "object_relation": "md5", "Tag": [ { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755687194, "uuid": "9bcd02c8-51d8-480d-94de-d450702dc661", "comment": "Malware payload", "value": "72f81cd547fd88325918025b7044e155c05c0410b0faa3d4a79f0ef865a5fae7", "object_relation": "sha256", "Tag": [ { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755687194, "uuid": "62ee3610-1c1f-44cf-ad3f-57c0642fe983", "comment": "Malware payload", "value": "2cc87527e50aeee77ce8193486a75cbd50eaffdb", "object_relation": "sha1", "Tag": [ { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755687194, "uuid": "5179147c-ae29-4bcd-ac58-a775ff18a1b9", "comment": "Malware payload", "value": "63e354b79f55fecb2d690637b7354fa16b158e3d7fbaf4c730bcd3367f29cd24f3ae8558ba241d83ea5039496509d5de", "object_relation": "sha3-384", "Tag": [ { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755687194, "uuid": "d22bb446-f643-48d0-b285-3960d0b3a780", "value": "T14D1633F1CFCA9E266A32EE5EC65338D429C758FA565AD0148E73305BC40919B4B0E7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755687194, "uuid": "2d02cede-3fc9-4a7c-9f1c-229a2ba79a37", "value": "98304:bDz3/+j7Vq/3QE+wxuISdmLzW66z/b1kSIPgnxeWCQdfQM:bDz2PCgiNmz/b1kpMsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755687194, "uuid": "5e6d5805-008a-42fd-87f3-b529b4891202", "value": 4056124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755687194, "uuid": "3ba63c90-013d-412a-b165-a14c51625200", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755687194, "uuid": "ec043736-df6f-447d-be9c-a172d59571f2", "value": "universe-1733359315202-8750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586d4a21-7da6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755681385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681385, "uuid": "043c681f-ae6b-4ce7-b470-e2e22603e167", "comment": "Malware payload", "value": "dc207ba664993a9bd090b4731b176ba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681385, "uuid": "7ac0ec1a-fb89-4f0f-aab1-5a65103f7f40", "comment": "Malware payload", "value": "73614d75c4f6369d3c3d58f2618b8a59c56db4f0e26d65ee507aabaf1ab2fcf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681385, "uuid": "27f313f8-74f9-4060-8c72-e496b667d45f", "comment": "Malware payload", "value": "583e6a81f92da1ff3b483b4a138ef3b8f88a97df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681385, "uuid": "b8ab7196-cc9f-4950-8c7a-9eac5834fc3b", "comment": "Malware payload", "value": "eaec9f5d4fd555dfca61af40e5bf8f0f9dc0070d49bdcf73b1ec1127b09e37089671fe128df2b31b16629e187bab6a1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681385, "uuid": "eca824e2-fa2c-4815-8ab0-d3a72aacac98", "value": "T14C77129366E800D8D46EC1398156423BD3F2BC6E57F28BDB06A56A751F73AD81E3B310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681385, "uuid": "115c6ea5-1b7e-471f-8bab-955bd498e0f9", "value": "500dfdd9f12f204a85217c1ff0e74936", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681385, "uuid": "9c239a15-d078-4b39-89b9-ab5e9351e81f", "value": "786432:oWG1s9ggLqsR9IEWPRWx4o3hRZM2bI/UbJPYfNOFGN4h:RG1Yggujrcx4o3hRZtsOJ8bC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755681385, "uuid": "38cba9e1-69bd-433b-a866-af47d5ae3d0f", "value": 33471520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755681385, "uuid": "67b42d93-4aa9-44cf-988f-b84bc7a1dcff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681385, "uuid": "42bb3510-db28-4eb2-bc7e-520977b89975", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe92362-7dfe-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755719139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719139, "uuid": "7302ad10-a987-4aee-8260-8ed101564ac7", "comment": "Malware payload (Mirai)", "value": "d4240259f60345f900d78838f1c49069", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719139, "uuid": "759bd605-01e0-4c5e-9a15-03ec0a6c143e", "comment": "Malware payload (Mirai)", "value": "7369199656c2034d43f3c0bcf9e7e9a7b8a0851936ae169f458a78257bb5442a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719139, "uuid": "c36a267b-7a20-4ba5-9331-ee1f37df9b65", "comment": "Malware payload (Mirai)", "value": "d813044f403502b312bc5f4178873dc8ad0257ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719139, "uuid": "83ed382b-9218-4325-95b4-0a61b718fdbb", "comment": "Malware payload (Mirai)", "value": "768e699af356f16e039a4bfccc0b350f66f6efa1051d28e8e03f4f0304f9ce0b80c996462a82fc19e39be0d1f1138eae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719139, "uuid": "5f293361-1bf1-4cad-8981-8838040ba326", "value": "T1EFE2E120D175AB90F9AACCF068F97BD1A6C08E9F7266CDC23081DE6A19610391415FF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719139, "uuid": "6acdafe4-5aa4-4812-8d77-9d8c8dc188b3", "value": "768:fb89Htkaq+Fh/dkixtMW4WFOXwVnPWTsBSSN7o4uVcqgw0RTWXD:A9uaLZbGBXo+mSSZo4u+qgw01WXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755719139, "uuid": "29dbc9f9-3e1e-47d0-8120-34944bfed8ff", "value": 32320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755719139, "uuid": "7bd436c2-17e0-447c-8236-54c77594bd1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719139, "uuid": "9028b74b-7c55-421d-bc2e-2c3000a095e3", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c787e2-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701801, "uuid": "b537727c-c0e1-46db-ad93-8a1407430aab", "comment": "Malware payload (Mirai)", "value": "9660a4c3218aa55b80477d5b57a11063", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701801, "uuid": "bf1a12b5-a373-43d1-a4c5-ff62365ba07e", "comment": "Malware payload (Mirai)", "value": "73fcdeb4b8b936726c487fbd618c369e6791cd0479b9416e824e0672146b389c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701801, "uuid": "c0822d3c-2b25-4fd9-8a38-a2c87f9d82e4", "comment": "Malware payload (Mirai)", "value": "6c99e5422f84f0f7147239f543743d41f6c3b719", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701801, "uuid": "358fcbb1-e6f0-4e93-bccc-b6c1fb813e8e", "comment": "Malware payload (Mirai)", "value": "92abcdc99b97c59db4cd58e29ee384ebab45ed1d344c9d422c0cb1f40d3ff6f4693a90d931fcfc65622c6e1c4c5e14f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701801, "uuid": "6e0962ed-9144-4e14-9b1c-85dfa56999fc", "value": "T173A2E11572A32D66E3ED1C3DC96A8317F9A71BFC90F5327679412620CD4D20A3E3DA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701801, "uuid": "da1e396c-1f3e-4f10-bcf5-ba53adc51e0e", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxj4hymdGUop5hj:vvQn4j+ZO5fKAlxMs3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701801, "uuid": "d372f559-ff11-4641-9b15-3bedaf801d02", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701801, "uuid": "8fcab815-8233-4115-aa7e-bb1802ce6341", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701801, "uuid": "d993e48c-65b7-454a-9517-bb478d6f401a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079805a2-7dfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755717756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717756, "uuid": "c2369578-b94b-48fd-bbb8-58da0ec8a7ea", "comment": "Malware payload (Mirai)", "value": "9c097697ccaa250003a06d03c06bbe3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717756, "uuid": "1b259ab7-4fcd-4872-9ea9-d4dfd62d1421", "comment": "Malware payload (Mirai)", "value": "7466c52fac6820090b8010a0f7843431482024a1d5afd9cea9ef31bd93346820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717756, "uuid": "3e7c7ec0-3635-4010-984e-5b50e2bd936e", "comment": "Malware payload (Mirai)", "value": "1c46df617ad1bd6a7a72c2f7c8b965034899e6e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717756, "uuid": "61866d51-c536-4026-8608-f987382eaa27", "comment": "Malware payload (Mirai)", "value": "2a248b9a20034b3b90770fe0c13fcb7398bd1c40ab7f5a57a80130f09edfe1edc9259c535b6763d8409ee112afa3ae88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717756, "uuid": "59b04b64-54ea-402e-b9ef-7333eba71439", "value": "T1F6D2F2E1ABCA9431C8705D78E3528592BB7F4B7489CE7642EB34BD20C6D45091FD99C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717756, "uuid": "033f4985-57c9-4711-bfcd-13424b986ef8", "value": "768:bSVKN07LN/mTxXku0L6KIsRHHixR+c+73a8r3U3o:bB2kiM6HqkcSa8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717756, "uuid": "3f425664-9ecd-404d-b13d-a5d48b8b3b0e", "value": 29832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717756, "uuid": "5a437fb4-ec16-4200-a6fd-ed52131bcd01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717756, "uuid": "8cc06c98-3c74-4a9a-b61d-21cbc0ed28ce", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448a9bc2-7df9-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1755716999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716999, "uuid": "37345ca4-b4c7-4d35-9c38-c48e4b9129a7", "comment": "Malware payload (njrat)", "value": "cc5f5d0a746db1c88f930f63417e6efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716999, "uuid": "093160de-aaa6-40c9-841d-6aad9c944374", "comment": "Malware payload (njrat)", "value": "74d9bfc4faf8fad7595fbd034a6a963524bcccc10dad06d1676cadc86af8b571", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716999, "uuid": "9846ac60-9c90-4f75-8808-a8b1c5b0ca7a", "comment": "Malware payload (njrat)", "value": "cd9a543c1c1862644ba7a9c342084d306449f434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716999, "uuid": "43464505-38a2-4f78-80de-52ec539bf4eb", "comment": "Malware payload (njrat)", "value": "9a11854cf2dd69114affd2eff185a54e620ea7de347ca43067374ef225c26b572e26c6e671a970b4f4c4f48e3780f71c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716999, "uuid": "2b0f477c-f86f-4f98-ae34-28fc2ec8ceaa", "value": "T1CF033C0567DD423AE2BE4BB885F1524583B9E27B2513E7CB2CD001FB1A23BC6D9417E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716999, "uuid": "4a4dd048-f746-4d3b-9922-66710c2fa4ed", "value": "768:4PjzI2iWwKrGfmRfUGv2vEBRyr+Dj909YBB6SA8tv7yNW:4PjzIIlUGveEB4W9gYBov8tTyNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716999, "uuid": "de633c1d-6ec2-4f6a-8a27-9f6dcc756bf9", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716999, "uuid": "be9782c2-3543-4676-aefe-7b43c4507b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716999, "uuid": "2a890166-5aa6-4254-b98d-11566695a10d", "value": "XwormRCEprotection.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63f12e5-7da5-11f0-91c6-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1755681139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681139, "uuid": "64cdb211-bb92-49b2-9a57-ca104b105a67", "comment": "Malware payload (DarkCloud)", "value": "7988f4c097d30581be2a5ed1e53bfc28", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681139, "uuid": "fd32f8b1-0f3d-41ea-b1b1-f04c0ae441a1", "comment": "Malware payload (DarkCloud)", "value": "74e51e9bfcda3d5f68dffd663270186d62e547c47624b4923dbd2819bff42c4b", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681139, "uuid": "d971c24a-a362-44e5-8ed8-93179fb8ee93", "comment": "Malware payload (DarkCloud)", "value": "8f3123a8793276ec393fe2999c8815e3f25b3989", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681139, "uuid": "7fd7d8a5-7901-471d-a0ca-7265b12bd33b", "comment": "Malware payload (DarkCloud)", "value": "f30126a276a046bad1f42bde303c32964dd8ce118ad2dac28e81151c4a0cbd685fbd921e9cbdb0a82d481dd85c74038b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681139, "uuid": "591cb79e-8b98-4d31-9ce5-9b0d7510ed8d", "value": "T13F839307BA4A8DF2C6444736CDAF55CC0364D783B693C61A798AE35E5843FFA9840E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681139, "uuid": "8a89a58a-c058-4113-86bf-e237832765c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681139, "uuid": "03196370-1b98-4f92-a56c-3a9213ab9312", "value": "1536:aiWXODkLiF5KG4t7qSig4NW0eWbO5OMlnNZtKY:aaDkqREazVIMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755681139, "uuid": "9205de52-2836-4306-bc6d-b8a54f9525a3", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755681139, "uuid": "90448ab1-e442-4f29-b58e-3306d33232b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681139, "uuid": "bc074f51-c564-47dc-b51b-f5580738489f", "value": "Facturas pagadas, 3432157645, 6572545675, 2315768,35432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8689b414-7d97-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1755675019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675019, "uuid": "9a315bce-a440-43bf-a784-8f9f8ba136f8", "comment": "Malware payload (ValleyRAT)", "value": "de272bd2950f6dba4ecc8aa3e48ea0a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675019, "uuid": "fdde285b-ff6e-4742-9d09-74cec09d56ff", "comment": "Malware payload (ValleyRAT)", "value": "751b1642a2ee61474045f6cb932fdf8ad7321f70670d39af496e4aaf983f33c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675019, "uuid": "448921f6-70b5-4fac-b9d7-55b37189d46f", "comment": "Malware payload (ValleyRAT)", "value": "5f79238a5e4e368b6a7c74e651ad615c62c4c5b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675019, "uuid": "554ac9af-b2ff-4ac0-b48e-9647ae0978a0", "comment": "Malware payload (ValleyRAT)", "value": "cce956f85e282a0d48fd38a6dc80f034ff20a6929dbc7192e5f38053b2f7597f78dc24f4c093a8da6485e254f6d33b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675019, "uuid": "6fb1cc4c-aa0f-4c7f-9040-75a42f0bd0eb", "value": "T196B37B2172A0C072C093253199F9EBB24E7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675019, "uuid": "0f8fb6c2-64d8-49f5-a9b8-421a10345843", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675019, "uuid": "cd8c737d-9ebc-4eb0-9376-38db462f0bb9", "value": "3072:qbWjdIPbcia0NFtwwnILn3py6D268XEPKc2:qbWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675019, "uuid": "50711237-9d99-41c3-aa78-6f88ece2cf95", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675019, "uuid": "a71c50a7-b380-4f27-b512-82250d96d521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675019, "uuid": "eb04b583-881a-45ab-917b-9a4e8ae7dfdb", "value": "de272bd2950f6dba4ecc8aa3e48ea0a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1cabaef-7dd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755703117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703117, "uuid": "0d39a4e1-b780-422c-bb0e-fe8f64099f35", "comment": "Malware payload (GCleaner)", "value": "a9452a306bef9139dc7d80fb222f01e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703117, "uuid": "e21e3aeb-ce93-43c6-9785-3e9583a04194", "comment": "Malware payload (GCleaner)", "value": "75ebdbe16e4e04a657bb1a54f48b6951d1b0a191e79f27d2dbdbf2a4afe929c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703117, "uuid": "6902b06e-535f-4147-bb74-3134569147d1", "comment": "Malware payload (GCleaner)", "value": "5e2cf680e3d84c4d64393c2488fa52a5fb286b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703117, "uuid": "c2f8aa66-bac3-4036-a1dd-52f745b33f74", "comment": "Malware payload (GCleaner)", "value": "91152b0dd9bafd17b3e2fd8d4eacdefeeb34fae349a767e07115a39c1dff93f490debddd6ddd8ac717a67806fb86d9df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703117, "uuid": "44e365af-9ee7-4fa9-991a-daa8a28baf30", "value": "T13B06F122A0F195EFC04616B4CD9E62F5C5EBBF102B40947A6AB2D717C126ED1B80F53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703117, "uuid": "8ae8da9e-e3b8-4cf7-8a01-12f0e6d61847", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703117, "uuid": "4e7891e2-4c79-490a-8f55-8c5d928025dc", "value": "49152:VME5gQITN6er51QzEHXHeBpx86kg9XHLoCWkP3vC4F4LyJqecQAO66e7:VMUNqprExUglZLXCWeQAO66m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703117, "uuid": "cb033d45-e750-4f91-a416-8041151ab263", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703117, "uuid": "6b951b02-24aa-404c-9dca-64d2f04ddb94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703117, "uuid": "315d78b8-1e83-4eb9-af16-bf45985736bb", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a070ec-7dca-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755696815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696815, "uuid": "2e2d5757-254a-40df-a3d3-9c59eaf1e064", "comment": "Malware payload (LummaStealer)", "value": "36f10d5c1b8a2238f3421e55b637c887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696815, "uuid": "5fb4c896-f22d-412b-89b8-2b5bb47bf824", "comment": "Malware payload (LummaStealer)", "value": "764bbce45136aeabf2622abfcec7d7ac7fc4ff63120f313dabd5cd6cd03a74cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696815, "uuid": "d50da742-e72b-431b-a630-89bb700baf6f", "comment": "Malware payload (LummaStealer)", "value": "b3f1294dba16132269366a9edc1514926287606a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696815, "uuid": "250a254a-3a7c-4229-926e-f1219aa66bd7", "comment": "Malware payload (LummaStealer)", "value": "c3a14110f565687109f4dafb029c76284cec734992fed70d5f8c80b7ea9125d3868bc7d87261f095a4ff9b8d4fc7e4f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696815, "uuid": "23c1f136-ec81-45e8-a454-f270a2514d63", "value": "T11245C004D87970DAECD74071AF365201F8327D7F4F242AAB51DC96B11A5AEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696815, "uuid": "e7819f5a-abdd-4901-9ace-8299ece14223", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696815, "uuid": "dde24414-29b0-421c-8f5d-06abaf81fd42", "value": "12288:6CzxSeT4ZAtm8eKCk0zbVYmdh8EWcxassWJt12KfISmUjRQnepMoCDtm0nDj7aAO:6qHhP0Hccxas/JLDBgxI0DKA398", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696815, "uuid": "cbd5dc62-7c47-4122-ae6b-e5af6e9fee8b", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696815, "uuid": "6f9bccd2-0eb8-4d6c-aafd-f697eddda90f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696815, "uuid": "74ddd1da-2099-4c83-8534-f061bf0ca1aa", "value": "Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538aeb03-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683094, "uuid": "d965e947-4187-400d-9d3d-3db6942d6c93", "comment": "Malware payload", "value": "96491b22f59d4a4b64d220f5f1e03fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683094, "uuid": "5ecaa173-e43a-4074-857c-0073ff6fa7e2", "comment": "Malware payload", "value": "775990f291134eef95badc186a290a4f5ed9f317dcb02678ffa3670c9e7e855a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683094, "uuid": "f0381dae-ec04-480e-b6bd-66d6173293a4", "comment": "Malware payload", "value": "6c2b05a42d40682c1dc1f3d8436ce5e401e0de79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683094, "uuid": "a8e3a2da-f4f0-49ab-844c-54d46b72fdef", "comment": "Malware payload", "value": "4d4671a525f3a4225214df0d551bd4e078e5ede2625cf8af82673c9b5f370b8fe611bd206ea54e8a153614f6ea92e3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683094, "uuid": "fea07523-ecb3-40e0-8fe3-b21a88edd9a6", "value": "T107D3E513B32A01BCC1AAD27C9AA64A12F373785E13358BDF139895252F976C19E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683094, "uuid": "0fcd1dc9-2cf7-4061-ba84-f3570e9ef383", "value": "6c1bbb200918589f97156ada5cb2c2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683094, "uuid": "e0a283a2-28bf-404d-bf40-0f8014fa0ed5", "value": "3072:g60TBBAeklcXfyFkatIM10MVBZRws5Mor:g1TBK7Ga2a3bws5Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683094, "uuid": "80a244da-d54d-474d-9256-fa809f646dbf", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683094, "uuid": "2b6eebbe-d719-4008-bfad-9e21091d213e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683094, "uuid": "9301d600-49d7-4233-b26d-0623b688c1ca", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f3f2be-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755706560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706560, "uuid": "d2d9e32a-7ec6-4988-949a-4fcae0e43b0f", "comment": "Malware payload (Mirai)", "value": "a5aa128765871417f8cba8f2106a4c61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706560, "uuid": "d62ffadf-493f-467a-94e3-402a16d6d53f", "comment": "Malware payload (Mirai)", "value": "77bea9cd247260681168a657d48e492a83a988c1b6fa5b8074a63aa8e6a272cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706560, "uuid": "e52788eb-56dc-4150-9107-a5739832ef3f", "comment": "Malware payload (Mirai)", "value": "c27af3228439a896899601501d12123126644b6e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706560, "uuid": "61dce8bb-74d1-4a35-b6e0-05ad26fe3d7e", "comment": "Malware payload (Mirai)", "value": "520bafb2ae28e563d1bdb92cd9be0254da295b040d48db1c6d57223df7078854ba2b64f6e554524f3fff96c0f8bdcdf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706560, "uuid": "c2cb28b9-58cc-4be6-ae80-e13df611b246", "value": "T1CF01ADCD2BF5F6831A4CCE18B07B814CAB619AC0B1B10E56F1A89CF258D52043056FBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706560, "uuid": "51e04968-04d2-409c-9e6f-841c0973cdf9", "value": "12:3J3CEjQCSqQCKNIl5zAQC30LKjQOD+OsQO2CQOo/QCSEQLtaKAQ5jQliAQoyfAUR:3J3LINNI7rKFD+X2UorGtBiwHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706560, "uuid": "9cc3c490-0835-4fc6-80f4-3a1141e7ea6c", "value": 754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706560, "uuid": "88513118-a3a9-494e-a825-b2f28939c390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706560, "uuid": "c3353679-01f0-463b-9be7-0748c476f784", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088859c8-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701866, "uuid": "e0b2e245-0604-4589-bdbe-cb05f2057207", "comment": "Malware payload (Mirai)", "value": "65e8fb35951e7b0d0191b33bbc2dbfc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701866, "uuid": "d08a474b-02cd-42ec-8b56-679952599321", "comment": "Malware payload (Mirai)", "value": "7829a58159c23e7448074f9622df119e2ad841de1ce6be1fee030e12b707928f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701866, "uuid": "a3184ff4-5adc-40a8-8e7b-a6756a53a74a", "comment": "Malware payload (Mirai)", "value": "b74c4cc72a869109bfc792c455123f977999a1af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701866, "uuid": "99fa652d-f4a6-464a-888a-a99b8a92e64c", "comment": "Malware payload (Mirai)", "value": "0862357e2f031d7bdbaa9e564ab4eceac4274302ede2698ad40499ba7c91b7c28037e6fcecea083d3de206ad166cb300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701866, "uuid": "aa961a71-204f-45e2-8d39-8005064c3e98", "value": "T16B431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701866, "uuid": "58f1232f-f64b-4082-aafd-5349c10262f5", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701866, "uuid": "b9cecbf5-7d84-4e26-afbd-e01d1203894b", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701866, "uuid": "05033e13-35dc-4c1a-a352-39a860baa85f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701866, "uuid": "b8c46ccd-9d95-4c35-be3f-c731d87bc81f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04c05f7-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1755692806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692806, "uuid": "c69e7506-ee97-4e08-aafe-eaa16c6fb93d", "comment": "Malware payload (VIPKeylogger)", "value": "042050a0b0ec13c19ab5131c73d86293", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692806, "uuid": "968e49dc-8bb3-4772-adde-e5f0770ba0f6", "comment": "Malware payload (VIPKeylogger)", "value": "78465ea1603affda4e6da3343787105459746c6368a01e2431064770a7312c14", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692806, "uuid": "5f8ddac4-92d8-41b9-a32a-79023f2a4240", "comment": "Malware payload (VIPKeylogger)", "value": "3654e24d1912641d2f498916d14c14b99a616bb6", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692806, "uuid": "3e775d27-eeb6-4b18-9b33-ae6d4e735f0e", "comment": "Malware payload (VIPKeylogger)", "value": "1c43385c4a9355557ac6455f84cd182f04c37da1451284a85ff897edd3081c65fd83c6be7df9c8982435712023485544", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692806, "uuid": "4cbc808c-b1b7-4f15-8108-fc52afe3de5a", "value": "T1AD9533715EBE435A8DE8E94CCE807695499829A8E179B8E31334FF91F9B095DC90330B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692806, "uuid": "eaedacbb-4853-43a7-afd6-74e3e45eea6b", "value": "49152:FNN2Zu5RkqIK5or0HIriSxwG4Pj2Kr8MBc7:A05RkqIK5or0AxwG4PCKrBBc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692806, "uuid": "947e0846-caa3-41a8-9a2d-b8282164514e", "value": 1904801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692806, "uuid": "5171cfa7-212a-434a-b062-5d89f8e81e58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692806, "uuid": "bea88970-7c0b-4f64-98f7-89d6dfae059f", "value": "EGE SERAM\u0130K F\u0130YAT TEEBI - 20.08.2025 Usual_siparis.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53378f0b-7e0a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755724325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724325, "uuid": "d5c8dbc9-9377-42d1-a995-e990631e15b1", "comment": "Malware payload", "value": "2df7cc375ca40d9b11ea25cdd2f62195", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724325, "uuid": "d0044a31-199e-4a92-929c-cb37bb33fe1e", "comment": "Malware payload", "value": "78a89bf30ed860009239e040d1badfb8135afdfb7e877b1c9cbf00f7ccdf637e", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724325, "uuid": "dc18b972-9661-40a4-abf6-1e028a50507d", "comment": "Malware payload", "value": "edbf7701d4822f0999bb7511abb8f9c9bdab2b2b", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724325, "uuid": "fb331c34-667f-4c93-9e46-b71a706d4941", "comment": "Malware payload", "value": "ef0c68a7382191e937d6f02e382603cefb837836c199b000847a6843b47878b8bf1dc252379fe130e7d5064fecc37f4d", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724325, "uuid": "2e1eacc5-1553-4f71-977b-d2fec71eac97", "value": "T10784EA1F0B55CE52F3D162F4ADA4FA1C9774B22C3BAB8B31D97618A87B6C740BC1A111", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724325, "uuid": "b9973cf2-121d-436f-9c44-31aac143ad17", "value": "7c811d10f5c7c6354fea8ce32769acd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724325, "uuid": "73783133-2f98-4079-9a1d-c655a2e0e00c", "value": "6144:HrYtpIGfsqYfVO+d0VYuGV+xyHWV5qxeQc7RpynGR40KsFuuR:HUKpqwVOULS4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755724325, "uuid": "f5d0edce-35f4-4ec1-8268-8569eba97130", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755724325, "uuid": "d5607a02-f102-45f4-9a8d-fc13a3d82de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724325, "uuid": "52a91456-e893-4064-be83-3a9785150fe5", "value": "2df7cc375ca40d9b11ea25cdd2f62195.virus", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e949a897-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721571, "uuid": "b9a86631-3136-422b-b08e-57571410731b", "comment": "Malware payload (Mirai)", "value": "511d9714c90340611bbd6010287a5dab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721571, "uuid": "c21588e1-b1bd-4846-98ee-a375023ed838", "comment": "Malware payload (Mirai)", "value": "7967ddd9aac3e26d0ee742f22cd39ecd52eed218576fdcefb60a827d1603cf72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721571, "uuid": "547004b6-371d-45d5-949b-a630ac416b1e", "comment": "Malware payload (Mirai)", "value": "6ebb9ad04e379cf4d6655672b156a8e572494456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721571, "uuid": "52de23fe-8828-4a04-9c05-60b39cd1369a", "comment": "Malware payload (Mirai)", "value": "923ac348f1f2c79b908f012315a267a047f9c446a36b288111c128e254be2d4e220f0c9575784bb8bf8bcba91ce1d5c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721571, "uuid": "3c203625-234d-43b2-9a93-b87d0257ee8e", "value": "T12CB2D019C0AE2EB4FE9B7E355941E2817B619FDF3A61CEC01AC16B010622D2C1F986D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721571, "uuid": "1d4828b4-c7b9-4525-89ed-ed2e06cef66b", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIoiBM4uVcqgw05VxU:2AApCdvwJr69VJoA8FZtxCo8Xu4uVcqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721571, "uuid": "d3899e3a-6d73-4922-8cf7-d80557acc8dd", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721571, "uuid": "3bd1adc3-087d-4761-a4b5-ba2c24deaab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721571, "uuid": "ebb8c925-d898-4445-b6b2-1d9aaf46627d", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4fae92-7d9a-11f0-91c6-42010a9c0006", "comment": "Malware payload (SkuldStealer)", "timestamp": 1755676318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676318, "uuid": "4a8beb21-65e0-45f6-925b-1e797ada1ed5", "comment": "Malware payload (SkuldStealer)", "value": "a0765b7f130ad93bc3d04e93bfd66265", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676318, "uuid": "c256f6a8-c9fc-46c2-a9c9-13975bf2743e", "comment": "Malware payload (SkuldStealer)", "value": "79add679b6797a46a69d90e7cf40ae91c886e5956602dbb8a4b71dbbf6754379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676318, "uuid": "34fc874e-d4c8-463f-84bd-f622ceb35119", "comment": "Malware payload (SkuldStealer)", "value": "37b7b857816e101ef1c6db38404fa71493d9ce4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676318, "uuid": "05aca18c-649f-4126-9311-1d03b482bfcb", "comment": "Malware payload (SkuldStealer)", "value": "ef1843e28489cae715120d6ac812c010742a12fa3f7b8e4736161158923020c2f6b69075430134801cd87f9cbd863d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SkuldStealer", "colour": "#CCA511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676318, "uuid": "34b92cde-e594-4297-9ad0-32a9411b288a", "value": "T189F533B43801DEC4D2BD87B9ADB742F1D5523CD5620DA49C7BFDBA32081C628A85BF25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676318, "uuid": "e6e1f4eb-3806-431b-9e46-d999d20a30d3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676318, "uuid": "7f94a589-1885-4022-b39f-55fb873d40a1", "value": "49152:6uFkN8pFLPp9i+n8RTLZTGMhKuHF2FKehaWl9B2GWR2fhVAHHHeQh03tri6Z:nRn3n8R3ZTGgKuHVYaWdEMctyBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676318, "uuid": "fb6d8b8a-e20c-4996-9e1b-8763ff44f553", "value": 3404288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676318, "uuid": "91c312b1-3693-4833-839e-5c8d0a75ca6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676318, "uuid": "b45e0ada-819c-4e7c-91db-8ff40ef5f720", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b643262-7df0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755713199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713199, "uuid": "47492374-72c4-46ec-bcd6-33d1711a4cf0", "comment": "Malware payload", "value": "bc249760f92a0c485b26e2ce1989b4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713199, "uuid": "8da905d1-e0b5-439a-836c-d998873badd0", "comment": "Malware payload", "value": "79c1208ea20d614982de1d6f8b1c1db6ff323b04d95ddae90a524fbadaacc052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713199, "uuid": "4496ea9a-6e71-4423-b940-0605add30ba8", "comment": "Malware payload", "value": "455a72414d9f2949569e3bab1493f7625b565ef8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713199, "uuid": "2dcb3ccf-c3fd-440f-ac1b-1d673ea646c3", "comment": "Malware payload", "value": "17e646bc180cfa4e356cd06b378703d58dac5b7dddfafc20855d1200f6c57577207fc1db0b3f29cf10e58d54755307b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713199, "uuid": "cbad6c85-c65d-4b47-a0ba-e8c8b226cece", "value": "T19575E108A87990DAFCD340716F359151F833BD7B8F346A9B41F89B601656EED0A3E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713199, "uuid": "a3a9e4a5-f585-4d00-a201-c747c241edf1", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713199, "uuid": "e8c45d0d-9284-46f2-8b15-75fef6d64e18", "value": "24576:cAgGqsICddG7l/zd8UoA1deThPJfInhWoLoZs8EDeWavQZUspdht:T7qpCddClkG8IhvIEZaIZJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755713199, "uuid": "24d2cc4a-58bc-4a40-b727-48f9f92335c9", "value": 1551912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755713199, "uuid": "ddcf6bcb-3cde-4e75-a551-a3f5f9ee254f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713199, "uuid": "a4bc3d4d-df26-41a4-8d01-305e35d6395a", "value": "Arly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57a318f-7dde-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755705646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755705646, "uuid": "2a5d1784-aecc-4c38-83c1-d26c0b6819e2", "comment": "Malware payload (XWorm)", "value": "304b9ac6805ebe0767c4749fe6f2ea6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755705646, "uuid": "07dec636-da53-466b-96bb-d98c4f1aaebf", "comment": "Malware payload (XWorm)", "value": "79cd8186c3abd8a83890cda9839f6b09b5129c7b0d2e989212a1230613ad2253", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755705646, "uuid": "11521da9-d94d-4f7a-85fd-f98109f7e5d1", "comment": "Malware payload (XWorm)", "value": "06a6c111c3718f91d07a7b2ee69e93c6c0ccb3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755705646, "uuid": "96d0cc36-7614-49f0-a03a-8e0a7ec6db34", "comment": "Malware payload (XWorm)", "value": "ab4a547a2a743768f36c6096500a668832a2e5ea47095176fe71d885ea26c8a6c3d8eb435f7c84c60555e6a947ca5d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755705646, "uuid": "e35ca7d0-4324-4340-8732-715dc14373b5", "value": "T10A035C48B7D44219F5FE9FF05A72A5460631EA07E813EB1F0CE595DA1B37A808E107E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755705646, "uuid": "9bdaa99e-b220-4a68-a204-d5ec66be0cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755705646, "uuid": "aaf808f5-4fa2-4d79-b5be-f85354d2d590", "value": "768:lGdr/PEH2jl2R3oFPp9OTOphPJzZQn4K:wdLqYFB9OTOpVJan4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755705646, "uuid": "cad3eb2c-eb9a-4188-8601-b6c4ee0ac9f1", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755705646, "uuid": "6fe42e69-b553-4a01-9fab-7cc6a6c84d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755705646, "uuid": "bfda923a-4a1a-47ef-8ca8-cad79d1c27f0", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d750b06-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755678011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678011, "uuid": "54703992-ae9c-4e76-8744-ed32a3fd1741", "comment": "Malware payload", "value": "0d8e9bc3e756cb42079a3c23b1c6d067", "object_relation": "md5", "Tag": [ { "name": "84-200-80-8", "colour": "#02CD4B", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678011, "uuid": "1304acd2-63b4-4312-ab61-099ef9995860", "comment": "Malware payload", "value": "7a648396c2933743cb273bb1b1be5eb206740a4d6e423672906591ca08fcd5da", "object_relation": "sha256", "Tag": [ { "name": "84-200-80-8", "colour": "#02CD4B", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678011, "uuid": "46fe5cb1-3a07-446f-ad9c-61c5cd6950d5", "comment": "Malware payload", "value": "3a597712b006bd90331e4691dd2f29f17e9d24d5", "object_relation": "sha1", "Tag": [ { "name": "84-200-80-8", "colour": "#02CD4B", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678011, "uuid": "1fe679b1-a015-4464-80ed-3470b01de019", "comment": "Malware payload", "value": "f5b1555559f359c99741c05428855a54b59cc55cf2b1d0369c07077ed96cb02e8266754750415b5fc92a8ba7d1b5a1e0", "object_relation": "sha3-384", "Tag": [ { "name": "84-200-80-8", "colour": "#02CD4B", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "image", "colour": "#9BD3DC", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zipped", "colour": "#BC8083", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678011, "uuid": "31f09433-4248-4de0-8a78-0cf9d33a65df", "value": "T11C9533A92A792463A85326F164F11E7259DDBC0AE77B2100A99FF0CF7B0C715393C786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678011, "uuid": "d249ebc4-7407-43cd-8799-af1b19595184", "value": "24576:AyS36Xt80rM/52VronM+70bviF3OYpL0QQMAi0RL4DPqFUwPkM9Wpr9YNfwf8i5A:A7qw8VcMaZF3kRc6psOTfwk9R35rjT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755678011, "uuid": "2dac4c8b-f932-4fa3-b446-6f94f0145eb4", "value": 2013343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755678011, "uuid": "610f5472-fe68-46f6-95f7-f2fea890ef48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678011, "uuid": "6806ce93-6f21-4810-bb43-ca92ab4273be", "value": "84.200.80.8 stego.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21df8fa1-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755670985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670985, "uuid": "6b79307d-d7ed-4731-8f11-1f980357c82c", "comment": "Malware payload (Mirai)", "value": "3fb664820e8274d80bdab27b437e1a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670985, "uuid": "73dc017f-96bb-4dd1-b328-25952d6a4b15", "comment": "Malware payload (Mirai)", "value": "7a815a709ff704864498357d284be77b5cbafcba8cb0339d356ad810beb21255", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670985, "uuid": "7bd89584-860d-4eb2-ab2c-9a81a36d7e31", "comment": "Malware payload (Mirai)", "value": "9927d4f211904abf505340fced37284a2bf27df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670985, "uuid": "de8c4b1d-b31f-4051-a9c9-e51b306137e7", "comment": "Malware payload (Mirai)", "value": "8e7ce76e43a75f93f4b6f47fef21fe300c8c841f83ce8d81064609280bb8d236f00eb710e1186fabfa7088cf657c36f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670985, "uuid": "e0b66a09-6c7d-46af-8bb5-2dc904f96744", "value": "T173E56C2EF9A214BDCAB6C4B0CA2F86726931749CC1517D772194DA703FA7F301B19AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670985, "uuid": "9f026dcc-4f77-4538-bd28-f9ae39a1a7e2", "value": "98304:ufKQGIwApLHdkrZFa5j/MvEsXj4q+qiOXCDDDDDIDDDDJDDDDDDDDDDDD4tievN:mKWdQHoDDDDDIDDDDJDDDDDDDDDDDD83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755670985, "uuid": "b89a04f7-ec7b-4371-a84a-ed060f9a3a42", "value": 3145912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755670985, "uuid": "64e1da6b-e438-41ce-84f0-b648e32ee1c5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670985, "uuid": "e45397a6-0d56-489d-9943-acbdb3af2eaf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f297023f-7da0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755679066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679066, "uuid": "c829d6ff-b722-486c-8b7c-1cd4600704bb", "comment": "Malware payload (Mirai)", "value": "b7aef6b1407b7fed9bf19d0f6f850460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679066, "uuid": "8f8b2a20-6826-4cf1-97b3-a9a58782cddf", "comment": "Malware payload (Mirai)", "value": "7a99ab4e4e45249225fe7e6d2a1fb0fc230d5c4439adeeaae447c258a10b9472", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679066, "uuid": "739b2bff-81d6-4658-8ccc-db55f2dd4c0f", "comment": "Malware payload (Mirai)", "value": "df299fe917b8df725e3720a33ad20a362fa6f9b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679066, "uuid": "0177915b-76e8-4c8f-9e36-66d1fed00afe", "comment": "Malware payload (Mirai)", "value": "ea7cf8e9d999e75f7d322a7928c9467b82bd154a21edbe1167ca3eb787bfc6c3bdb9ff51595d53ce75b6c1a0dce419f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679066, "uuid": "67251dc3-486d-4e2b-9515-0525828c0af5", "value": "T120837CCAE697D9F0DD8305B0121BE77AAA32D9316120DE7FDBE5FA23E871542601721C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679066, "uuid": "661bde9a-f4e4-401c-9f26-6aeaf68ffb8f", "value": "1536:fW3f19hkMDKEaf8mzsI9AO4bwjWWHUq31sbYoqKQ0I1oSIh1wtiQX3r:fSZkMYf8mzsIE0jWoy1qKNYoR1wtiQX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679066, "uuid": "ee22aacc-4a09-4fab-9bc6-baa7a03e7faa", "value": 82764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679066, "uuid": "f144f06d-91ba-4082-b9b4-db7206ab7b7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679066, "uuid": "1fa79705-e5cd-4bd7-bd37-1e69afac564c", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b830f700-7dcc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755697866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697866, "uuid": "9981847a-1953-4354-9975-4699b375ea62", "comment": "Malware payload", "value": "47ba166386fc217b0fc025bafc3d6fdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697866, "uuid": "04483a76-59b1-4911-a895-2d7af89fc525", "comment": "Malware payload", "value": "7b5f3aa0e1bf3c0ba5d243609210375de9b11b36cd951524aaf2b868a5f19345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697866, "uuid": "5c2bb2c2-33fb-4c34-a506-7ddad9024735", "comment": "Malware payload", "value": "aa56cd2294be4cbb28961d0a7e056b3bb04b1951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697866, "uuid": "04b2e36d-2f68-4636-84d7-286da1ae6d72", "comment": "Malware payload", "value": "dc82d10aba387a20ad86c778fe534cb73f9beb4bb4dc3cac63b8570cb66936bd20a898b6d8f527d903365194a30749a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697866, "uuid": "f5ce41d2-036e-4316-bb6c-6d6d254dd265", "value": "T17CD633F788174B53F5EA593F02B6FE254823173A3B4747B365303CABDA6430B9996902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697866, "uuid": "8ebebac2-f7ff-48ee-9d4a-a80ac1c91073", "value": "35d2c95b8bf3039f27745d9e25ec6dac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697866, "uuid": "22fc681f-f1db-4466-83f7-f1560914a75c", "value": "393216:HYfHFOaARZIqrzmu+fNQvSNvCtdfn5EXQ:8FODbrz2fNQvOSFaXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697866, "uuid": "ef6095cb-7275-4db7-834f-7a868d53fb31", "value": 12636432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697866, "uuid": "c8156e55-ed44-4216-8452-62ebcd72d737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697866, "uuid": "faf13920-c556-4a87-b3a6-b24f75151893", "value": "DLQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb2428e-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1755693498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693498, "uuid": "65d889da-8bb3-4e00-b146-d9c152fe98ac", "comment": "Malware payload (HijackLoader)", "value": "6cd2d4d9954309124f79df12827697a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693498, "uuid": "da7de794-25e1-402e-a7f4-12a32325f1e1", "comment": "Malware payload (HijackLoader)", "value": "7ca7e6f3586196ac5093bcb92a601bfde7edd23a3d0f90eaa5e8f43e6bea940f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693498, "uuid": "61fdbbf6-f042-4df8-a9f3-b7da781dd771", "comment": "Malware payload (HijackLoader)", "value": "416f5613fbac45b1225e9bc04f7ce17d0e855db9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693498, "uuid": "9866a68e-7083-4593-9aea-7d1469ddc021", "comment": "Malware payload (HijackLoader)", "value": "ae45b23f6e10a9e5559fc9fcf1b3c972b50d5998b897aa6e5f236d822bbecf8529100c8b7eb1b44cb69f1a5114c6cbe3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693498, "uuid": "7729cd0c-51eb-499f-bc9b-e005122a01e3", "value": "T1BA048D107A91C839D96F16341474CA761B3EB431DF708ADB7388593A9E706C1AF39B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693498, "uuid": "611c837e-43a8-4d32-afe0-70dd97748935", "value": "f65b9748d91a6f320390ca485223acef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693498, "uuid": "2c978ae9-0596-4033-8cb0-812700ba8039", "value": "3072:QOYwGVRcOop+zfsx6ovGTaaxbIqKnqPWJC2SmoR02W9bY20r+zFjrMUbn:QOYRVNop1x6BWCZnWC2sR6ir+lfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693498, "uuid": "16881829-761c-434f-b3c3-ed48d409d654", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693498, "uuid": "e5341dc0-90ae-460a-9308-dafac44a574a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693498, "uuid": "409c60a4-43fe-4992-b066-16fe29dbb6a9", "value": "Temperature.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4af559d-7d84-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1755666990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666990, "uuid": "8b493cb5-b28f-4aaa-9dc3-17c66eeb5181", "comment": "Malware payload (Formbook)", "value": "363951a001e9d0ce95ff0e73d4ed7252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666990, "uuid": "8dc90002-347e-4f9b-a382-ec0ea717cd60", "comment": "Malware payload (Formbook)", "value": "7d3c778bdf96a09329ff48320375c3b3f902fb0c60a6dcc3e84c74c29a925ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666990, "uuid": "d462b4b7-584c-4ec4-ac57-2ecdfe354913", "comment": "Malware payload (Formbook)", "value": "64b74ae6e4d9fd3cdbd5b05d20a8c2dd8e9aba9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666990, "uuid": "fa14d978-7f41-43a1-9fda-e8d82c2f6936", "comment": "Malware payload (Formbook)", "value": "2b3bd402a1cbc6bca821572d46a9eaebb762f59f26e22308619491a1fdc4611f67d9e93a698e5bea59724eab249b81fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666990, "uuid": "8d33ab75-3914-4b12-8043-6a58e61caf72", "value": "T14DF4124562A6EA15D6FA2BF85DB4E27843F93E897921C3060ED5BDE73C30B406D14B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666990, "uuid": "b4cf28e1-ef92-49d0-ab7b-2cc094a9d5bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666990, "uuid": "61a8bc1f-1f46-40d5-bf19-62d71ca45469", "value": "12288:sxOzmACKj9NCtJwkgJkTRf+hxi/RGrcFPlUcV0VacsCbp4MRo1WMnI+lmqhan2:1z3StJwXAfWGqcFgVaURYWMnI+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755666990, "uuid": "cc5c1537-1286-4cc0-a775-ffc7771f9831", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755666990, "uuid": "e4c28e31-4772-4a80-a0ae-3177d7a8acbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666990, "uuid": "529c96c8-6258-4e11-9a06-2fbbeba24ee8", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.18051.15657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72f5121-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700468, "uuid": "3bd6f4b1-ad50-4aeb-9d33-5a5f91daf99f", "comment": "Malware payload", "value": "50a2daed6f18042b4675f72e8139a48f", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700468, "uuid": "72232d24-d49c-42bc-855d-43ff88c4c97d", "comment": "Malware payload", "value": "7df333e96d4bda54effe78d12c4ca27842665a368a2f5d3c5a0c8996fb666a4a", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700468, "uuid": "f618d1e9-be67-4d08-b10b-d14178d3291d", "comment": "Malware payload", "value": "51b631f39635f2aa1d18d620245e98ffd3a5563c", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700468, "uuid": "059693c4-a2f9-4c6b-9050-0162bb5eda43", "comment": "Malware payload", "value": "6550b3c4136581fd68ba7c3d95b1be89dad109f2c56994eeead9afe004c5d5f563a4d3fe97a77f32a6194b40b798f61a", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700468, "uuid": "eacb162e-5020-4939-8414-80dee451eda1", "value": "T12B36AFC3250492FBCD208932B02D66711A219BFFC317A5A176D85F2A6CEF584593B93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700468, "uuid": "876b9e77-047d-4a00-b44f-496b3c5bfd6d", "value": "68179373e81889b94c38a1cad3519e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700468, "uuid": "ffd36c1e-9dd3-43da-95a3-e4a5ec119876", "value": "98304:FjQSpGp5y6pvpFI1Ulzxc+NYHKHOH9HHHHHJHHHHrvulsLw2dz1uKez3H3lV1FyC:OoGp5w1UlzHNYHKHOH9HHHHHJHHHHTuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700468, "uuid": "e143dd86-34a8-4838-9598-863f938c556b", "value": 5341968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700468, "uuid": "d5107c61-93f4-45a2-afda-86d87202def1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700468, "uuid": "281530dd-20a1-4962-a15c-531aa3e34c0c", "value": "7df333e96d4bda54effe78d12c4ca27842665a368a2f5d3c5a0c8996fb666a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f035153b-7d66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755654151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654151, "uuid": "e16959fd-e921-430f-81d2-8ab7d5c2d7e5", "comment": "Malware payload (Mirai)", "value": "82f683ec9027a479d1bd5ff5dd73df8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654151, "uuid": "38e1353a-f5c1-43fd-88a7-d0f31c4aa8de", "comment": "Malware payload (Mirai)", "value": "7e0d8be0783e68cea0fd1495ef8a2c0fb6704ccb469b1e5d3a0d249229334bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654151, "uuid": "aaa3cc60-e0ae-4789-9d9d-d28deb23368b", "comment": "Malware payload (Mirai)", "value": "5270dc13fa6b308da69443d1a365708de71e4fe9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654151, "uuid": "ba7b56fb-faad-453f-914a-0d575970695f", "comment": "Malware payload (Mirai)", "value": "ef88d993a997cabd8a5b400e6aaf2ecc89885504d6e9b4669b02a425a4eedb534cda8023c91e2eecf11feebefe059fd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654151, "uuid": "f9a63076-017a-4556-9354-5620953884c0", "value": "T19B53F24C03E229FACDD97871A3BE46741EC1B181749E4B4E827B0D845F09CEE758693C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654151, "uuid": "0a7b4370-9e73-4fb4-8a7b-6eec7ede0df5", "value": "1536:czK/++ANa1adgRZHTdDqYsHO4dd6yUe9UrWKs2:c8RANa1aeHEVuryUyUrWKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755654151, "uuid": "d9dc2d04-3bff-40f5-8ed4-4cf081e82813", "value": 65636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755654151, "uuid": "6d723cd4-3410-4611-994a-a18f734498d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654151, "uuid": "b340b6e3-4213-4f04-9e40-d1670c881d1c", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67f5e3c-7d9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677274, "uuid": "530b6303-2d46-4457-8fc7-7efaf86e38fc", "comment": "Malware payload (Mirai)", "value": "f66b97a260e101ef5ebcc74c1a91afaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677274, "uuid": "01bd9f61-c0af-429f-893e-577efbf6d517", "comment": "Malware payload (Mirai)", "value": "7e8d6d10a37d9b60059cf7c93439db2ffbb374f02f6ea75fdf6166c02851c706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677274, "uuid": "40453e62-e8d9-4407-b8f4-0fd2e34f0848", "comment": "Malware payload (Mirai)", "value": "adfd2dca1dd90626404399e6169648434649c26a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677274, "uuid": "8abc2f88-d7c4-4c05-8c7c-ada243a23339", "comment": "Malware payload (Mirai)", "value": "2c23617924088ece269bf9c709e95558e177177508581b5ec7f673de2eb286d222dfb709091ca0e4074ffb02363dbb87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677274, "uuid": "deeda6a2-aedf-4c9d-8cd0-48a7bfb5e04f", "value": "T1F0158D2AB2B3F5BCE017C03407DBCAA25535B47922312D7B36C4DA353E6ADA11359B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677274, "uuid": "8c69580c-4124-4733-94ec-7df50c67ebe7", "value": "24576:a39dN/lkZsxyBbJ7Ng21pHqwPigFVxv7pWwdCQi0:m/ybJ7Ng215vPiyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677274, "uuid": "29ec4b25-57aa-41fd-8ac2-e12c72fb9a96", "value": 940344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677274, "uuid": "382fb58d-e21f-4c57-b0cf-3e116926bd5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677274, "uuid": "8fcf2d5f-a946-4cce-b7f6-2de56b0dc79c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc4ba1c-7d62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652453, "uuid": "07b45669-70ca-4dad-b953-e08c5877f9a5", "comment": "Malware payload (Mirai)", "value": "93a6e05a83d7601d9f33f41985756b8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652453, "uuid": "9870f741-592b-4bbb-b90e-a48c6852d3b6", "comment": "Malware payload (Mirai)", "value": "7ea46f7eb321860344feebf16ebc57535777e56df0afbe2b9c91f0b1704b6f48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652453, "uuid": "ca38a961-6dca-43c5-98aa-b44927f7a6e8", "comment": "Malware payload (Mirai)", "value": "948261fa1338120dccccd117b258cc44bd18b449", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652453, "uuid": "47fe74b4-19a4-47d9-8067-7f9deab6f3db", "comment": "Malware payload (Mirai)", "value": "fd2c168d6d1dbeec0b3af4a9cac9c041e69d9630f361c4031ce67adcd1020b8ae8eebd9eb72cca38da595d65fcefccca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652453, "uuid": "15f52116-2a83-4972-a6e2-346207cf4516", "value": "T13B4302B278A015A2E0B1943CDE7DF7D20FA747D0E5DB7170698B069CA31B26305B6A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652453, "uuid": "9e53ff7b-99dd-4789-944d-f0282d9203ea", "value": "1536:Iq8y/bx+j2EoLBhfCHJz5QAvBiJ4P5ThkIfvcNPfz52:Iq8y/Qj2JBCz59BiJ0TGIGV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652453, "uuid": "f60c537b-e51a-460a-b157-a665e2393465", "value": 58652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652453, "uuid": "6bfdd126-2fc1-49ee-84ff-636eb7775e50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652453, "uuid": "04562c16-5716-4278-84ab-c4ef8292f030", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c8aeb7-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699067, "uuid": "594de7c2-79c4-4f8b-8945-b0e08ca0e0f8", "comment": "Malware payload", "value": "cfbddb12651f19efa7a302db2f24e68e", "object_relation": "md5", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699067, "uuid": "a4a7ec85-cfdf-4a2c-bb99-9f1eac29f7b5", "comment": "Malware payload", "value": "7ec3b8ca494968d71545c4e813e4a3c899b90f404203829fe2b462df4931fc27", "object_relation": "sha256", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699067, "uuid": "bda95352-2197-4cb0-ab68-effe0fc1fb07", "comment": "Malware payload", "value": "7692200de69be7cee54efb11bdfc75e84a1140f3", "object_relation": "sha1", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699067, "uuid": "3bb48adc-0d97-43c9-b8ce-d9174b7c8410", "comment": "Malware payload", "value": "986ab7d707c8008e936b2dbe0f9a450b1313cb7ef8170b1b5f8878417c58a32f6d782ac7771705d2148a266c55eaa093", "object_relation": "sha3-384", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699067, "uuid": "46b9500a-da2a-45a0-a100-201582c037d3", "value": "T1954506D3B8888951FD2844375097BDFDEB169CCC9CB8910AB24472F954B2D72223BF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699067, "uuid": "711f0e1d-b4cb-4e45-bad9-b1edece56fe8", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699067, "uuid": "e5714157-84d5-4014-aa34-f02645042eb3", "value": "3072:myVNvRp26ey4e73T/9iRZ5vga3rNEAYe111MCvdQ7M3:lVbpBseNORvdQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699067, "uuid": "10f74413-dc22-4937-a088-321a336428c9", "value": 1215072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699067, "uuid": "4c3f065d-05ce-4cf7-b530-023dbfd5b75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699067, "uuid": "f256334c-fce8-4b1a-a0a8-dc258e46117a", "value": "7ec3b8ca494968d71545c4e813e4a3c899b90f404203829fe2b462df4931fc27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b18fb8-7dfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755718154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718154, "uuid": "7315712c-2793-4d39-9e6b-a032d8b5371f", "comment": "Malware payload (Mirai)", "value": "bd5c6b0b574c9faa525deccfbfda0f95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718154, "uuid": "0f61513e-2cc9-4f72-b386-186208bfb594", "comment": "Malware payload (Mirai)", "value": "7f0e4d11a5fde68a5ebc53a913db19b6f5c101f7004ecbd846418e2be5236402", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718154, "uuid": "e4373ed7-df3f-4d38-a25a-e60f33195eec", "comment": "Malware payload (Mirai)", "value": "d80d40d5bb524c7024f8d70c6af05b1eab39c62b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718154, "uuid": "90e97d98-9f1e-40d9-838f-e841d4e20aff", "comment": "Malware payload (Mirai)", "value": "573c16a46601a491718522c5a5ca058fcff449f32dc4138a1045ea0bac199b273513a5cee058552ded379c8bb3d8a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718154, "uuid": "58fa39f2-0524-4a79-9c62-a668366afd6d", "value": "T10503F110C311A721C9B46E39CE5B48D733D8E932D22D305BED2B6D6DE98358633F954A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718154, "uuid": "7456e8c8-ac75-46eb-990e-0e87fea5d83a", "value": "768:pAPYlkF0lKQjNEoZN3zxrBTrdWw93R3FE3PS0bKhq3UITKV:pePFgzEYxdH3Fqa0bKOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718154, "uuid": "66fb65b3-a58b-4f77-b951-83e9f7c91c8e", "value": 38168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718154, "uuid": "a70a8c73-dd93-4983-a3d6-3b9430355c4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718154, "uuid": "8edbfa3d-d9f9-4da7-bedf-b75b3004432c", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39568a02-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755697224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697224, "uuid": "a71221de-d497-4090-b6f8-07fd4e5aab0b", "comment": "Malware payload", "value": "b5277cca152b21d308fabe9d1fcfd534", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697224, "uuid": "0cf9ee0d-a952-4623-ad4c-c9a62e6dd2b6", "comment": "Malware payload", "value": "7f85d60e8732bc6ae76d87dc0b4552cd01fcb0534c8b6719348d98098a543527", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697224, "uuid": "97ddf8ab-994c-4dfe-a660-459c73a9e5bd", "comment": "Malware payload", "value": "fc9c1148894f956e3d8d86d0efb0f23f78c40015", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697224, "uuid": "e8b69914-be16-4aed-959f-24babaafc558", "comment": "Malware payload", "value": "5469338697d24f32347134f006437c55d09f2fbd5afdb4455172a163bc69b2b175f6678ae461aa7d7d7f27d096a5a88c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697224, "uuid": "f2aa5663-335e-41e4-832d-ceff00c5d8e2", "value": "T1AA019E10A51DEE691A4200F651E7CC44F7B466DA9201E82437CCCAACEB06A645B08517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697224, "uuid": "05fc57f5-c1a5-49ec-baec-78d4256dfcac", "value": "12:41WdjwmgDY3v/lPDD3o1EyshHHhH7Os+eLCB/UEBmNi4PkoB1L:djwmX//doejhHx+eWB/UEBmbPpB1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697224, "uuid": "0948fcaf-3427-4514-833c-3fce8e42bc31", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697224, "uuid": "e772ff47-e043-4565-892d-cdf5dd1884af", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697224, "uuid": "38fe0287-9e28-480c-8815-2fa00dabb46d", "value": "111.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ce69ba-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679640, "uuid": "0020d3b0-8c57-49f3-9b63-bad922e50887", "comment": "Malware payload (DonutLoader)", "value": "da44000dd4513e128cfc9c2f34881c42", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679640, "uuid": "2d46038f-485b-41e5-8000-bb0276f5e25a", "comment": "Malware payload (DonutLoader)", "value": "7f8af380cd1c472ea607112bf8e1d8b488e37c46d690b9601d00d0e144ddaa61", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679640, "uuid": "504514e3-060f-464d-8f8d-a46dd25763f3", "comment": "Malware payload (DonutLoader)", "value": "3aaac2c0d16d82ebb8a54899bb48d6f041d33074", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679640, "uuid": "438eae57-f57d-42f2-b84a-eeaf5b13e761", "comment": "Malware payload (DonutLoader)", "value": "6ce5337ad356503a1fbeb4046d94c1d7d5bd52070d2a8c5713b040a64a41fe945dce1f124412b16ad3df4951a3fcffd0", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679640, "uuid": "109b29e9-afa7-4817-9fc2-b06af5d5f42f", "value": "T12AA6D6DBA32D59D90DCB376CDB465D63EF89993406B0864FF6AE891EF00F81640F091A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679640, "uuid": "d63675b1-171e-4205-a1e7-553544e1243a", "value": "12288:+OiPrsmsOPziUj1SqLmJY6Yua9EuZ82pfsDIvC378ZWJdb581v1HgiuMGXEN1kYg:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679640, "uuid": "29ab228b-1a2b-44ee-8606-b50b6f702b22", "value": 10255135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679640, "uuid": "0256d9b1-aecf-4691-876b-31206ad15633", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679640, "uuid": "cd33bc0b-6472-4b2b-8ac5-063a81fd95b1", "value": "7f8af380cd1c472ea607112bf8e1d8b488e37c46d690b9601d00d0e144ddaa61.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99cf047-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679454, "uuid": "cd5faf25-656a-4dde-9691-40370a9c2057", "comment": "Malware payload", "value": "ddd2a8c4db00016268e8db8e118a6d88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679454, "uuid": "eadd05ae-2c35-4e67-8dcd-7984614b3a5e", "comment": "Malware payload", "value": "80752f2cb155717e849e0858dcc5f5c7523393207ad2508cc44f4aa716506c5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679454, "uuid": "4ba0eadf-09e4-4de2-b99e-b441da01b445", "comment": "Malware payload", "value": "4f7e0dcc33417ed148aa736772e664961fcd8bcd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679454, "uuid": "f68d1243-fec9-45e5-a6d2-473748910a40", "comment": "Malware payload", "value": "91270a39962fec94fb42ec1df60fca6577f73b5385bc6788b908fa8d3818efd863fb0df7fbdcbee92b05b02d325b27e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679454, "uuid": "50035e80-e51d-42dd-9b76-99342160e68c", "value": "T17551CF1A93E84A6BE4B70731ADF3831637B4F8509F73535E5980421DACA07645E31FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679454, "uuid": "ddc21090-b920-4bae-8e24-7285d5d38441", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679454, "uuid": "9135b339-6289-42cd-a6f5-e6a923fb65b3", "value": "24:etGSfWPBe5ekKC8oMv6uQYD+aetkZfpJmKzZ0WI+ycuZhNoM4akSxMtPNnq:6fFskuoMi2JRJpJmKzZX1ulb4a3q3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679454, "uuid": "1cc50c57-283c-4bc2-9adf-46c4976da576", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679454, "uuid": "1342829f-e061-441b-99e3-3224b6d6de0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679454, "uuid": "a089a8f3-4aa0-4647-8f45-f81628195edd", "value": "3wyq1kug.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a75d91-7dea-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755710604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710604, "uuid": "4ccbf662-cd7b-4900-9e07-60c768b76569", "comment": "Malware payload", "value": "2e87b3876e6214db55b382706f68b30e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710604, "uuid": "a3913a2d-1593-4b24-ad34-00548ddbe3b5", "comment": "Malware payload", "value": "80a2ebcf21f419d20ee24f7ad8bb474823498b041fbda9a7e9a1dac59b488b75", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710604, "uuid": "6ec56990-e693-4b32-bdc7-e505a7e05bd7", "comment": "Malware payload", "value": "e3028636ee2600cbab0eabcc99d737d0d3854f40", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755710604, "uuid": "ee1d434c-351c-4226-a20c-4e92e0e49cf2", "comment": "Malware payload", "value": "5e5d682c23aacbc304625a3e22a49bf490379acb14b63efcb5ac8e6d324694889b58e4b81f6554be1f5054106f59cc27", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710604, "uuid": "f54a874b-06e3-4703-83af-9b0cd81293cb", "value": "T1F1762302F369795EC4F3C332287292752026DE16C787A787953533B968FBAE84B167D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710604, "uuid": "a923d3a8-3c44-4870-80f5-ebe1a1fe1afb", "value": "196608:4YcORWxl3zshynzlDoqJbRexWmiRotIY02aq2r56:4kRWx9sMzlDoibRZ+tIY5gr56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755710604, "uuid": "cebff116-2795-449f-8d2a-aff30db2e490", "value": 7490075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755710604, "uuid": "44e115dc-a518-4030-8cac-45d309d1d0f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755710604, "uuid": "00b2ad91-3818-4e02-b8a4-b451918c1bde", "value": "80a2ebcf21f419d20ee24f7ad8bb474823498b041fbda9a7e9a1dac59b488b75_detected_by_motmaenbash.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd0e4e6-7d96-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1755674713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674713, "uuid": "ce4d95c2-45c6-4553-862e-0ac810bf3e2a", "comment": "Malware payload (DCRat)", "value": "dde54139f35029106571916ca0f68fc0", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674713, "uuid": "70309486-a429-4bde-9c8d-4e6eb299de5e", "comment": "Malware payload (DCRat)", "value": "80f75a3043ef695d40f234f9059da4c49795d387beba67a51b4d509f7ed242dd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674713, "uuid": "c33a4995-fb38-44cc-942f-78797c98ef6d", "comment": "Malware payload (DCRat)", "value": "d3ae31db428b2d2aad21bb6daa6f49072a37ae53", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755674713, "uuid": "89d4d111-0c42-455e-a16f-74341c5b08e8", "comment": "Malware payload (DCRat)", "value": "92ee3a675d2be3826c20fd559408847fcb7f39fed49f0c03df97bf94066fa2654595dcd4e0a5460c1593c9260ecfeef2", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674713, "uuid": "3217242d-25a5-48dc-b279-6de1085ef195", "value": "T1C605E6027E44CE01F0191333C2EF458897B4A9517AA6E32B7DBA376E65123A77C0D9DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674713, "uuid": "71e73ddf-74ae-466f-962b-f55f7de75cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674713, "uuid": "acf312e5-7235-44f8-ba94-cc725acaac4b", "value": "24576:3nBnNLqRQF95KDasAHlAVnk2+yws8mqr4N:3nOWmPB1Er4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755674713, "uuid": "bae6b7c1-6210-4035-9c2e-be25755853cc", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755674713, "uuid": "b79ab68f-61c1-4f67-ab03-69ff32b1c3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755674713, "uuid": "1b5df3b3-6ff0-4f74-8675-2d10307f980a", "value": "dde54139f35029106571916ca0f68fc0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2904099f-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (IRCbot)", "timestamp": 1755706216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706216, "uuid": "673d743b-a1b1-4d58-8006-2e2c1f34ca7e", "comment": "Malware payload (IRCbot)", "value": "d9c6da282d0a97b34b99e8c246f6ad16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706216, "uuid": "a033019b-6b05-47f8-acb3-f04a04249228", "comment": "Malware payload (IRCbot)", "value": "840357cb035ba642d399b08b0ecc5eeef0bbb3cabb5a39be1010dd5757405a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706216, "uuid": "bcb01367-0537-4884-8056-78ba7e22bb42", "comment": "Malware payload (IRCbot)", "value": "91dd8a3854aad6425132f637dac81418361c50fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706216, "uuid": "0eb56765-b4f0-401e-afc3-89c87462f8db", "comment": "Malware payload (IRCbot)", "value": "a4889a186c1cb2d71b730a5e3bc2210a8fb06431d78a434233a60cdcc4e43c8caf48b15396feeaa4e738ccdf2fd3dfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706216, "uuid": "917f4b43-dbbd-4f7b-9105-bf67f767b60e", "value": "T1DDD2280D59856837D86204307B016F779FEFEDB32358A41FDF4105082AB979AD9B928F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706216, "uuid": "685c37f4-412e-401c-85a0-bac504773b9b", "value": "5d93c980cc5e5613f5a385e38f0e819e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706216, "uuid": "b34dae24-e9a1-4584-8812-cb8751dce151", "value": "768:IKHmSn9+HllamoMza9xE/HLUwmLPO9zMRnn8C:LHilaNpxyUrLPO9On8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706216, "uuid": "63d037d4-065c-4341-adba-222602fc0f7c", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706216, "uuid": "7bfc06dd-9be2-462e-b2ff-616e10b6e687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706216, "uuid": "c8859763-8353-4c13-8792-c784c3c29263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3ca715-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1755703456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703456, "uuid": "c2bff63e-fa69-46e5-a642-3d8ee665846a", "comment": "Malware payload (Stealc)", "value": "2ec65ea39e10130c9ef1b4959cd8c1b6", "object_relation": "md5", "Tag": [ { "name": "185-102-115-104", "colour": "#5C86D0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703456, "uuid": "8bd59fac-4567-4ad1-9771-644292528bef", "comment": "Malware payload (Stealc)", "value": "8441f8b903c676d468bb0b0c07d699cb98df153cc50b4ac566e7ab95293cd2db", "object_relation": "sha256", "Tag": [ { "name": "185-102-115-104", "colour": "#5C86D0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703456, "uuid": "c8073eec-8d53-42d0-bf3f-435007d5f1f6", "comment": "Malware payload (Stealc)", "value": "8c68a27f38496c91143e4a684c9d790c3d645331", "object_relation": "sha1", "Tag": [ { "name": "185-102-115-104", "colour": "#5C86D0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703456, "uuid": "3a7a021a-f229-4dc8-bab8-bdff3ff94250", "comment": "Malware payload (Stealc)", "value": "b17d94643bac5a118e471cec78d70505242fdf2de556709a201f362d58cc7e8c623cccfc1d6f4a7a4ed0b5b39e22f5c9", "object_relation": "sha3-384", "Tag": [ { "name": "185-102-115-104", "colour": "#5C86D0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703456, "uuid": "69bfc682-0cb4-4829-aee6-99a1fe38c4cd", "value": "T1D7F48D1FF7E501F8C4BB8278C9525952E77A74561370A68F03E019A63F2B650AF7EB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703456, "uuid": "4783479b-9bd4-4c67-b133-1120846bb76c", "value": "112f19f28f55f461c3d7ad7d3898dd7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703456, "uuid": "ca15aeaa-5a23-4bfc-8e0d-dec6d1680aaa", "value": "12288:cJLb4TZvg7l4RaaXGOFC4VCPMeY6ReOSoE/:cl8TZ472RaaX7ZGM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703456, "uuid": "1b80c56d-ec68-4095-8d8f-bc11a6b421cc", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703456, "uuid": "51af10b3-acb6-4fe0-a310-67c0f71fa053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703456, "uuid": "e1cac214-6411-4dd1-a680-0635a6423c4f", "value": "trvb3cO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa06d11-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755648693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648693, "uuid": "407e6deb-b295-4fa3-8b50-6430b3d51056", "comment": "Malware payload", "value": "838106424f20808ed74c786390e4f924", "object_relation": "md5", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648693, "uuid": "a6a495ad-c0eb-4dd7-811b-720b4d9cb0d9", "comment": "Malware payload", "value": "8478ac961533811713428723a53deaed5df237699c9dfe60a5de783e8be0306b", "object_relation": "sha256", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648693, "uuid": "4c571efd-b077-4078-856c-ea5e9110c244", "comment": "Malware payload", "value": "e06bc0584c1daf071729af39a3930105321e5c34", "object_relation": "sha1", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648693, "uuid": "c0b4462f-cd59-49a9-bc35-d8c4fef66976", "comment": "Malware payload", "value": "aa415ca02be8fb591e00358f70bbdeeda120aeb1f8318852253ca68828c2fcd6a6af8004461c038266d03438fbb0b5e9", "object_relation": "sha3-384", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648693, "uuid": "cc029a63-dcca-49de-9b8a-8e84d34d50b2", "value": "T14E7533633A65DF20D19296BC5AF44DA763A011C512237B14FF43B4BB3CA32EE251DA93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648693, "uuid": "0e4cd0e6-1eef-4eb6-96d7-410ad39bdef4", "value": "24576:m8ZudNGHp4k2s1GbHtoABQB/8w/cVYY1QHN4m+kB1PyPcBE858yfX0MdX5CZPWTN:EdSnkNBQiRQt4xvcyBX/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648693, "uuid": "b61b0fb9-0988-4c32-8422-38f504b34148", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648693, "uuid": "6ac1f228-d01f-4bef-8f84-4d8593ef5094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648693, "uuid": "08c13cfe-21b7-4f5e-8faf-d03c20ce0f3a", "value": "8478ac961533811713428723a53deaed5df237699c9dfe60a5de783e8be0306b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e23ffb-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721594, "uuid": "780cd08e-1b71-4f48-8068-4f615ebaf1aa", "comment": "Malware payload (Mirai)", "value": "20c28409589e89794aa25377f05c58e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721594, "uuid": "ac36b0c3-88a1-406e-af17-73ff634fee42", "comment": "Malware payload (Mirai)", "value": "84df6ebc807d9779e862b0c259c02bf4a6c45cff0d62e773a5dc04bded69beca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721594, "uuid": "e8cacba1-07ea-4946-8a03-d88c7e85c72b", "comment": "Malware payload (Mirai)", "value": "68a8233b08093565abdc2bb36af75c0c02543345", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721594, "uuid": "6004b709-67c3-4ac4-97f2-669f99b85c39", "comment": "Malware payload (Mirai)", "value": "d68568cd8211d7b66fe9499d2f297ce8b7cda66f8c30dd8d1b9ee64683bab07ec9417a01289d8c1e486261597b60e7fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721594, "uuid": "ab6a6912-5b4f-4b42-8182-c1fc8aed9228", "value": "T1004308817881A626C7D05377FA5F018D33199798E0EE33578C296FA07B8AD1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721594, "uuid": "07dae7d7-9c10-4b4b-9613-db837391d96c", "value": "768:30ESWRYSaG0wBXAy9abThYrB2dPsnjVB5uEBwLRzqmPrqlhH8qkJSULwCVy/rCxE:dSaP0waejVMqYIcJ8fhWfM5tMd7oHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721594, "uuid": "047327f9-0603-457a-aa18-931b8453f84c", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721594, "uuid": "d1b84a50-da0b-4389-bd9c-c28c81d7d70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721594, "uuid": "ead5c87a-fd60-48ff-91d3-b86fd6cef174", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d561add6-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721537, "uuid": "ae6d5164-fdb9-4b7f-9a54-88394fccf57a", "comment": "Malware payload (Mirai)", "value": "c48766cbabeeb310ec7456bb479c1e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721537, "uuid": "5450f3bc-d737-417b-8e52-e75a0dc11aae", "comment": "Malware payload (Mirai)", "value": "84e4c9230689c097bb226965d86cc17180965caaf2edb5feb0be49f0bbeafcad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721537, "uuid": "bdeb468f-8230-4dd1-93a0-a39b7cda2f89", "comment": "Malware payload (Mirai)", "value": "777996b733c56d61703ca7dcebf01f81d4955830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721537, "uuid": "daf71f33-98c1-49c5-a351-d91f832758fe", "comment": "Malware payload (Mirai)", "value": "c102e64b39ef1f95592bf7a74dfc85eb5177a5c4fba923227cf293435a9f8a6332e397cddd7bc4335d98a2f1ef30e9b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721537, "uuid": "bded82d8-4fad-4994-9d90-9c46bfcdab8d", "value": "T1BD337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721537, "uuid": "3da86039-f6d1-463e-9cf9-0edd3613ebaa", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvf:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721537, "uuid": "0b7b3b18-dc3a-45c9-8c98-bd31811bb347", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721537, "uuid": "e9759c06-fce8-4666-95b0-bbc75647f1f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721537, "uuid": "19813e6d-84c5-40cc-9a06-49d76bf2e4d6", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44299f9-7d9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755676921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676921, "uuid": "1fe0d12e-2d31-40a4-9066-3284e4bee22c", "comment": "Malware payload (Mirai)", "value": "b2888b3ddd3752ac235af4804b0f007b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676921, "uuid": "4b7adeb6-bb7b-48ac-81fc-c947781c57b1", "comment": "Malware payload (Mirai)", "value": "84fecbd6bbd6721d8ed59d11aa229c1c8c31f3a7cec4b0cb89a95582992486e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676921, "uuid": "80ee2ef2-b9a3-460e-8955-162b850efbae", "comment": "Malware payload (Mirai)", "value": "61c1055c37bb5ff1fedd8ea5e681825a16b0b013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676921, "uuid": "8962c36c-49cc-45fa-ab00-cad8fa4d249f", "comment": "Malware payload (Mirai)", "value": "233a6271beab63d9a7fb4e226e14ae71b216b4a93ef93aa9d9e8d4355f74bbc7537079c98a6a9a858e4a5f17050ba4d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676921, "uuid": "cc79c5d5-6a5d-452f-9f7c-a0249d1a1bc7", "value": "T1AF733982F68B85F6D4570D3050A7F73FCB71E96841719A6EEF4EAF31CA379419212288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676921, "uuid": "66fc31a2-1e89-4ce6-89b2-c679908096a9", "value": "1536:nHxaJIjrGMf4GEfzXRvmUmmRq09sKMIOBlWNsYXZ0CEGJ2qNwtiQXQ:nHxa2jr5fOfzXRvPbRq0+KFuYXZ0vGk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676921, "uuid": "75d8b62e-7e61-41d1-b456-efc51e42aa09", "value": 79056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676921, "uuid": "646e9549-ab72-4ecb-8b0e-83739aebc3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676921, "uuid": "c37b45c5-8568-475c-a821-b9d23533951d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb1bb26-7df0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755713151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713151, "uuid": "593742c5-a9b0-4c85-b1f0-84e0d3b46ae2", "comment": "Malware payload", "value": "1ace10e4505d1f243afe2affd132d445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713151, "uuid": "42f780da-751f-4b3c-ae16-2bc7c385f3f1", "comment": "Malware payload", "value": "850125c6b84c9bbaffbd1ed4077691fe362daa6a45775be3bb29df65d692d02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713151, "uuid": "1a9e6451-af8a-4529-91d0-487a5198451d", "comment": "Malware payload", "value": "72824bd75f12595528f3f7834055230dcd278342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713151, "uuid": "aeb31586-7df6-45e2-9fc3-72b4df1890f6", "comment": "Malware payload", "value": "3ac133c93f2105e2f90c5bbfd4ca6018a7468158d26b991a43b11157d570f8c9f05dda009d5edbcbd3faf30ed0567126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713151, "uuid": "21827b0c-5c1e-4b19-876f-0429c5901c65", "value": "T1AC55D008A87990DAFCE340706F755251F433BD6B8F346A9B41E89B601657EED0A3E336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713151, "uuid": "a28ff7a2-6339-4a25-b201-981221fbe463", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713151, "uuid": "e3c0a6d9-017e-4607-bfc9-aae6b6374c5b", "value": "24576:nAgGqsICddG7l/zd8UoA1deThPozz7LTdkJJ/MCHll:A7qpCddClkGtzPqJ3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755713151, "uuid": "075de1df-1ee0-4a27-8fba-f3b12690dae0", "value": 1287680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755713151, "uuid": "c1618036-1417-474e-bcba-8e8132e3beb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713151, "uuid": "6a20eb57-d01b-4da4-b2e3-b283312d849f", "value": "LauncherV8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08127030-7dee-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712173, "uuid": "532dd866-2190-409e-b262-e744af006f26", "comment": "Malware payload", "value": "8389544708559b4ffeeb55d9b5577106", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712173, "uuid": "122543b5-81f7-4d74-b60a-56f69a9110fe", "comment": "Malware payload", "value": "851f4e6d4b712f0c7dca923d3775a535103ae0066312179f24558d97dfd3186d", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712173, "uuid": "c1972ecd-c32a-413a-88e4-f2637d874fd5", "comment": "Malware payload", "value": "16bcff7322789053fa51ea598f22d26f0de10746", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712173, "uuid": "80d91c57-c776-4395-9886-1f23763dfd76", "comment": "Malware payload", "value": "9be84bbeddf1f359b8ffca4fcdface085d084dc14b96730c0cf9b9e77c50e4b5f0049365e9c302b63e1d3ddc1654b085", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712173, "uuid": "e33902f4-34f1-4105-9d1b-8f1b6c457e3d", "value": "T1BDE63323C63EE8C3DC77A3742DE3EB1A5A0ED26927A1AB4F0E2722946D590D0531735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712173, "uuid": "bf78723b-0efb-4da0-b593-1a2e4d8ee54c", "value": "393216:c9rjcBVFq28fklve8n2Df3kY3ucN6OUPLFJcaacQ:yjc9qclGfDf3Nuc8fD9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712173, "uuid": "19e8ff07-5d1d-4c92-b804-32234a10dd37", "value": 14286241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712173, "uuid": "c304731d-8610-46db-bdfc-f9ac372fe8c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712173, "uuid": "3672f6ff-f2f4-4bda-a80e-e75084f5d84c", "value": "0811PHMainq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faee8218-7d8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755669631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669631, "uuid": "71f4e51f-1ed9-4c31-a26c-7f0a8635feaa", "comment": "Malware payload (XWorm)", "value": "d2f0cbef5467874fd500355c45ba16af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669631, "uuid": "7c962af1-cde2-442d-aae4-b38f31c67123", "comment": "Malware payload (XWorm)", "value": "8533f241b5bd32bab60acc0d72bbfcc09f49298a18fb35d2f34738087293f02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669631, "uuid": "da61ce09-fc52-4a69-bfb9-b3b5eb0255d2", "comment": "Malware payload (XWorm)", "value": "38d563ed007fb61569dfaba9fe7a0532e683e343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669631, "uuid": "b9bcc2e9-b3c3-4c6a-847e-5c4a69f35421", "comment": "Malware payload (XWorm)", "value": "f81a9f3eede73127d769bffe4c753ba6da3f65f8bd1d39d937cacba1179e6529a5013462ef4393f0fb433faf92626fc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669631, "uuid": "5f5f2e4b-9e6d-4ffd-935e-215082ec101e", "value": "T14E537D187BD54125E4FFAFF11DE23122CA7CF7535803D69F28D606861723A88CE51AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669631, "uuid": "fe2b8ade-e279-4a78-815b-f28b4f24265d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669631, "uuid": "3016f10e-198c-45a0-af31-43515e0d9974", "value": "1536:ocvU/zWwib9K7MPQjFrxiHu+bhxuzeH6IuOpGD:ZvcKwYK7MPQjku+bhfafOpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755669631, "uuid": "35d4f751-77cc-4cc0-8f7b-a4af491a068e", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755669631, "uuid": "5ae194c7-9824-4db8-b21e-60c899cf70c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669631, "uuid": "4f8b2b51-cd4f-4404-9fc2-6c01f5568bb4", "value": "d2f0cbef5467874fd500355c45ba16af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d53088-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Plugx)", "timestamp": 1755697302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697302, "uuid": "dfe4ad66-1505-40a0-8a40-16721bc7b310", "comment": "Malware payload (Plugx)", "value": "7917b4df9d64d168cbd3028a54769872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697302, "uuid": "60b5ce2a-3d24-462c-bfc9-106435d0041e", "comment": "Malware payload (Plugx)", "value": "854c8a2bc48bced68b6c8d92fe3fadfc67df4f079af0a9714731c61bf3b684d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697302, "uuid": "ea8bb027-4066-4613-90ec-9e1e89fb421a", "comment": "Malware payload (Plugx)", "value": "0993f37c578a5a4eaf33e2e664263e91fdff0866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697302, "uuid": "a2a6afa9-bcf4-4e37-bef8-1fef17cc1e6a", "comment": "Malware payload (Plugx)", "value": "edc02ed1f0f063f3530b0594c6effa7648edcc7e79d4843e8ce58cbd596ba1809044b34237e229a2ea9f02fc9d5e599b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697302, "uuid": "f292296f-f20b-46a2-aade-70c139b9b04b", "value": "T1F4E75A42A6EB05D0F9F7AE3195F652274537BD066F3184CB620C1B2A5F732D08A73B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697302, "uuid": "dfdacdc9-17d3-45bf-88cf-41bf46dbde84", "value": "6349935017fab6295626f276167fc0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697302, "uuid": "d33d9c71-2d28-48a5-b6d7-d2baf46f9f94", "value": "393216:KgO1vAM4wCChmN4og3J0CzGFbyjCujm6KI46B5RVs+p+kQ2SR7rGvHvTUlAX6/Nu:xO1/4wC/K+GOShrsxwbEp6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697302, "uuid": "508ef530-1fdc-445b-a966-6c8cf99e78ec", "value": 65715759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697302, "uuid": "7232b22c-86e6-4c7a-a3b5-96093df7db8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697302, "uuid": "0c8adb28-186c-4270-9d12-bdc840e1590e", "value": "FL Studio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f2e2b2-7dfc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755718418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718418, "uuid": "e564f50f-4773-4465-8d92-05c78a849aa0", "comment": "Malware payload", "value": "0ea1ecf1f75e4423b86c00842dfdf39d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718418, "uuid": "91fcf6b1-2206-4ef2-ad67-9801d1959732", "comment": "Malware payload", "value": "85641c8fb94e8e4c5202152dcbb2bb26646529290d984988ecb72e18d63c9bc5", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718418, "uuid": "abe90ef2-6a69-45a9-aaae-c90809c0cf1f", "comment": "Malware payload", "value": "1d5a6f9661525df3eba7c0924bc6ef2922155691", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718418, "uuid": "1ca8d808-007b-4ae9-a373-ff18a31227fa", "comment": "Malware payload", "value": "58c1520bba771d13b8b704844e8f45fd4540b9a17262a6d9792196ebc16ffbce66edc24ab081f5366d25ea46a3ca0163", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT-C-36", "colour": "#703ABF", "exportable": true, "hide_tag": false }, { "name": "BlindEagle", "colour": "#8C6B90", "exportable": true, "hide_tag": false }, { "name": "COL", "colour": "#622B7D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718418, "uuid": "74025ba8-d26e-4878-bee4-4e7c64274bff", "value": "T170468C467AED0484D969D03ACA2B8D4BD3B2FC50136557CF0136A75EAF733D24A3A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718418, "uuid": "fefb891d-ec21-462e-bcd0-107d55fb3037", "value": "b4f070f0028c97d4b44509b262314b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718418, "uuid": "e59f5ebe-df85-4265-9764-004dfb28ee64", "value": "49152:KuEsNcEc8/CK4b11P5ViH8gw09NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVu1:KnL8+5gionQFLOAkGkzdnEVomFHKnP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718418, "uuid": "02466a65-7b58-479c-b5a4-3df9eb692a9c", "value": 5653424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718418, "uuid": "a73dfc63-314b-42f6-99c0-fd793fffafa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718418, "uuid": "fc83feff-a379-4ecd-aa9c-153a11364d34", "value": "mfc140u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5937e9fd-7dfa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755717464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717464, "uuid": "fc977630-8e9a-4160-bbe3-c2cf681edfc1", "comment": "Malware payload", "value": "b4fb07882551e559cc1365599cf2c863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717464, "uuid": "5e91dccb-15b9-4241-8a7d-077f9da366ee", "comment": "Malware payload", "value": "85b278f922d4621a5e2cacf18e732d5a32b6c32aeafabefedad3e746c71794b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717464, "uuid": "dab67da5-a40c-41eb-9498-1e30fe7eece7", "comment": "Malware payload", "value": "e4f35452cc845c4dd826eb937087d9746a9e2f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717464, "uuid": "d8ab0deb-ab80-49ef-a616-0bcf8c62a6b0", "comment": "Malware payload", "value": "b6fca00c3e3c8d72c21dae20da985fec9c4ab4813e690bfada1c4d0b8a182b2762240db0d722bf567d439aee7cedaeab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717464, "uuid": "cee31655-ba05-4491-9eaa-9353c2e46cf1", "value": "T1E355D008A87990DAFCD340746F759151F433BD7B8F386A9B40E89B601656EED0A3F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717464, "uuid": "26aa2de0-e476-45e7-8a76-c7b01c98944c", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717464, "uuid": "e4ddf903-2d9e-445b-9b85-e7d782303578", "value": "24576:LAgGqsICddG7l/zd8UoA1deThPE/DsWyR9kUVuG90/v:M7qpCddClkGDsRzkEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717464, "uuid": "3a98b144-2d94-47bb-992e-90773b427f7b", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717464, "uuid": "ad6f4367-ca96-41e5-8124-aa96b1aa2a25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717464, "uuid": "990add69-dd03-4682-a1b6-606adf1d7f16", "value": "SecuriteInfo.com.Win64.MalwareX-gen.19511748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815102c3-7d73-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755659549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659549, "uuid": "2a33b120-0c89-45c1-9e94-878cca278998", "comment": "Malware payload", "value": "bbdaa755ccc2a05e52c4c6f5b22ad4d4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659549, "uuid": "fdb6a497-3954-4b22-9c53-f721a9f4a092", "comment": "Malware payload", "value": "862cdb13528a03d2dfbeb9df5cdc9eb88fc46ce962e58d52eaf106e469414caa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659549, "uuid": "6941536e-3206-4436-a517-ebf0cf6e87a1", "comment": "Malware payload", "value": "8a1a60afb3488c6dfb51a5bd0232dac52468c567", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659549, "uuid": "94b64226-4a32-4bb9-9a9f-809c26eedb8a", "comment": "Malware payload", "value": "75a52b6af3badc86e9f24c073523e8a450e289986d8b0be74143b24d13dc9b17609ab5620e40b547aa893ec9cde097d6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659549, "uuid": "df59a34c-66f8-4e1f-af12-c5cd707488ae", "value": "T166E62312B7450519E8F3CB324E336295A3364CB34B5393877AB27DBCACB27D09791A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659549, "uuid": "5ad09d98-1f1f-4894-a81f-e83b05060d3d", "value": "393216:kCmGEbcow9z2mBE65VgvTiap5jOEAbOHkwxLqRKaC:iGoXm6dOM5cUkOLPaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755659549, "uuid": "c04346c2-cda9-4d61-9f5e-a8c339ea82f4", "value": 14389494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755659549, "uuid": "f085bf8d-0930-4e0d-9d9d-ead3d1212721", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659549, "uuid": "a47d908a-2f96-489d-b15d-f77c36900736", "value": "ARCASeg2.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604be494-7dbb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755690417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690417, "uuid": "d351f135-f3b9-4fa3-bc58-a4a264bafa5b", "comment": "Malware payload", "value": "3d272caf8bd0342550d65a425ef86f4d", "object_relation": "md5", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690417, "uuid": "8985bcba-e1a6-4358-9509-35a2d7bef5da", "comment": "Malware payload", "value": "869905271dacaf1d157dd5c8b75ac15899ab8cf4fc264c73a9cb0b7d9360f43a", "object_relation": "sha256", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690417, "uuid": "0c390fb6-38db-4a34-9ea3-ca742f1b4b28", "comment": "Malware payload", "value": "d50c30ca2b06f8d1a57dfc83e4b9891c711ca932", "object_relation": "sha1", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690417, "uuid": "4a2a64f8-e319-44ef-b0bc-4f47e2846354", "comment": "Malware payload", "value": "29394ab1549a6edf6815b9de1479c3d66b0f14a68b20f9554615c452754282f6b408e6de4c3c86507609d11d36ff1163", "object_relation": "sha3-384", "Tag": [ { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690417, "uuid": "4e947cd8-39dd-4e41-a80f-a4f6c129803f", "value": "T101867D07EC9555E9C1EEE5308A669262BA717C485B3523D37F60F3382F72BC06AB9710", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690417, "uuid": "dfd18a40-7f17-4fd9-ba8c-20db840caee7", "value": "98304:7b0cCzJazJmoH5MCG16yEECakKdA5MCTGr+AIOGjTqDB:7cVa1moZr9GzA3qr+BT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755690417, "uuid": "5792d1e4-ee87-4db4-8840-aa9a08fde602", "value": 8187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755690417, "uuid": "47019885-2954-4c3c-89f3-d7a7bcc04db2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690417, "uuid": "eea0c6ef-8e96-4ab0-8ed0-71ceab3979ca", "value": "Meeting_Notice_dtd_20_Aug-", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ea039c-7da3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755680231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680231, "uuid": "c8d19e2a-a2a2-4ac7-bf47-5d93106e71b9", "comment": "Malware payload", "value": "7d5e942811fae95f3b959510ec41d2fc", "object_relation": "md5", "Tag": [ { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680231, "uuid": "b9116bd6-682a-4681-852d-8765c07a1c7e", "comment": "Malware payload", "value": "86d6e00b9217d0928f4c86ac27145981245fb8de05ae5721d22515f7d3a6adfd", "object_relation": "sha256", "Tag": [ { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680231, "uuid": "c707efd9-72a8-485d-affb-4cb03d6e0b65", "comment": "Malware payload", "value": "2abbf596758530a40f7b4aeca58d442d4f36e713", "object_relation": "sha1", "Tag": [ { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680231, "uuid": "6e01d69b-11d2-4e35-85a2-0403bc3c5e5d", "comment": "Malware payload", "value": "a15cc75d15b662939660cb86601270117e3ef60236bd8ddf6b965a6c379a817f75755b0cd2bb56399c82d55873a4db2b", "object_relation": "sha3-384", "Tag": [ { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680231, "uuid": "a58486d4-5af2-4d9d-80c1-9efe9e1efbe3", "value": "T10F4533B6627E88BACBC5D33707D111308E84576527E89DEE7792EA9D790CC06848CCBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680231, "uuid": "ffc865a3-0675-48b7-b2b8-4fbc800af963", "value": "24576:ouYvjTI8mLfXggoyURNveXv25ATDSGh8FKlEvRi3rk57:obrCLfwfRp625KSGhEKavRi3rk57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680231, "uuid": "f4ab0df4-1a6a-4edc-9c51-bc533428132b", "value": 1164505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680231, "uuid": "9bfe67ac-2ab7-40cc-bda1-89112c0f765f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680231, "uuid": "042d837e-04cd-4ce2-8c6c-3ed55d110975", "value": "nV8g4NE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ab3883-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700625, "uuid": "178e2c23-23d5-4e2d-bad1-fcf4366f30c3", "comment": "Malware payload", "value": "d58ab6b58e06759d80356593351e13ec", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700625, "uuid": "2c065bc9-e87c-4f8f-bb2e-91a226bf1384", "comment": "Malware payload", "value": "875fe196f5fe07f41bf7f986e3c8478d6677097ca4ce0c8d064dc3b814e7ebdb", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700625, "uuid": "0c805350-fcfd-4b25-aacb-2256968c1f39", "comment": "Malware payload", "value": "318739dd8adae05de03b863bbfade80a6edc6419", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700625, "uuid": "c725cb14-fa02-4f30-a53e-c581a7679dfb", "comment": "Malware payload", "value": "3162ba2134f1c8a57aa231744a88ffa14beaaf8c733a59b2a86fc4c1f23743c92ceda1a6f70d7e587ad0aaec09602bb5", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700625, "uuid": "fb80420d-a28d-4877-bf0f-8c0f1ae1040a", "value": "T123F57B06EA4E7DE1D0450878117297BA8D36DD645B35A0E38ED03CA9B53A1C3F63E73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700625, "uuid": "3537dafb-13a4-4469-98c3-2b6cd555b23d", "value": "a326436fefcb2117053a862e77488aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700625, "uuid": "439a8e87-68c5-4c87-8b93-9f5aafff77ae", "value": "49152:9cLr9EoxDAtK1I2w1EOyWeCS/wcLMYqPoawAczuh78h7OF6VKBHanRJJu:WLr7dWxQ9alXh78h7WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700625, "uuid": "121b43b2-1034-40b9-af5c-ea5b5f5745ec", "value": 3587344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700625, "uuid": "b0e369c8-4258-46e3-9ca0-52d259be014a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700625, "uuid": "66a5ea4f-1331-4816-b15d-fa2b8287d784", "value": "875fe196f5fe07f41bf7f986e3c8478d6677097ca4ce0c8d064dc3b814e7ebdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d854a2-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureHVNC)", "timestamp": 1755692946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692946, "uuid": "04d0ff5f-93b6-462f-b626-6848001810c0", "comment": "Malware payload (PureHVNC)", "value": "5db9a032b31a74b6b64614424818899f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692946, "uuid": "4c329e11-0901-482f-86b4-b1c8a6a2fc3d", "comment": "Malware payload (PureHVNC)", "value": "87e1e8c1e29eef773344a54e0d6b518406822840b50f2866ce9c2128b767b37d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692946, "uuid": "bf1f7744-ac7f-40c3-82ff-15248e7d1ad3", "comment": "Malware payload (PureHVNC)", "value": "321fed7b3948ebd17f7c32c5cd7363add6269467", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692946, "uuid": "701f5a4f-7529-40d2-a82e-2b015bbd4ac6", "comment": "Malware payload (PureHVNC)", "value": "09402da30c23657f2cec14d87525dd7c63ca72b8ccd92812c839fada5006be0b6b48b70ea775b53d87de2712ed338fe3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "wndlogon-hopto-org", "colour": "#118BFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692946, "uuid": "2857df04-585c-4bb6-9d2e-13bb67fc8fd3", "value": "T114A633BCCB31C826FD8A233AE5A24849D0F35F49D56D8170E51BF2799D3681E81F6AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692946, "uuid": "0871645b-6f42-4be4-bca1-2e88fa85e3ad", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692946, "uuid": "965df0dd-1a5a-4633-8bf4-c67b03548961", "value": "196608:JbBFX8dk2Qooc3E9nD21nTenDpng4pNPY8LqEjNKXmjL46AHgFw:JMm2Qzc3NC1gUNPzLRKsOww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692946, "uuid": "44556027-acc7-4a26-9940-e338d094767a", "value": 10199040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692946, "uuid": "a274382c-2fdb-46db-bb88-32f3b21a2440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692946, "uuid": "54fb8146-0601-4cb6-ab54-1e20d9011746", "value": "Setup_v181_x64_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a21993-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721543, "uuid": "d1adfd40-6dc4-4d5b-894c-0b2435edddc2", "comment": "Malware payload (Mirai)", "value": "737f0e9e7a9ef3c4d7de315e1b63fa67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721543, "uuid": "2cbed6d7-0ab2-4078-93fb-7270409d60ce", "comment": "Malware payload (Mirai)", "value": "899219cdee80516429df60c1b1e4fdd47722362e8387c7126442e14028c3a8e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721543, "uuid": "08025c0c-4634-4d0f-9b2f-1117e76f3f34", "comment": "Malware payload (Mirai)", "value": "f5767c3c97f1894ff9211a10fc1d680794f80148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721543, "uuid": "9bcf9a38-f347-4c82-b73d-2cb5219f21eb", "comment": "Malware payload (Mirai)", "value": "1a07714a816cbf421a8e22c29e5bf64ac9a1f0fd8092bad8c2f49454195c216d18de7400cf4a5a2176b4fae81bdfdc4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721543, "uuid": "a1d0419c-21d1-4b8e-b939-c0eb8956b16f", "value": "T172333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721543, "uuid": "348e3c7c-b8b8-4e39-af6b-7142cf5eb627", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380DF:dsfIBZeNlJDFj0imvppqmUJP6Lc80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721543, "uuid": "29624fdf-67d3-4953-8da3-1966a3de1623", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721543, "uuid": "d58c63fb-3986-4531-b258-37081dace499", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721543, "uuid": "590c7026-84dd-48f9-b054-3f7f71e31a60", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a23965-7e0b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755724658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724658, "uuid": "18fe274f-bcec-47f9-8a72-facb4a18f5d7", "comment": "Malware payload", "value": "127efc60b5f6a365e55f8d00eb503db4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724658, "uuid": "6b260683-ead0-4e30-87c7-019df4094f3e", "comment": "Malware payload", "value": "8a5c8682b77f463cb332b47cc28a00b9b25964e45ed7c2bac13f8c9a5ee8bcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724658, "uuid": "bc146b98-0140-4ad2-bcc2-a944955b7e28", "comment": "Malware payload", "value": "15fe3fbe2b5dc9ee98bd5cb86952208690fbff97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724658, "uuid": "e46acb3f-2fa6-4313-866a-a172c9959977", "comment": "Malware payload", "value": "8b492b74b0787e990d27b0b344097f0f2f2a690c3ff960fcf1f5409dd0988de32645d1c0460f28d4b5946c063fbe01fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724658, "uuid": "23393c6d-9853-441e-8a9c-b189210064de", "value": "T1A3D633DA739825E6E8CDA33DEB90946282F5B56B1F7881B397F488901C631C4EF75312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724658, "uuid": "97ac8548-f119-4ddd-98e4-50dea6977d05", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724658, "uuid": "f6bb0ba5-6865-43ed-8024-ac9750427590", "value": "196608:KCuglI0W8UA54uQ00eiurHmmRnfMP/XRL+/uAqMVVby4py2gTUJUE+21nixd:KCuyW8ZVDiuCuneXYWAq4ty4pbUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755724658, "uuid": "fad312de-42ca-49d9-9309-d15e2c2db924", "value": 13796797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755724658, "uuid": "f49d54ec-8d02-4f9f-9c40-0ac4103d1922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724658, "uuid": "e43b6c38-c70b-4854-99bd-bd13fb952411", "value": "Loopdash.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59325173-7d7f-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1755664635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664635, "uuid": "c2c0e52e-e522-46ec-8181-94fe210c4763", "comment": "Malware payload (ValleyRAT)", "value": "9382e22cf1465c8ce2bab114454c8aa3", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664635, "uuid": "61b72d15-3529-4b9b-b14c-24832d0491da", "comment": "Malware payload (ValleyRAT)", "value": "8a6a78daeaa2c7df560e13bc5194b3dbfb4f32bd6f1c6efee1fd7c5705a0f390", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664635, "uuid": "e802d43a-d3e8-47e1-af6d-fc62e2bbc7c0", "comment": "Malware payload (ValleyRAT)", "value": "560bdd2c7e3b5ec89f2ecfc953ab70b5da6249e9", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664635, "uuid": "8163d292-418c-4ad8-b9d2-433bf548b1fa", "comment": "Malware payload (ValleyRAT)", "value": "5de230571e7b7421b03128d6aec4751f73e4501c2674c1dfd2b1226e2b6b01aa956d6f3781ac7214fdc23c81daac4360", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664635, "uuid": "49e5ab7f-e0a2-4ecc-8492-612e9ddd7259", "value": "T1A3F71742FF4D4DD3F16941708C994791B372B875B76283C712682B6AEFAB3E40EB5290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664635, "uuid": "07cedfa9-dd39-4adf-838a-18f897eeeb69", "value": "a390d022a0030cba50701fb84cbcfbac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664635, "uuid": "99f651d5-cf69-456b-9f47-9ba68b00f5a4", "value": "24576:q1u8cskSZlGzbTQhhoFXwMr4lmljy9dtjGiU:qYl5zbTQIwMr4lm5y9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755664635, "uuid": "a188bedb-ae61-4b79-936f-19e98e490ba8", "value": 73382400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755664635, "uuid": "6833d2bc-4f54-415d-9ef3-2c93c9088a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664635, "uuid": "28956bb5-4510-4087-9671-ffb702d7e61e", "value": "bui.6852082002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067865f4-7dfe-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755719043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719043, "uuid": "e41336ea-ae1e-4a7a-8945-779d4f70f5ae", "comment": "Malware payload", "value": "35d9306908d059f27fafc0a6f5e260ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719043, "uuid": "d6b51e64-0c25-446e-9e3e-e291cce5f8e4", "comment": "Malware payload", "value": "8b9f0a2711881edb3f46c3d1aafac531cd3aaac5516f347811a490350d1c22b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719043, "uuid": "8bd30817-b4dc-4811-ac2d-1f13642805ea", "comment": "Malware payload", "value": "85c688dc604f56eb0856c13a1413bdc23df9acc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719043, "uuid": "4456eea3-cd45-4b10-9524-7c3e21bf8524", "comment": "Malware payload", "value": "f79a30c4537fa1b68d3928bf7640a21ac673e6cde7cb1b6b260b773c49dfef733b018e89f48aa9b97b377a919f0e5334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719043, "uuid": "97c209a0-9da8-45e6-b07f-2fe4735039f3", "value": "T1A8187C5263F609D6E9FB9A3489E65213DA73BC063F3086CB324C176A1F736E04976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719043, "uuid": "d15202e1-3c12-4503-adaa-47bc21e2fd4f", "value": "b2e426b78f8291fe9c5a3f4a8555e42d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719043, "uuid": "2895e208-7f18-4fbd-ad2b-fdf3f2c2afc6", "value": "786432:oo4cR8Ez2LD+RZiZ71RE/x+npgPVlcmHp7:oobRbz2LYxDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755719043, "uuid": "a6836ca7-c81d-4bdf-8fb0-2e9e6ebae08c", "value": 85390985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755719043, "uuid": "87c35629-9fe3-46ad-ba6c-3271454534dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719043, "uuid": "ec77efda-ebf0-4611-ae86-7c6b0132534a", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdafee2-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755671431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671431, "uuid": "f8d84379-45ec-4f96-8b09-0ce1c746599b", "comment": "Malware payload", "value": "969f2365839d4f452e24e3b1962f8531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671431, "uuid": "97ad67be-9508-436e-803b-b5ff4e80a0a8", "comment": "Malware payload", "value": "8c21e0e16b662b66c0a33c77eebfd5dfe2a4096996911d9d07185132d4f43c68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671431, "uuid": "6720397d-2079-4895-9296-5ea79f31a295", "comment": "Malware payload", "value": "bcc20887ac552b5463c7f1e2a0889f508f63a849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671431, "uuid": "78cec2b9-7bae-48eb-97d1-e0cabf5450a5", "comment": "Malware payload", "value": "95a924b3d921b088b8a7aa162e67f313c07481cb29c9164195cd95b2a4649d6e624457a474e5f4e7363976fb952b827e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671431, "uuid": "fcd07719-ef63-4676-8985-88dab7380940", "value": "T1B0B3029D32E071DECA67D472DF986C6CEA51747B871B5203A02306A9DA0D89BCF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671431, "uuid": "fca12f1e-92f9-4d62-a2e3-bdfc5cde0f6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671431, "uuid": "20f748de-057a-4b55-ab22-1b986fd1138f", "value": "3072:2aRD2W1bM0kj+TXpGUfAuu3u/L63j/bGovmLv:xRjbNkj+TXpGUfAuu3u/L63j/bGovmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671431, "uuid": "323f9d11-fd0f-4194-8e7b-e6d84443e61b", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671431, "uuid": "0dd1d49a-c674-4e12-a4af-0df9fccd3994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671431, "uuid": "6f0ee8be-5fb8-4ad4-9fd5-021dfb5df6c1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77217846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee84853c-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1755693233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693233, "uuid": "9635b8cf-ca71-48a8-83f7-0c0c4f245110", "comment": "Malware payload (SnakeKeylogger)", "value": "a72fbedc6515423321246d11c82db58e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693233, "uuid": "e57e4ac7-3e6c-459a-8e6c-da1e2685786b", "comment": "Malware payload (SnakeKeylogger)", "value": "8cc4684d5b4c41db041acab6550e5d8d110175b4da2dbe79da04b62cd21b410a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693233, "uuid": "128249fa-f6e7-4ae7-9bc4-eded13ac911c", "comment": "Malware payload (SnakeKeylogger)", "value": "784867a6c3a76e1947919914e166411208fd1e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693233, "uuid": "938bff16-8c35-47ab-b8a8-9451ab79bda6", "comment": "Malware payload (SnakeKeylogger)", "value": "bb23240b02674cef96b58d1c84e69c198e3a012ddfbcbc7f5bfbe0c888f3fe175566ff0bc3078e592f5153dce9678e55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693233, "uuid": "c7045b92-01c0-4057-8bb5-eb05d2443ef2", "value": "T11505CFAC3200B99FC457D9728DA4EC74AA646CAA930BD20395D31DEFBD0D696CF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693233, "uuid": "ce3df67f-4e7a-4d92-a33d-58bdbbe56e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693233, "uuid": "5dad7718-cca7-40d1-85b1-07c4023966ed", "value": "12288:MXTOwBxSGxz9MVl8d0lGEskv+7MeLYLNB9HcsUEgZn0g2cpL5/XUJm5Kzhan23nw:MxBEGxml8mlX+sL79Hn2Zp269kE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693233, "uuid": "3176ade3-aa72-4780-ad36-3512aae2255e", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693233, "uuid": "db6b58ef-8911-4aef-af68-9dd3d685f17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693233, "uuid": "b1893861-5e7b-4501-af68-3d95bc701c24", "value": "ISLEM \u00d6ZETI_70868191-1066-1034 19082025 nolu TICAR.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8be0da8-7db0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755685948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685948, "uuid": "89e9820d-c31e-4a3c-8b03-b9502d32a270", "comment": "Malware payload", "value": "a948b29a86df95be45e7839309676c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685948, "uuid": "b2629670-db95-4fe0-81ba-8c70ef2140f7", "comment": "Malware payload", "value": "8d1db6511eb46ad8b9c00d732b1e45ae7a962bb1f6fea0ed53184d3fd5f89a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685948, "uuid": "73773c72-9a9f-4c72-a374-65602a9cfe0c", "comment": "Malware payload", "value": "6c4819c020bf0b6ae86063bbecbdf1f3f03c2838", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685948, "uuid": "06b3ef86-d40d-404e-843e-411767498d38", "comment": "Malware payload", "value": "acddf3dc9a528bdc1d2a8bf040ea43abbbe19207002dc16fd4316ba1db8363215a678ebf7a9223b61e7dd33ffe480887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685948, "uuid": "a1079215-42e6-4dd5-b671-bd9b4cb1ceef", "value": "T155187C5263F609D5E9FB9A3489E65213DA33BC063F3086CB724C176A1F736E049B6721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685948, "uuid": "1d008b3e-40a0-43f6-baef-9e4464dbbb39", "value": "b2e426b78f8291fe9c5a3f4a8555e42d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685948, "uuid": "ea903e36-ea03-4985-9993-efcbeee915f1", "value": "786432:Ro4cR8Ez2LD+RZiZ71RE/x+npgPVlcmHpu:RobRbz2LYxDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685948, "uuid": "90fcea1b-3bb9-4be3-b785-e9afbabb8a94", "value": 85764861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685948, "uuid": "83d63b98-e1b1-4f4c-beaa-9e179513b2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685948, "uuid": "e9dce2f2-3f10-4373-9d5c-91903e51b3cb", "value": "v6.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2d9e01-7ded-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755711937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711937, "uuid": "6127a79d-1612-4697-bd25-a9a7b87a63a8", "comment": "Malware payload (AsyncRAT)", "value": "05c52ee5988fb5b0ea1bd043466f653e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711937, "uuid": "d978c176-f9b9-4064-8677-0db2fa3f359d", "comment": "Malware payload (AsyncRAT)", "value": "8d3ac938de54bba136f4c8ae000dde1c3e80392e57f3a7b9fdc35646edfdde16", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711937, "uuid": "ecd24847-f403-4525-838d-3cc7f0c3cbe7", "comment": "Malware payload (AsyncRAT)", "value": "cedb3fdf5ab0b924a3557685e47ee23ad3d7e2b5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711937, "uuid": "20c95308-14ad-40b4-a4d4-b45c487868a7", "comment": "Malware payload (AsyncRAT)", "value": "828f9886e6b97fc51be9ba1df58a0215878377033d9e3fad5387d5a88db9f9e2a179213df398be020934d6d3715a6fd3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711937, "uuid": "0d19f4b8-afff-4df9-9b14-7bc196302752", "value": "T1390288561E8B9144C5B0C376AB2C01E0EE2D92EF432525C93A79D5EC37290D7C1FE9CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711937, "uuid": "2aee759b-a9b9-4372-9635-953bff28be52", "value": "96:oI4RQLS81j32yheaxm7s97omE08mqHQCsG808mrkcn42Jpb:aRQLS81j32yheaw7I7GpHp+SkSzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711937, "uuid": "cfd2fcee-46ea-4209-815d-6a6c7a4ae825", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711937, "uuid": "a5208692-3a0a-466a-b55b-1ed0b1d22539", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711937, "uuid": "0a4d7747-0277-4fce-a2e5-cebea36c6814", "value": "yrsa.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73390af0-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1755692596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692596, "uuid": "8a4d8c96-cfe5-4bc8-9421-70442cccec4d", "comment": "Malware payload (ACRStealer)", "value": "062ede900515bc66d4d6cd8f7b7f5282", "object_relation": "md5", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692596, "uuid": "05f61b73-1e2f-4670-b2e8-7494abf7edc2", "comment": "Malware payload (ACRStealer)", "value": "8e4270a5523a188988fb878d91104bc9541d15c944e8ef9c0d46bb94c2f1d34d", "object_relation": "sha256", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692596, "uuid": "dff4d24c-e662-4d3a-a724-5680c58fb960", "comment": "Malware payload (ACRStealer)", "value": "4d70ccfec58d5338f1d0a4a93ac87d5b7a60bd99", "object_relation": "sha1", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692596, "uuid": "40abdd0d-9016-48f3-b2da-5315ffd6cb36", "comment": "Malware payload (ACRStealer)", "value": "536362d09375ee34dc8dcaa2e1ec06a0717ae1895d06b0752504400fb9716a0424b770967b6a59eb7a36dbe149f2fd56", "object_relation": "sha3-384", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692596, "uuid": "fa6b6b79-3c6b-4268-b913-7a7dcdd77813", "value": "T1B4B633D9443D4CEE25F318A4015D7C13A3B6E4E7F34EFF1F066225659EE71AA229828C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692596, "uuid": "605b371b-1426-443d-abf9-42c2ae2ffc57", "value": "196608:DgA4pEcb6aR+AjD2oSl5lKrQg0ont5XCxrwPABr8PMmfbybwuG9GJUmnxhhX:8ASvWW329Crt0onrXCxrwPAV8EwpE5xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692596, "uuid": "9aec39fb-3a40-4159-8f84-5cfda2f4b4de", "value": 10453393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692596, "uuid": "36cf1e03-da59-4f8c-a820-fb1f843d6d94", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692596, "uuid": "2025600a-57e3-4a46-8bb4-ffce9f13c185", "value": "\ud83d\udf1b \ud835\ude3c\ud835\ude58\ud835\ude69\ud835\ude5e\ud835\ude6b\ud835\ude56\ud835\ude69\ud835\ude5a\ud835\ude59 \ud83d\udf1b \ud835\ude4e\ud835\ude5a\ud835\ude69\ud835\ude6a\ud835\ude65 \ud83d\udf1b.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319dd1ee-7e00-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755719974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719974, "uuid": "e34a69ac-a593-4a10-af92-d1aa82517b67", "comment": "Malware payload (Mirai)", "value": "ba6213d7438154c2bc3f74c696b456af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719974, "uuid": "3311c085-3490-4383-bdb5-08c0227b89bd", "comment": "Malware payload (Mirai)", "value": "8f867bfb6df55c54b68be2c1943bf4b4ba8d748cc30fc9857c54bc263fc304ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719974, "uuid": "3cef3bcb-7e8f-4126-8106-cac5c87ea9be", "comment": "Malware payload (Mirai)", "value": "fabc595d7d4c7ab365d6aac6a4e59e0a40ed09c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755719974, "uuid": "68e9f399-c159-41ae-aeff-781d0796f3bb", "comment": "Malware payload (Mirai)", "value": "e0b33cd44cf877e2f81527cdbf0edba9165ae45ece7452c1f956d8454851043e6a3239c54146d13ca0720052586b925a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719974, "uuid": "4acb7533-4375-4353-b9f5-d3e7aaf5aeca", "value": "T1A3F2F153833D014BC54FB67718AF683A8C50535ACADC9797AFC8A0BB9527E704B98372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719974, "uuid": "71c0bbca-4b14-4fb4-acb6-1b866400e1c1", "value": "768:RILQZBLX8TEYN93eJjtZRN6FhODtQpPv+vATNe7RVnbcuyD7Ufyq4:OLQP78J3uJj3RehODtCPvVo7bnouy8qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755719974, "uuid": "617bb00b-ab78-413b-abf5-2378b00477bc", "value": 35152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755719974, "uuid": "651aea8c-8c3c-401e-8cb0-39f652fd1dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755719974, "uuid": "a2dcd489-cfe8-49f7-ad04-f80f41ad0904", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e67bf4-7dcd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755698084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698084, "uuid": "766388af-c6a7-4b39-b2b5-6bd1279a3737", "comment": "Malware payload (Mirai)", "value": "3a9393037281334f2e0742ca5c61cc24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698084, "uuid": "6877b8aa-add6-4345-84c2-d2e1f0a38913", "comment": "Malware payload (Mirai)", "value": "8fb9d7eb84836b8d660d2e94b290bd1f22e4b589a717f56731bce22c1be36b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698084, "uuid": "4c36059d-8e35-404a-b3e1-af10022e3d99", "comment": "Malware payload (Mirai)", "value": "e9d91e0df9cca2c8fac79ea595dd2d8720737f24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698084, "uuid": "21202da5-6f85-4719-bd75-f5f3724c568b", "comment": "Malware payload (Mirai)", "value": "2690c7f5f265b36ada8dfe04dfa0ea2f7ce188c21af31ebb2ff6ab66421394ac6a9786d8ecc77cdb70ad9fdf9e13ef76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698084, "uuid": "365b56fc-0fec-4959-8209-e61097e696e8", "value": "T189C31945FC415B23C6D212BBFB5E428D3B2A17A8D3EE72039D256F60379A85B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698084, "uuid": "b0b48669-ec76-4e7c-b2db-e346829bc094", "value": "1536:p836hz9G5F3qZxaF2AwQv1SAFmn4VQGRTgiHM0c4dvjSkSBHlenwywGBIgWo9RbZ:G36taoZ827u1Sn4fRUiHM0BSj0qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698084, "uuid": "1a62da10-84a1-4db3-9051-d1c38b4fa7f2", "value": 129760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698084, "uuid": "1dd6b453-23d6-4f82-9187-da37b1a10152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698084, "uuid": "4c6cc840-0c53-47f2-9d91-791e14f6ae18", "value": ".syncd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70911c3-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698830, "uuid": "b124ae5d-e2c1-43c6-b1ba-6a90234ab0bb", "comment": "Malware payload", "value": "aa414171e719d6f9471a7b1a16a6bbc9", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698830, "uuid": "d12a1de4-8718-406d-af40-447526b82724", "comment": "Malware payload", "value": "8ff745807f23037871a770495d2bc30e4be7be2d5dca93bcaeb210e6b1597ee6", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698830, "uuid": "9ced2665-0ee0-4231-b408-127eb9187fc5", "comment": "Malware payload", "value": "e2889821fca8047f046af1c90ad769fa68f3fef0", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698830, "uuid": "ec07febc-d1e1-40ef-ad77-03380b962115", "comment": "Malware payload", "value": "11c8feb8ea47b286ba125c66172f1b34a10aba0a5eb91570ba9d5768b40ebdf09909f531c81f2fc5a47f187864c7e129", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698830, "uuid": "f14b3e36-2ccc-410b-9a56-af8ad4ea44fa", "value": "T12745F6D3B8888951FD2844375097BDFDEB169CCC9CB8A10AB24472F950B2D722237F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698830, "uuid": "eb007d0c-2321-4dcf-9552-ff7fc694fec2", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698830, "uuid": "e9d103d3-3a94-4038-acae-354c216183f8", "value": "3072:Kt2NPRXVKeyou7yT/9ZRZ5vSa3rNEAYe111MHvd:e2bXk8usJcvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698830, "uuid": "ced0c2f2-9069-4081-b7fa-09938adc738a", "value": 1204736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698830, "uuid": "c2d02266-39eb-4d09-8d95-8e6a59f88f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698830, "uuid": "e7558856-a115-427a-9daf-f05e85883257", "value": "8ff745807f23037871a770495d2bc30e4be7be2d5dca93bcaeb210e6b1597ee6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ecfb36-7daf-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755685432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685432, "uuid": "97fbe9a2-da9f-4a41-b594-5f6a78aa156a", "comment": "Malware payload (LummaStealer)", "value": "27c218a635cb5e1642da4e25f17efed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685432, "uuid": "0449173c-487d-46d0-8d02-056fee976caa", "comment": "Malware payload (LummaStealer)", "value": "907dcc646cf6e223fe3112994cb44cd7b8df4889f4d90837066a691e8d49b2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685432, "uuid": "7dd0eab0-53fc-42a9-abb3-45fc96560346", "comment": "Malware payload (LummaStealer)", "value": "2495f10c07e7920cb0c0c6258b449e3d5afc7a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685432, "uuid": "1658e5cc-a0c5-42e4-823c-2d6dbcad9942", "comment": "Malware payload (LummaStealer)", "value": "8b191dcba15d39cb713e0fedda583ee667fd4ee63a1a2ffabf4596d9928ac9fbb88c6abc0dbef5f6ae0c54ba75f552fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685432, "uuid": "8d34eede-a23e-49cd-ba02-22ed4a3d66c0", "value": "T1CD45C004E879B0DAEDD740719F365201E8327D7F4F342ADB51E896B01A5AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685432, "uuid": "6a6ecf5f-6e3a-4b7b-be68-548f52b6ded3", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685432, "uuid": "f137a0fa-1379-45bd-9a60-517a322beb56", "value": "12288:uCzxSeT4ZAtm8eKCk0zbVYmdh8EWcxassWJt12KfISmUjRQneEgD8i1V5tIi/D8P:uqHhP0Hccxas/JLDBdpnIi/TCMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685432, "uuid": "25ec4ffd-13fe-43bd-844a-e7b50c9c1e5e", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685432, "uuid": "32e513d6-88ec-4ee0-8938-ccf443611d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685432, "uuid": "7349c44d-3857-4291-949f-114eed8c7c30", "value": "go-soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b51eb32-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755695992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695992, "uuid": "7fb820bc-0741-460a-8856-c5503bf564ae", "comment": "Malware payload", "value": "4d1d76bb3ab8dff3a7c8362d5667d458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695992, "uuid": "5cd844e8-4b54-4786-87fc-fb289a9d822a", "comment": "Malware payload", "value": "92f4fdda0cd9f0b734c3f68cec7e7cf72dd0e2ee740c63eca63ddbb560f2ed53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695992, "uuid": "fb2c34df-1b0b-4d17-b056-e4d9ebdd724e", "comment": "Malware payload", "value": "0a957960b0da3136fb332db6e9c5274773bd7ec2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695992, "uuid": "34b56053-731b-48c7-9e40-a01772f4ec09", "comment": "Malware payload", "value": "103f2ea3a39f6345dbebf27d399dadfad9e6670e7b2475c606323a512be4c24d9cf1a940fb17ede5a558a0cbc5864ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695992, "uuid": "a82970f0-51ec-4dbf-9aaf-636748fdb059", "value": "T1D675E114E83970DAECD740719F765201F8327D7F4B342AAB51DC96B01A5AEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695992, "uuid": "5e17c0cf-e444-4e50-a408-e0c20103dc8b", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695992, "uuid": "0a6b8256-f02f-4ec3-9acf-5019b4877045", "value": "24576:3qHhP0Hccxas/JLDBYKJ8qskVLr45FM2X1mHRlILE2qMylJ2NCpo:aHhMHccxreKJ8U45F/XaafqMoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695992, "uuid": "d8f995cc-97e1-4372-9bff-30c485ac3b53", "value": 1574912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695992, "uuid": "1fc91b3a-bcd8-4c26-9e3c-099a767195f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695992, "uuid": "e038ff15-15d5-44cb-9baa-7c2e73955935", "value": "SecuriteInfo.com.Win64.MalwareX-gen.44833496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cee5f99-7d5b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755649099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649099, "uuid": "4e2922da-f6f8-4ec2-9e69-0963d99293d7", "comment": "Malware payload", "value": "d81dd1969e26f13083de81dda1a19246", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649099, "uuid": "525ea42b-a05e-4020-9ab3-cc54fe0b8cff", "comment": "Malware payload", "value": "936a7cb99d7fbd1df916648d082bedc9be21973ef2784365196feb0e6041620b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649099, "uuid": "ef2d28a2-0fdf-4ec4-a78f-e0e7dc3cf32e", "comment": "Malware payload", "value": "fbe9560b694008aa9b28f544ae8adedbec1fc677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649099, "uuid": "0a049a49-c45b-4a07-9aee-a840e6fa1caf", "comment": "Malware payload", "value": "d4e7ec5ddc4d7833d0a81ae6d378981bc241a99e1f6754ffdfa45c9122a90ae13e1ad1c19c2f5ef943ab52d3dc10d531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649099, "uuid": "7a33cd39-f353-41eb-a08e-c1af955758a0", "value": "T142B3F19D72D071DECA67D872DF986C6DEA51747B831B5203A02306ADDA0D88BCF543B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649099, "uuid": "f4d797c8-3d8e-4a8b-aada-5e96741b1acb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649099, "uuid": "26daa57f-235e-4931-9949-40f92df4111a", "value": "3072:X5D+wG4tKu1w1bMuOy1IYlHWJfTHMjWTivmLv:X5ywjYJbXOy1IYlHWJfTHMjWTivmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755649099, "uuid": "39831de2-512c-4488-bf4f-aa99b720a8a8", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755649099, "uuid": "3f6cc683-fc3d-4218-a4bd-458063393149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649099, "uuid": "3dfddb9a-6787-43a2-970f-21bc5418f840", "value": "SecuriteInfo.com.Win32.MalwareX-gen.78131312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0edaafa-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679466, "uuid": "6a4fde85-f565-40e8-8507-c5a346db5691", "comment": "Malware payload (DonutLoader)", "value": "df480b6398a8d052e4da7d282ef9c1ce", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679466, "uuid": "e89769f9-4f3e-4a9f-a798-6440bae40e2e", "comment": "Malware payload (DonutLoader)", "value": "93d9991e5d18a7e5af18efa27e7680f40b4262d02750174bd6cdcd64ef42b5f6", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679466, "uuid": "3bd22a6a-a0af-46e2-b0ea-536bd3ab9976", "comment": "Malware payload (DonutLoader)", "value": "17cd3e9b882f796266d5ffa3a90fa1e2028ccb9b", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679466, "uuid": "971c998f-ee48-4b5b-8366-c51ff7ca9a9d", "comment": "Malware payload (DonutLoader)", "value": "01ee62360cca054d87574e2d650d2c1bdbf03eeeaf825118dacca1fdfc713f0307b21c96f75bea106ef80536a611446e", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679466, "uuid": "40c0cea6-eb5c-4d7d-9bca-1ab007a8cce4", "value": "T1D5B5BFFF05780F8221623E5E65A5B4847610DFEAD78E7F747E118078A2670AE130A79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679466, "uuid": "2e6d30d0-e525-4836-affb-b7e9d2a028cc", "value": "24576:j8aXBwUziaoAC/mIb0Vz+SA/5pFENeQgkm0PLAxQ2/gnMXYHA+z5LGgTWs6bFhj2:jnflC3/5pyxp5DHD/yzbFN9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679466, "uuid": "6c21e07a-22f5-4156-93ed-c729629b0338", "value": 2296705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679466, "uuid": "eb05f740-c9bb-4ee7-b76a-73e1c851b153", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679466, "uuid": "b4038954-feba-4f97-9080-0719afa70337", "value": "93d9991e5d18a7e5af18efa27e7680f40b4262d02750174bd6cdcd64ef42b5f6.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd0223c-7df8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755716669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716669, "uuid": "d2703319-f45c-4596-9977-85f4b17129ab", "comment": "Malware payload", "value": "070734e26f842e298f634b4876c84a6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716669, "uuid": "41ac53b3-83ed-4b00-96ca-b43e38a97668", "comment": "Malware payload", "value": "93ff25385a16a079346527c29a55e3099ca8a550c30aea1e49e6acfc67d13da7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716669, "uuid": "0c8c3827-630b-46ef-97b4-95f91073d031", "comment": "Malware payload", "value": "fb9a4fddf66af517e1a20ec2e3f76fa89be2b675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716669, "uuid": "75d12767-1f98-4f5f-b5aa-10502b058826", "comment": "Malware payload", "value": "c0c758276d9675bc6af400d8de4602c367e5b2eb8a7e865c5310546155d5b24806b34b54bd635f7c2008f2b50aa919e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716669, "uuid": "4adcdb7f-c5e3-4778-b2e3-abfda76f5fb3", "value": "T1A355D008A87990DAFCD340746F759151F433BD7B8F386A9B40E89B601656EED0A3F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716669, "uuid": "0e42a415-50a7-4662-b67d-7a39b7de5f10", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716669, "uuid": "de26e18c-9e4b-4574-a5c4-9dfa8f1d7ade", "value": "24576:LAgGqsICddG7l/zd8UoA1deThPE/DsWyR9kUVuG9s/v:M7qpCddClkGDsRzkEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716669, "uuid": "ffdf3f3b-6903-4c4f-9ba4-0043d7dda5d3", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716669, "uuid": "176c9b78-30d1-4bb9-a0f5-450861ee711f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716669, "uuid": "8c41a907-9900-492a-88cb-4cd0ebd3ae95", "value": "Gam3UnIock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b6b4b8-7db2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686687, "uuid": "fe206759-13f7-445c-b6bc-f83abc689504", "comment": "Malware payload", "value": "21a6dcd01afe618bc32233eb1338abb2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686687, "uuid": "06b6a31c-b398-4913-8b20-84aaddea26fe", "comment": "Malware payload", "value": "95e2f2823c3c8c6e5ede8ea087891ef42ba4ea66d5beb9b4f603f61d26f58a63", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686687, "uuid": "3ef7ac44-6c5b-4ba1-ba61-8ed7a20ea50a", "comment": "Malware payload", "value": "81f7024a6d9b9a068a97c7df7fc66edf1c6c59bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686687, "uuid": "c139b2c1-7afe-431e-921d-6a11d6bbc73a", "comment": "Malware payload", "value": "ebda7eedd1eb8ef8a0990543b878ee55f053f73e88663205b70803b58cb70af068c9f99a23ec0080635a01c27afbf861", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "paste-ee", "colour": "#9BAF8F", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686687, "uuid": "e6899c68-0f00-4c25-b467-1ce86a458a0d", "value": "T1C8F3541D06BF5070F1B768898A79D067560F5A42EBADC6BBD8A4CF4C86F400D6EE19CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686687, "uuid": "d51116c0-a6ad-47c9-8835-46e215f7eb5f", "value": "96:rvPWEF1MpoqTBuVWXvzk4DmcoxvG2qZqhOVmUg3U/q0WlbYx/byeWVTxVm9o0TXT:rvPW9p886GEwTQwQJ+NXaX9TA2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686687, "uuid": "a8f0a2b4-fbb8-4a52-a35a-ad78d38e2ebb", "value": 160050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686687, "uuid": "0fd05391-f3fa-419c-a12b-d31189ad57e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686687, "uuid": "f341ff1b-7460-44b6-b1b4-62c8aaa120ae", "value": "95e2f2823c3c8c6e5ede8ea087891ef42ba4ea66d5beb9b4f603f61d26f58a63.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f9a5ed-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755652711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652711, "uuid": "a44fdbe5-188c-4f38-9a4b-649509a7a465", "comment": "Malware payload", "value": "5d461b900f5004df177c5ab514611d63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652711, "uuid": "61b71c49-13a6-45e7-87f2-164f23d46169", "comment": "Malware payload", "value": "95f315df00b9d723cdf68687f6c251cb8fff44d6a5533645a7a53343580607e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652711, "uuid": "9f8893cf-8de0-45d2-9c73-a32ddfba187c", "comment": "Malware payload", "value": "2fc3dac01ed6ccdfd09b76aa16f7087194338158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652711, "uuid": "ca4fa8d8-37ef-4266-962b-def909cd21a4", "comment": "Malware payload", "value": "1549a12166f45de3b4ae170dbe1b6d7ddd2d4c029caa433945e6923b22bc6d0bad98fa5ad8d27f2cb3d7bbac5e21b1a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652711, "uuid": "dbb10635-c6d3-44d7-92b8-7a6236f3c329", "value": "T1C4B3E09D36E071DECA67D472DF986C6CEA51747B871B5203A02306A9DA0D88BCF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652711, "uuid": "34897654-ea2d-4555-97e1-3bb69bb1c798", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652711, "uuid": "4e2c79cb-b12e-43b1-8c1d-95d619910a52", "value": "3072:V1zA2UHn3N1bM4g83RXsseJ1yEqPwfEoT9vmLv:/zA1HzbJg83RXsseJ1yEqPwfEoT9vmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652711, "uuid": "7757a0e2-5412-46b8-acaf-b1f2915597d1", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652711, "uuid": "c1fd6aa9-dec2-4b9e-b7d7-e1fb13da96a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652711, "uuid": "4edb69e3-172a-4f9c-b190-6a0cd65bcf38", "value": "SecuriteInfo.com.Win32.MalwareX-gen.84582316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c04d4-7dd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755703000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703000, "uuid": "6ded12f0-fc38-4859-8959-1ca1998a647b", "comment": "Malware payload (LummaStealer)", "value": "264209bff659d152dd59800888ef00c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703000, "uuid": "bbf0fcce-e5f5-4009-b43e-42f09f93de7e", "comment": "Malware payload (LummaStealer)", "value": "96024042d0dea1ab62db489fba07834dced65fe1e2d09b33ccdc41c388d11609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703000, "uuid": "0c45259e-0620-44d0-a717-5774f270598d", "comment": "Malware payload (LummaStealer)", "value": "be7a91a756591f4dc5219a93a81b7efee4ecff7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703000, "uuid": "3d03f99d-e3bd-4f66-b819-be3762931544", "comment": "Malware payload (LummaStealer)", "value": "1debf6b0cf93b44d11680aebc190caf24117b9b3ce6e8dce054ddb4ead3f538b4877e0f593a98df0205350d8c7ad4173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703000, "uuid": "215d3a0f-6dd7-4031-a55b-031f05c0f33e", "value": "T1008533CD7E9CB5A3D48A29F6400B630637DD30BE696BF3010550622CA89FF91761777A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703000, "uuid": "a194bc09-8e06-43d7-aa6b-d0f616e2e574", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703000, "uuid": "64c08933-a558-40e0-b4d3-580865b74c27", "value": "49152:GzkppHMnd0YedYYl5kPCGwTQCZVmxYN9:5ppHs0zdYYOCBTxIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703000, "uuid": "e370275c-11ac-420d-9a15-110a25f76fa4", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703000, "uuid": "099ae2a4-3e4d-41cf-a26d-b3ffd12572c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703000, "uuid": "7cd09069-a482-42b9-945a-277d4eba434d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20af4b4-7dfc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755718445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718445, "uuid": "609b3de5-8e4e-43b7-a0ba-9e3069e060f8", "comment": "Malware payload", "value": "b565402c7d247f1ba81d7afb5325f719", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718445, "uuid": "5eacec9b-ed95-48f1-bc1d-4e16484970c6", "comment": "Malware payload", "value": "968afc9af7de855d201135e6f86dfb8c47200012a57800458a02f7d56d65b440", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718445, "uuid": "fbbb06cc-1ff6-475d-8a84-91ccf93f3008", "comment": "Malware payload", "value": "58d0aa049b435e5bd2a904460f3c66a421219079", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718445, "uuid": "c6f1708c-4dfa-402a-91f2-4da21f36d310", "comment": "Malware payload", "value": "b2d3e7a8c25cdbba91fc6d73ba4a7798eb5147b3ebb5077cfe43ca31a0e488accfadd61c03cb802365e402409b0165e8", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718445, "uuid": "9f2dd875-8798-4c63-ba22-5600f8a6979a", "value": "T177E44B9EE4032F4AC336D1FB1ACF85203CAB42BF8ED25B077569A8536B80949F43555B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718445, "uuid": "f72dd600-6621-465a-9d33-55a798e8c250", "value": "12288:E9g2mTqNO6RmDxNxgOJ5QLyQkzQIMrhrV4o:EETUm1NKZLyTpehJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718445, "uuid": "d4fbd12d-7a70-443b-b372-3565e7bd8564", "value": 663531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718445, "uuid": "1578cd79-6305-4762-8f09-c0553d32d14b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718445, "uuid": "116ea1ab-1399-46fd-a9e9-63ac93674c02", "value": "XCta7rtexU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec3dee9-7d66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653854, "uuid": "7414a0ac-a437-4e6a-a24e-a3b319c74885", "comment": "Malware payload (Mirai)", "value": "c7dd596abb35d214348c0054adb0a413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653854, "uuid": "a985aa29-4e66-4939-809e-94add51a6404", "comment": "Malware payload (Mirai)", "value": "97486451f4027c87159a9893c129fcd2255ab390515eb2afb0f332671ee8fe55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653854, "uuid": "14950aa4-0370-449a-a2fe-51aaff1e7a81", "comment": "Malware payload (Mirai)", "value": "811ce64475280e01e4cfb2e9eb06b0df0eea83ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653854, "uuid": "0ca108b0-842e-4bb5-af7c-7a842de68f8b", "comment": "Malware payload (Mirai)", "value": "6f839fd4b68226d1112194fa0b54370ad68c99529f8eed4df5a62ca4e5986542e27c4a7f8d009ae21c61367bb97553a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653854, "uuid": "cc75c9a5-b2d9-4d27-aa21-8c6e3b7c601a", "value": "T120B2D07970048894FB324C79F570C74BBB6A65A9C0F9327A1DE17C0D9A8D01F55BC299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653854, "uuid": "4c79eaca-7446-4a0b-bc84-be731d48be6a", "value": "384:4+N4pwj4su1ohLyUM1NDPOPNzhcuXoxN+sZq9nrBPGK72/1ZDg3JnmBhymdGUoph:gpb1KWUMHDPge8oxMnrtGKaUlmBs3Uov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653854, "uuid": "e8763ad8-e52a-436b-8451-773297d56ca4", "value": 23988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653854, "uuid": "62ae1326-dad0-4c9a-9fc0-669104418532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653854, "uuid": "08001ba2-3a03-4810-b448-68b188038957", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60eedb3-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700493, "uuid": "380fcf43-4e0c-48ce-96cc-7e2cf7d0aee6", "comment": "Malware payload", "value": "4d65220ae44f0444fe7d76edb3076c6a", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700493, "uuid": "7e6f6fbc-8795-4da9-9e01-3fd4153d2e9d", "comment": "Malware payload", "value": "974e926751512a51af4d96137e1e90f3f8c5ab50196a2468cbdf49f048bdae76", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700493, "uuid": "624de963-ad4e-4cb8-b9fd-003f8179c391", "comment": "Malware payload", "value": "043cc54b7a050bb1baf2e5174bf67463068c382d", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700493, "uuid": "7b40410c-c4c3-4a89-92d7-1629faa97e5a", "comment": "Malware payload", "value": "8156f63d1f814e87b24074dce5bb8866abff11b903d1724e18fb7affcb6957331294e5e3955533f85af2345f752d0256", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700493, "uuid": "637a31ad-534f-44d6-afba-836d9f273cec", "value": "T11236AFC3250492FBCD208932B02D66711A219BFFC317A5A176D85F2A6CEF584593B93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700493, "uuid": "26243a1e-4044-49e8-a15c-40ebda864309", "value": "68179373e81889b94c38a1cad3519e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700493, "uuid": "5bd6e4b7-db7a-4f6d-b244-458bb22f70e4", "value": "98304:AsQSpGp5y6pvpFI1Ulzxc+NYHKHOH9HHHHHJHHHHrvulsLw2dz1uKez3H3lV1Fyp:eoGp5w1UlzHNYHKHOH9HHHHHJHHHHTus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700493, "uuid": "1c21492d-dfea-4e72-8631-6bd46b34f7c2", "value": 5342480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700493, "uuid": "924f2122-2abd-4748-8e00-4f8a1f28c3a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700493, "uuid": "32bb9454-da81-4821-b022-165004b76d46", "value": "974e926751512a51af4d96137e1e90f3f8c5ab50196a2468cbdf49f048bdae76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350ecad3-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755693351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693351, "uuid": "8f94c9a8-f5f3-4a07-9383-b3fc262619d3", "comment": "Malware payload (Mirai)", "value": "2d1b53fe90fae9dfd9d8a47a7d270858", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693351, "uuid": "c912889b-9fbd-4d5f-b234-8c313a4a7dd7", "comment": "Malware payload (Mirai)", "value": "97593cef05ef18ea9ebbe2d9295c027caa49ac06fe642c2943df908a705e8ac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693351, "uuid": "31870ce4-5010-4853-b2ef-bb4a6e82d9f8", "comment": "Malware payload (Mirai)", "value": "6c3729deb36ae444aede44ed057c493dffcd4ff9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693351, "uuid": "b1016f68-30a5-48a4-9fab-6efdb32cba26", "comment": "Malware payload (Mirai)", "value": "66038a5634668b1f8bffc28a6e19c0dab6b8cdd23df79abf537336f93d1391f34665898ce7c914d9e7003f714039b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693351, "uuid": "9cf3591e-5097-4817-a414-ce9aad1d8339", "value": "T1A5D2E061D9489834C6B45C3ADBA7821772A52BF040FEB13734449EC83846B8F93B83D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693351, "uuid": "86c928e3-c3d6-46da-9907-56c7224d1f48", "value": "768:PiavIGk5wn7VXqV04AxtExn5g+oOwVFEts3UozU01e:aOn+0Jig+B8qwzn1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693351, "uuid": "b83f698c-54fd-4736-947c-6ed0c90fdae3", "value": 28888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693351, "uuid": "ce8be295-447d-4911-88f4-2890685d8f51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693351, "uuid": "8bf3cd8c-cd7f-4105-a9f1-863642b5e4cd", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a514d536-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755693539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693539, "uuid": "cd4b2a15-5929-46be-994c-918861dbddd4", "comment": "Malware payload", "value": "6aca1227cdbf4b0f06bb3aeaf7e09ad8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693539, "uuid": "e85b0a74-7ae6-473c-b6e5-437ed32865e1", "comment": "Malware payload", "value": "9771d73b2669a49a7db6deee3775dc05cc56563755796aa1b71103711fc7f4e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693539, "uuid": "7ccb46b3-ef27-450b-8d83-bafe90614adf", "comment": "Malware payload", "value": "806a6f0b730cbd32459416ba6df73bf8d857a2b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693539, "uuid": "987f8857-c919-4b0d-8b5c-3893fd0c6dbd", "comment": "Malware payload", "value": "92c9daec8cf52897201b7dd358bbba0e20895c1543e398b6e0bb55b6f60e71801c23c8f097d4f5709491e45555de8ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693539, "uuid": "952ae2d1-07fc-4eff-86b1-3cbd99b6fe08", "value": "T11FE633103BD00DD6FEE7E2399621CC78D2307D5723A3CE9B42D486611E631E92E79E96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693539, "uuid": "6d0ab4dc-901d-4085-ae60-f87dfbc28e8e", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693539, "uuid": "6e056225-8525-4515-b12b-848c249b4f1a", "value": "393216:AuL8pCvHbxx9rrruCnDvV+53SM8+Aaxg4CDQR:HZVvPyCDvV/M8+Aaxg4CDQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693539, "uuid": "9ad9f7b8-d43d-4bbd-96b4-41a9e8dbf161", "value": 14085169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693539, "uuid": "96ffcb12-9034-432e-80e4-52eaf09e7ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693539, "uuid": "f3401ea7-ef12-485a-9e69-d9bd8a54da03", "value": "Up4pc-Compressed-Download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1d0c4c-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698978, "uuid": "30982def-9338-4bdf-9109-1fb4b6cc0c30", "comment": "Malware payload", "value": "1475f34f4123f717860e3452372a6d2a", "object_relation": "md5", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698978, "uuid": "16a0434d-0e5d-4f91-ad83-18ee0eab2093", "comment": "Malware payload", "value": "97af96fa18993d499c63d3ca9f2fe198ca637422b86451b7fbdee1da435e5b9d", "object_relation": "sha256", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698978, "uuid": "43063baf-5d87-4baa-8780-7552842e90c1", "comment": "Malware payload", "value": "94504e018cf16406f2f81e39d53db55e558105d0", "object_relation": "sha1", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698978, "uuid": "6616af18-136b-4594-b58b-e6dbb8d9a9ee", "comment": "Malware payload", "value": "7904b2d015b104ad7b68f73f3eaebbc83abf6c1d5143476539c9aff48dc49eef6cfa66e14733fb2e561fa41cf49eee24", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698978, "uuid": "1812a244-7088-40c9-a9c9-af9d74aff8e3", "value": "T1F07533F16EAD51FE2306A10636D268221540A35EF1780B47F6BB80FC7DE28D65D2D27E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698978, "uuid": "a99a0bfa-2ac8-42a9-b953-091f3ce001f9", "value": "49152:zTElN5R7eAciF6z9B7SktUn/C9tlipK8HIu06YFCm:zTSd1ozzdtCSl8HD0qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698978, "uuid": "465799fb-f2e8-41be-b22c-84b4af327d7a", "value": 1588876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698978, "uuid": "74a9bfe4-3be9-41eb-86df-1c6787653973", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698978, "uuid": "b4271a87-b192-4ab6-9390-437f5f97ea9e", "value": "97af96fa18993d499c63d3ca9f2fe198ca637422b86451b7fbdee1da435e5b9d(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e622fcb8-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701809, "uuid": "fa868b96-eced-468e-a264-c12d5e17f321", "comment": "Malware payload (Mirai)", "value": "dd13d2efad3802b2f03a5e5437e36451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701809, "uuid": "f175965f-35a9-4dbf-95ec-5dc9bc0fea57", "comment": "Malware payload (Mirai)", "value": "97f261df61a4b09fd018a823566f3c9c11faf654fd3c21f30e3e900b3c0a7099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701809, "uuid": "886b45d6-575b-4b79-b169-d343709a8a6c", "comment": "Malware payload (Mirai)", "value": "5fb9ec077c8b3388c3b974c46e7d6b943cbcf9ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701809, "uuid": "320d15c3-03be-4d89-9c52-81582eede8ea", "comment": "Malware payload (Mirai)", "value": "6f647fb5c52b7dc2e1fd1031fdd078d944ce4de8e05195e96f7e3b77966a72b0177e25fdffe60149d7d7fc29b8cb9b64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701809, "uuid": "58118d3f-fa2e-4f3a-ace8-ec0acfd29077", "value": "T159B2D0CC65543084CA8D7C7C2B8D4A664F6CA190BAEDCB26E354CD98B3BEA4F345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701809, "uuid": "daafb2f7-7c8b-4108-b81d-c029ee0b66af", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpsZqSWv3:4QlS07FUXqIYSXQKquUq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701809, "uuid": "0899ef84-f927-4609-b948-6feb6e89a5b2", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701809, "uuid": "83c98b70-2b79-48d3-a84b-d1015ba90031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701809, "uuid": "41160cf5-a201-4df2-aa8d-1827a1161782", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869a5326-7dc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695206, "uuid": "db0e28ab-d088-427d-a3ca-22a199a949f4", "comment": "Malware payload (Mirai)", "value": "aaba399161fa6e4f344a6457025fde11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695206, "uuid": "77df69c7-7bcc-4f2c-9fb0-3c95b6dd81c2", "comment": "Malware payload (Mirai)", "value": "980a6e9e4b20ae09a971908057b12347b474600d1109b67ff3d283509e163e87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695206, "uuid": "ac857505-f7bc-4e6c-b488-b6aa36c9a95c", "comment": "Malware payload (Mirai)", "value": "e845c07b4d83c369d03d9b3814aaedaefdcb22b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695206, "uuid": "6b9dcbaf-9e12-4cd8-a482-7e154f49a0b9", "comment": "Malware payload (Mirai)", "value": "a6cb2778cf9898c30b0214b9ce90ffc21995e973b3a5e247877d24f247693a92f625d8cb3818082c29f319d020758946", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695206, "uuid": "1939914e-6236-4a1b-b9df-8f30b1651367", "value": "T1C443F14100087B6CCAB20B71EFAD94CE63BF0DFBA9F941222156852D148B7566DB5B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695206, "uuid": "ab22bec3-2312-4153-88dd-1203a3a6ea4d", "value": "1536:gDn0xJll9IODsuubribUdqirGiCmtv1uzi:gb0D5nxbUd67mN1uG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695206, "uuid": "164718af-9efc-47e4-b2af-f31f595eda39", "value": 60544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695206, "uuid": "73bf493f-d8d6-424f-94b4-ec4130bb0ba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695206, "uuid": "3932aba7-4df6-4e70-8cca-27cf636d41f7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad18c66-7dcc-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1755697978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697978, "uuid": "2fc4f4fc-fb52-449a-927c-cfd844a16dd6", "comment": "Malware payload (Stealc)", "value": "8c3652dc5d35d8cc27a027d0c90632b0", "object_relation": "md5", "Tag": [ { "name": "77-90-153-129", "colour": "#B0D9C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697978, "uuid": "46ad7589-d5e1-498f-aa46-91a1fbf1ad52", "comment": "Malware payload (Stealc)", "value": "98ff524fbcc50cc6fdf41ab2ab24526db858fed97104d11f7a233db8eb95bbc5", "object_relation": "sha256", "Tag": [ { "name": "77-90-153-129", "colour": "#B0D9C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697978, "uuid": "fb714014-33b8-48b8-a7a5-8da9c078e942", "comment": "Malware payload (Stealc)", "value": "abdd547f03110ee2bca690d2708ada3687dd61e8", "object_relation": "sha1", "Tag": [ { "name": "77-90-153-129", "colour": "#B0D9C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697978, "uuid": "10255665-e1e1-417e-ad9d-3f3d9982c32e", "comment": "Malware payload (Stealc)", "value": "6cfc1f5f860175e79fe3d1aea2c6bb93174c7451c889f690a3c85fc392026556c01e7575b08c692dce971910c314baca", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-153-129", "colour": "#B0D9C8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697978, "uuid": "76f64d31-5b73-4c6d-896d-06ca02450bb2", "value": "T1C8A55A0A6C9C03BBD0DE8271CC7E70527A707C940F6E23C72A61B7692BF26C95979B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697978, "uuid": "08c6b712-d3b9-421f-bfd1-e51027e49532", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697978, "uuid": "9a8fd4da-092d-4155-af0b-af376915216e", "value": "49152:quuTxEl32shRfjlVR+VDCjjOkr6wAaRLLd:qDyRDzLLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697978, "uuid": "b0d2d502-31bd-4f35-a869-68b879378da0", "value": 2204248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697978, "uuid": "99c04abb-61ea-461e-a504-befee08684ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697978, "uuid": "9a100ec3-7225-4ce4-96fa-975fc99c5ab3", "value": "sdHookpp.64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425ddfe7-7dc4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755694232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694232, "uuid": "258d18f7-9877-40b2-a046-e670c3a1c4d3", "comment": "Malware payload (Amadey)", "value": "9d1ee858be90e34a8e70bdb8ad2c5e5a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694232, "uuid": "4ebb3592-c2ea-43ea-8743-9879d1103246", "comment": "Malware payload (Amadey)", "value": "994065e0f91b950d6b8b8d5cc42817f22506323206740c570fa1db33746c4de1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694232, "uuid": "ee78209a-722e-48b2-983c-5300148cc869", "comment": "Malware payload (Amadey)", "value": "d5f4c923e9d3d812edab4df85667f45b6c66f358", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694232, "uuid": "8b8ed817-4481-4ff2-80cd-ca7829c10b43", "comment": "Malware payload (Amadey)", "value": "06eea131c0ef3ed7f9fa71268fa24ba3aa57ec2ef30b765373e2a428cf4993ef780e4d01f9008992da748d809a57c868", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694232, "uuid": "002aaf88-221c-4351-b301-b5c4babad851", "value": "T15B651202BF919B53D1AA0B3859F3A3245730DAA07F574F538254AD60F8867E93F825EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694232, "uuid": "073cc931-9faa-493b-872e-32440ccb8064", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694232, "uuid": "631ffd68-58ad-4258-a149-39859317c1c9", "value": "24576:oVD0244gJEaVEuTnojXUA9NjmpJoxzVJ6xdO0FRRl00Al4scmM:oSFlPMXUA9NKpJo5VJ6xdd7BAKKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694232, "uuid": "410485d1-d6e9-45b8-9604-60a1185cbdde", "value": 1543716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694232, "uuid": "be456d5b-490c-42c3-9ac7-cb46f3e389c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694232, "uuid": "92bfa0cd-1186-40f0-b805-6e73bae31f75", "value": "am.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3346bf6b-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755677457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677457, "uuid": "b25a062b-3a74-4ec5-81e4-f2bb7f48001f", "comment": "Malware payload", "value": "78510e92c56cd6295cab19aabed7b40c", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677457, "uuid": "0637ad76-b17a-4577-95dc-2e2ad4960e23", "comment": "Malware payload", "value": "99a2109c9dce37107497d4f0cba37ea280a644f3ce267a7c3af5abce69d089bb", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677457, "uuid": "0ee0f953-ff2d-4ccb-ac27-6952b7ede703", "comment": "Malware payload", "value": "e946e73632764b76a0ac3229892ddac1d837dd74", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677457, "uuid": "1ab5bff9-aa2b-41c7-95b5-21fb2f06dba3", "comment": "Malware payload", "value": "9022afb59e17573e97371a40100195c6b518f7131fbbdad8a65f4679f053fe41a4bd095db03d61299455e9affda71ff5", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677457, "uuid": "0534bf21-22b4-449c-a2d4-a53cfff99359", "value": "T1ECD6330108D97D3CF690FBB4695BB9A289F74CAD5FAC82BB2B4D34C18016D70B2355B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677457, "uuid": "b900b5e9-7672-4ed0-91ff-92c8260d03ad", "value": "393216:L2291Xa607BBNO79Oir9P9dpxsRQKZdOMg:R87HNOZ9PzpxsRQqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677457, "uuid": "ab659678-4cfe-43ef-b134-69a3cb0bdd72", "value": 13142918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677457, "uuid": "1c6bb193-8087-47f1-80fc-f2f995dee249", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677457, "uuid": "b6d3ac5a-c844-448c-9cb8-ae8f62a6c279", "value": "100words.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11b4040-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701800, "uuid": "af6c5a6b-8751-4d28-82d1-a218bc8da64a", "comment": "Malware payload (Mirai)", "value": "60ac55333fb9ea921f6b8073a42729d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701800, "uuid": "9d3b18a0-d719-44cb-a8a4-a851aa07a59a", "comment": "Malware payload (Mirai)", "value": "99b6c4ffe34ce75a9cc219c0ff4c43b268df0990828d02663852dc6bb2df8c9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701800, "uuid": "cfa3a2f6-5d83-488a-868b-e5f34c16cfd3", "comment": "Malware payload (Mirai)", "value": "4642c720f31e7643f4db799eca60dc64e56b74cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701800, "uuid": "52e41186-edf3-4d31-a4c3-a12457b933c0", "comment": "Malware payload (Mirai)", "value": "56918194a8b1e06a4ffb1b08a44ad7e8509142a93867bc2daf3b2ddcc487b0a52ce9658952b8502d2445dd62dc5d2531", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701800, "uuid": "70684c9a-1b9e-4d0a-8a86-084b59562502", "value": "T149336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701800, "uuid": "30aae787-5fd5-4868-9b70-c79f1721e86a", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701800, "uuid": "91c9103c-fbb1-4239-af6b-c6b9745b1a02", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701800, "uuid": "0e397c66-4b58-4892-82fe-a116051ae067", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701800, "uuid": "d71b9bb5-53e9-4f91-8c55-360a45f93c0b", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d6ec9c-7d6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755656422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656422, "uuid": "fa0265df-9300-40f3-865f-f864d84b7088", "comment": "Malware payload (XWorm)", "value": "a6dc975f4298f25dfeb66794032d4f80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656422, "uuid": "00ecdbb5-d661-4ec8-a29b-d32fb8b8f328", "comment": "Malware payload (XWorm)", "value": "9a26897e1061fb4e54e78b427a4b605aba58e30243c3c72fc4d3d32fe58a703a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656422, "uuid": "2cd084cd-619e-4876-b61f-d1232c35bab4", "comment": "Malware payload (XWorm)", "value": "443409df2da0b232d60aff5603a75c6b02dfecf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656422, "uuid": "92d134ce-c044-47e4-8506-64c7d001bbc2", "comment": "Malware payload (XWorm)", "value": "f9d5abcc8ca5bfb02a884010c1539bb75917f05295e312c191261016317870c6d6b544d6bef4a55e5e9eaf17f4f79ec5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656422, "uuid": "60d8dc27-022e-4acb-ad7f-c32e1d2016a3", "value": "T16323E009A5DCD827E7BE0BBC9DD2EA8543E65A390292F39FBC40B5C4285E3511462B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656422, "uuid": "3a41dde6-c9c2-41af-8bd0-ce88bd641cd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656422, "uuid": "cae8452d-cc93-47e1-8cb6-9c31930b7718", "value": "768:bBjWX2Exr65oNAHCOQF21Chp2mSXrOrOKX+NaZA9ij:pKZ65UAHrQI1ip2prOv+NaZA4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656422, "uuid": "84621bb2-f566-4d92-aab8-aaea11e25d18", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656422, "uuid": "503ad841-946d-430f-a538-2f0fa9b3845e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656422, "uuid": "503281cd-26bc-45ab-83c6-1e4ab485cd3d", "value": "a6dc975f4298f25dfeb66794032d4f80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61cd65c-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679448, "uuid": "ce901661-67f8-4341-980a-56ef28a58cfd", "comment": "Malware payload", "value": "0a6818d5ba0cdcc554e26332525c8e58", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679448, "uuid": "032defa4-da74-496b-a725-e5b7c6f5ffeb", "comment": "Malware payload", "value": "9a683675bde5f0d2c4fdb8c3c6e29402948b56dba90f29c7a71628a9f8e07716", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679448, "uuid": "229f6ed0-678f-436d-96cc-8c9f86989e8f", "comment": "Malware payload", "value": "32d4f3fbd475e6d3ffa32ff8f0fc23c7046d4691", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679448, "uuid": "c52315bf-7dde-4af5-a4c3-efda5714de0e", "comment": "Malware payload", "value": "6717257a05951376060b4ab6ebb8a35113c2f658f7ce89087964a6ffeaa238542396f4d3c65b04775dea683d9d4f135d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679448, "uuid": "907a9109-2da2-4c53-9936-2e106b0e38f7", "value": "T103C1965BCBFA4572E4EB073979F307112770C0404BA3DB5F1CD1522AAE667A84E627A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679448, "uuid": "3b3f3fb6-d71f-4704-8592-fed357f4bec2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679448, "uuid": "74cc9a11-8547-4a35-9e20-946daa34625e", "value": "48:6f/w+4ihkMY4/bE//wB75qt+sdvv68M0mqcmZwuDb1gKWDnnMGJkGVUF6Xeh31u5:9iiezqnB9b9wZEuehoSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679448, "uuid": "7775f7fe-37e3-4f3b-86b4-f4d696d83423", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679448, "uuid": "73728d20-a29b-4e58-8b6a-a947073cd5b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679448, "uuid": "3e05f1be-7e84-4bc3-a135-53b32254a563", "value": "dormerxo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eb9b3e-7d66-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755654005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654005, "uuid": "cce56565-3b16-406a-9a41-e039b9b97fc2", "comment": "Malware payload (AsyncRAT)", "value": "70ea9cbb260b390a137085defc8f5631", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654005, "uuid": "9965dc09-9d8c-4816-b9b9-cd3387a6d4b5", "comment": "Malware payload (AsyncRAT)", "value": "9a772866ea2c23132e23bc41023531f17200f4bd1a764fdf998ee2fe17f4b7d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654005, "uuid": "9551ccb5-89da-4b1f-8563-ed40d369128c", "comment": "Malware payload (AsyncRAT)", "value": "dcea8ccdaead0899c8ee8baccabac43e0241e3d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654005, "uuid": "d4ad0b84-f5e1-4615-88d1-cbc74e444a3a", "comment": "Malware payload (AsyncRAT)", "value": "cf24525e757a859abf381c2e4ae4268cbfe16e21283d795b058b184334afc2798ce1d1d572f55259d286eaeb973d5cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654005, "uuid": "ba756c9e-c520-4fbf-a4eb-72fff40a255a", "value": "T165C40E533AB85981678601332DC3381390B3A3D2CFC2BFD96587B6792EBE527784594E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654005, "uuid": "80501b7a-a80f-48e0-ac2c-86f99c96f0f0", "value": "3072:Ym4qt3Wsy63KJRPhtY7YBznGbvFNWlaRXrxwj:Ym4W3Fy63ahy76GEM7xwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755654005, "uuid": "92896310-aa97-485c-b219-174c2f5d782a", "value": 548609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755654005, "uuid": "9e7906a9-9b8c-4288-ad68-a84a76830a4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654005, "uuid": "0e8a7b2b-d94a-4804-91c5-64ed3226fb2b", "value": "hooks.mins.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd807c8-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700585, "uuid": "f93c3f41-64a5-4906-9158-e1bb44f93067", "comment": "Malware payload", "value": "f343d8887e636fdbbc3b2741b9d881ef", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700585, "uuid": "8d8ff27f-eda0-48ba-a0c0-ff7b119b04e7", "comment": "Malware payload", "value": "9aa2db0b28a990c233919522a23ce940323da8876eebc1d71f326974656b4317", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700585, "uuid": "56a3a6c1-6cf5-4019-b9a9-9d9f54c8d6f3", "comment": "Malware payload", "value": "1244d8ca4aa60aad7d4844ae072761eb21efb090", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700585, "uuid": "3e045d97-7f6c-4112-9ada-ce8c09e4cc25", "comment": "Malware payload", "value": "0cfa7e00177538879eae7beae5f4b2b1b5decf4fd62937a9e7af3716f913a72b6618084f8cdef291f96ad5240d806e31", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700585, "uuid": "31bc3e03-eecb-46b2-8ab7-96f9c34bf2f4", "value": "T1A636AFC3250492FBCD208932B02D66711A219BFFC317A5A176D85F2A6CEF584593B93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700585, "uuid": "449fd031-ed0c-4f3b-b01e-6ac5504d0f09", "value": "68179373e81889b94c38a1cad3519e74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700585, "uuid": "6584030d-8129-49d1-8b8b-aafb8ad30f6e", "value": "98304:xsQSpGp5y6pvpFI1Ulzxc+NYHKHOH9HHHHHJHHHHrvulsLw2dz1uKez3H3lV1FyY:1oGp5w1UlzHNYHKHOH9HHHHHJHHHHTuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700585, "uuid": "792df7f5-aec7-4b04-b893-d2d30a873718", "value": 5342480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700585, "uuid": "09d1ca46-ed0b-49c3-b837-f88c7fcfc532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700585, "uuid": "2f34a6da-da1e-4005-a7b1-f0f2fe188953", "value": "9aa2db0b28a990c233919522a23ce940323da8876eebc1d71f326974656b4317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81f0c12-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755706563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706563, "uuid": "7324def1-391c-4eaa-8809-388d48ef46b7", "comment": "Malware payload (Mirai)", "value": "9c5c436711fcfd29bfff4f4c38a7a20a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706563, "uuid": "0ffaffac-1306-4296-bc9a-de58139671e6", "comment": "Malware payload (Mirai)", "value": "9af69589bf24c39e7c22ff1b994f86b4fe95d7b104169665ba247a38fcdc99de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706563, "uuid": "2a62a384-bd0c-4bf7-a5ed-17d117d1c997", "comment": "Malware payload (Mirai)", "value": "4de7a321dfba41127139189dfa79f25702de65f9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706563, "uuid": "b8d36a94-118f-4089-bad6-5ef7d6d88be7", "comment": "Malware payload (Mirai)", "value": "693e535ec907f802de6cdb0db81957fac945b6e0324f506a33e710248c0c4c2c0489b52eedb24c72953e00a3396515a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706563, "uuid": "6b884965-0edc-4ab5-b687-d79367248d8e", "value": "T1241169DF21A46280045ECDC53A9A4C085F89CEE1E89CDB29ADFC4FF651D6A287549F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706563, "uuid": "70896f35-19e4-46c1-8584-29220a48e34a", "value": "12:XiVUMxCWEUyNI9kxwAU/ySKxWHUzyFUePCUskVUwjvUwxRI4qKAU9JeUpx7+cAU8:ymW5yNIqcfKxzLKs1aMA1xlHvig0HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706563, "uuid": "523aa63b-8937-4b22-b7ad-91824eabaebe", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706563, "uuid": "916beadb-65f3-4c7d-b5c1-598927d9359f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706563, "uuid": "1fb96e0d-7308-43c6-9c1c-af9dbb6cab9e", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b427131-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1755706246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706246, "uuid": "26719886-79ae-4eba-8fbb-59fc7177b02b", "comment": "Malware payload (Downloader.Upatre)", "value": "80ce6cb4e6de0cee1293a8a6722fd3b5", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706246, "uuid": "e3b1030c-9a90-43f3-90d0-850098c038ac", "comment": "Malware payload (Downloader.Upatre)", "value": "9bb8f16bdc28447af27b37781ce0bd213b0c51332943b62f29197357db811de0", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706246, "uuid": "9b94e36f-b9b2-4b0a-9bf1-8ccd37d7b355", "comment": "Malware payload (Downloader.Upatre)", "value": "6daee38238478bc767afda287c2e2cbe4c47564f", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706246, "uuid": "23654c90-4c8c-4d44-b7f9-d7c9c99f29ab", "comment": "Malware payload (Downloader.Upatre)", "value": "0ab5cae844512d74ed5479faf6668d85d7c432959b89225e5987f27a6dd89a97c6508526ca6318f5e2e0cbd3f5735f19", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706246, "uuid": "2962a554-6e91-47ed-bf05-162fc8e58307", "value": "T1A2D47D01B7A18034F5F70BF4867EA1B8593DBDA24B2580DF52C07ADE6A35AD0AD31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706246, "uuid": "c794e55e-88b2-4f33-9c11-4aa7ac9d10a4", "value": "944ace1d527485cffbd2cae8f17ca27b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706246, "uuid": "ff19ab9c-4f5a-4131-b889-7d2821997bbf", "value": "12288:fRVa6rB6B1KuZXEYGwIHCbYWBI9Px7yr1le:pEM6B1KAUYGoYqIv7O2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706246, "uuid": "8fe916be-792a-4511-b330-4ac8ef6662a1", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706246, "uuid": "f79b7d52-b5a5-433a-87bf-36dddaf42ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706246, "uuid": "44047c74-50d4-4b14-98f6-e331e406f77b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb855d0-7d6c-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755656457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656457, "uuid": "1a1940ac-129c-4668-a89b-ba8f292bef93", "comment": "Malware payload (AsyncRAT)", "value": "d7d469515fe4e010fbffd101a39cf301", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656457, "uuid": "d3230b3e-0e54-4703-835d-78a953bbe8f8", "comment": "Malware payload (AsyncRAT)", "value": "9ca26756a626927585afa233bf55997191b2d00ce11a8e7972eefbefbf68ac4a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656457, "uuid": "cbf9b123-70bb-414e-84e1-593ac9609180", "comment": "Malware payload (AsyncRAT)", "value": "1d50f235002c32ea9ef75d6c9be4defd12943c99", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656457, "uuid": "e8a639ad-986e-4cf6-81a9-550ab1f6eb99", "comment": "Malware payload (AsyncRAT)", "value": "2c6447aeb8c8bd51b8ed1748f03e6312034dac8c3c608cfc1a21c28d062d62c0df7c89985df852ee79d814c9cad79974", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656457, "uuid": "7fafde10-c3b1-4232-9c95-481547f883ca", "value": "T133842319D8F12BB4DC9EA19961F977B3BC96EBD8C5DA0D90BA3940D401A00C1BB377D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656457, "uuid": "1ed6c8d5-2c22-4c0b-a4a7-b11fdb0bd789", "value": "6144:YdmTZR1AHrThCVAbXAJ9IN3ipR2u2BUyYmtHsfB3PRXmuRpMV:AaZi09INSP2uoUydmB/Fm6pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656457, "uuid": "fecd54f8-3d27-4bc5-afab-fb1158212a0a", "value": 373052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656457, "uuid": "811c9ad6-aa2f-409d-82ae-11796f397a83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656457, "uuid": "4306ee96-b73e-43ff-a681-9fcb0335b724", "value": "OnlFans_Lena_Paul__3678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fd3d8b-7dcd-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698315, "uuid": "d72a692e-744a-4250-96fe-a0451450b9aa", "comment": "Malware payload", "value": "7ff1a6efe00d7b78094d3eb1740f179c", "object_relation": "md5", "Tag": [ { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698315, "uuid": "3ede5e39-287e-411c-afe2-062c9637f574", "comment": "Malware payload", "value": "9cd62dbace3324487124787127cff7c63a9f005d8d3aff9bac28c437e5caefc7", "object_relation": "sha256", "Tag": [ { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698315, "uuid": "b377f7da-c38d-4963-93d4-b17f8626ba0c", "comment": "Malware payload", "value": "c57a95d05d2f82d68204431bc8bd4d99bb1e4811", "object_relation": "sha1", "Tag": [ { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698315, "uuid": "34943714-3f63-469e-b2bf-d2af6f33ec2b", "comment": "Malware payload", "value": "a027cbeca44a02a6473f8085e7295f15266690bc38e2ac48cb838a2b66d55a8a8ca1cdba87ef5c0d4625187c4c93c372", "object_relation": "sha3-384", "Tag": [ { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698315, "uuid": "ac21cf35-fe80-4afe-a656-fdd522c96422", "value": "T106865B7BE16710D8C5ABC174C25BB371BD30B46500347E6E2E60D7B6AF62E601E6EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698315, "uuid": "2369055b-79ec-4010-a901-2124f947682d", "value": "11ec149f1a1a7008be9ae73504b4745f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698315, "uuid": "59d83474-7cb7-4bb9-b5a1-4676e33d47b0", "value": "98304:nJ0FJH/VVu41t1hIIMKEFQMcMC8Yssz0t0Ah9DzJoPtu/+9NY:nJAH/7ueOK+PJoFsOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698315, "uuid": "d32bf5b9-4ac7-42c4-ae27-7056c5112cac", "value": 8526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698315, "uuid": "6ab61ba5-bd73-454b-bf64-005d53bd0f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698315, "uuid": "f82049b8-dbea-45a5-938c-8bfd98e92f72", "value": "BQT_0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931cc79d-7dad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1755684489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684489, "uuid": "73e30175-2095-4e95-b738-f2de7f8f4a4d", "comment": "Malware payload (Meterpreter)", "value": "e122b31ff4c80c0e591df5a067fb56ba", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684489, "uuid": "531bd431-0568-4c81-953d-a3fee173dd2c", "comment": "Malware payload (Meterpreter)", "value": "9d6e37a0d3d1110efbd8b6c09b328cd72a72c02be62122b97bc2490c85ed0059", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684489, "uuid": "2fa534ab-432b-4f58-bd1d-451ce11121e3", "comment": "Malware payload (Meterpreter)", "value": "4ba391685bee44b8369abb77ae99c506d2a863ef", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684489, "uuid": "bd77b828-3538-4247-b4bd-6b2fdfbba764", "comment": "Malware payload (Meterpreter)", "value": "fc5e951b377d96475777c8fc7d0294e61e719cdbbc3cf7999337c8a8a3aa9b3709d76a8f6d971bd36f07e3eddefbbe64", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684489, "uuid": "5ad7ffce-53f7-4eea-bbb9-3bafdf3c71a7", "value": "T160245C5632A410BAE973913CC6934A1BE7B2B45A03B197CF036483BAAF1B7D1653D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684489, "uuid": "3036d819-e7a6-4930-8392-23f9bec03b8f", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684489, "uuid": "a16603d9-5377-48b6-b69b-ffbebca814d1", "value": "3072:OzbPxvf4OWGKQ2x66J5MhlzBzWTFkWUdunnf29bSgyEM4/TGX6hjdwVoRR0+dm89:OzpQhQpY5QBSTO1un+9bXyEh1jGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684489, "uuid": "d3a14198-6365-4c12-a13d-3aa7d1ea2563", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684489, "uuid": "c1ddae98-32b4-4c5c-ab31-2073dc1e634b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684489, "uuid": "f9df28eb-21e8-44aa-a771-4c2d078fcae4", "value": "backdoor3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de949e78-7da4-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755680751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680751, "uuid": "b015fed5-1178-4cfd-9d20-8ae10065bf92", "comment": "Malware payload (DonutLoader)", "value": "44b2c1b89e4e5e2ac2d0efe9aa9aefbe", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680751, "uuid": "a8e77d04-3251-46d0-98ef-092b8ba3a9bc", "comment": "Malware payload (DonutLoader)", "value": "9e72cf7a56a7ef838d5c2a058e25e9dd074aedb6b72f3743acac85a59efdbd0c", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680751, "uuid": "f66339d6-dddd-45d9-9a54-52423e7b60e8", "comment": "Malware payload (DonutLoader)", "value": "5c330056ffa5b71b5a12d714ac1cd8e24c7266c8", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680751, "uuid": "6783a270-75dc-4b14-b886-bf1e9d2eff30", "comment": "Malware payload (DonutLoader)", "value": "3291bef52d4e3e814e2264b997988d6a512547fed6eab8a97f098029e9e82b2b6cac03df7b2ce4b628d6f06679f59f30", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680751, "uuid": "d3983a11-f9b0-4bf0-b018-c902fc70a37d", "value": "T13CB512526ED7FCAD8085DE1C125B21CE5BA44DB9A48C2DE11673D0C2D6689E4830BFBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680751, "uuid": "7e28fd41-f566-4961-98a8-6b4924cb9ba4", "value": "24576:5rKLljwRr/SvZKWHe1t28PZAfGIWkMU7kLKOIJRLum4MRraO2tqtY0LuRRccFN/K:fxavZKlPEkL8Emcq/GFz2fvdIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680751, "uuid": "3107e339-1507-4a4b-9db0-bbc366d9166b", "value": 2294638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680751, "uuid": "e5fd12b9-28f6-4950-857c-510a3c50ae70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680751, "uuid": "9f4a0754-6bd4-4f2b-ba59-de219641983c", "value": "9e72cf7a56a7ef838d5c2a058e25e9dd074aedb6b72f3743acac85a59efdbd0c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7609243-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755706562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706562, "uuid": "3f705dcc-4c01-414d-9d4e-3670cbe71c82", "comment": "Malware payload (Mirai)", "value": "8bdc730edf6d2328fdcb9a48465a04e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706562, "uuid": "de387bc7-0873-4622-8cd6-a139214b3c23", "comment": "Malware payload (Mirai)", "value": "9edf23eaa1d914d4e02f218d4af60583d3544f00380dca48f7a9cbb21b28a4c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706562, "uuid": "02281501-773f-4104-bfc0-b194a59925ae", "comment": "Malware payload (Mirai)", "value": "6d00ab97ee92515cda3bcd28dbb758be816370b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706562, "uuid": "49e62b48-407b-41c0-8139-54e88993c9c0", "comment": "Malware payload (Mirai)", "value": "706dd5d58351898fc2ffc37ebe35f946113706b8725e258367e210904e35c3d9fc944afa23af8d9e4020be4868d75d1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706562, "uuid": "e3962fb1-1ea8-42c7-8ced-8d05989056ea", "value": "T19F115E9E62642285005ACDC63A9E0D045F8ACBD1E8ACDB35ADF40FB754D7624B45CF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706562, "uuid": "a1d9a28f-3a10-4c58-bf91-b9f7c965ba74", "value": "12:BiV+jxCWE+PNI9kxwA+UySKxWH+6yF+nPC+BkV+Xjv+1xRI4qKA+2Je+Mx7+cA+h:kaRNIqBKx0961xgROxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706562, "uuid": "4242edd1-fa47-4e15-be7c-5bb3f489bfe7", "value": 957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706562, "uuid": "bbe7536e-7fb1-4851-be9d-17623f7030b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706562, "uuid": "1442b6c1-4303-4d28-bce6-8cc27f8ffd83", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5952621-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706425, "uuid": "72019052-b060-4155-803e-5565f740878f", "comment": "Malware payload", "value": "232f90d5f13ef94d25c5f602f63649c9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706425, "uuid": "368fc788-fc51-4415-87a3-d502ef0b7d91", "comment": "Malware payload", "value": "9ee7ef5a00c692ca0618c2def95b9609423bef64031ee8fae53946e25e2f34d5", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706425, "uuid": "9688fad7-7e4f-4278-8a2a-890924b76151", "comment": "Malware payload", "value": "5506d9348f0fc7fdad58482da8e101a7fe32d67a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706425, "uuid": "b5cf435e-a4ea-4c43-9f64-cbab66943017", "comment": "Malware payload", "value": "5e2167985668fc288744fe136d1c28e3d8ff66b0c5aabcfb4e64b00d68a58445b17fc6b82712eed01c1c5dca075edce6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706425, "uuid": "6dfaa742-7cea-4b9d-bee5-41291fd76469", "value": "T19B130908B3E84712F5BB57BE58F746024736F622CD32DBAD656D814E0AB27048942F6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706425, "uuid": "64ee1f34-1712-4f04-a9cd-5fcc4a068e43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706425, "uuid": "b84f0acf-4964-40fc-8803-572df54ec319", "value": "768:P9r8vm0w2Fsd1eWBJVvz0X+8hgzuhjZd6XhkhGhDY6r1dQrLhx56ZVz9sYcpASvP:Pavxw2uJ6Xh6CBnwiAhY6r1dQrL/56Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706425, "uuid": "d105c556-8720-459c-a77b-a44254edde8e", "value": 43371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706425, "uuid": "707b991d-2b67-4270-bbca-5edba058e121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706425, "uuid": "19a20f98-8978-49ad-920d-32b350c920ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e4b63f-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755699520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699520, "uuid": "add276bd-1259-4d76-a471-66f8bb946b67", "comment": "Malware payload (AsyncRAT)", "value": "66afb755b03bd1fd41f54be5fabfab87", "object_relation": "md5", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699520, "uuid": "3cac3466-bbea-4949-8755-e1bf597a2ee3", "comment": "Malware payload (AsyncRAT)", "value": "9f65fc1f458f2c33ac5547561a6ada98688817e3c362e9d38e2b2b6ce79df4bf", "object_relation": "sha256", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699520, "uuid": "c75370f6-081c-45e3-b506-12b1c0f4f296", "comment": "Malware payload (AsyncRAT)", "value": "b63db565b0839199da966145905e14c08612787b", "object_relation": "sha1", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699520, "uuid": "969eb799-b415-4b18-a86e-9fa8b2e56d6b", "comment": "Malware payload (AsyncRAT)", "value": "c706ddef3eef109b3df4cfab9755b92fb6ab92f8f299165aa7d0447ec7234400d324581c561ba6ff09187455835d9c19", "object_relation": "sha3-384", "Tag": [ { "name": "47-238-124-68", "colour": "#C7933D", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699520, "uuid": "13e6e541-f6a8-4c48-b26d-c2787ed89df3", "value": "T18DC5BF0BFF8255A1D8CE417D12A757BF4E398A08C724D6D38F9128E998316D0A73F399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699520, "uuid": "5ef86d23-6d8b-466e-9603-9b2e6ebf5f88", "value": "68919e34605cb281833770197131bdaa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699520, "uuid": "3ce2292f-e487-482c-9878-d5c5bf283056", "value": "49152:borYTSyNsUTHHHywqdikbWbqhwhFnXv5tFPwMf/zyBBtMZZZcgazyUhs:borFIlqJ0xXxAMfWBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699520, "uuid": "529c1b4f-6441-4236-a097-dd2b1356076c", "value": 2743560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699520, "uuid": "8c0ca088-6b49-4019-b043-706a8add228a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699520, "uuid": "0bb5537e-e42d-4e17-9437-493279e90d0a", "value": "9f65fc1f458f2c33ac5547561a6ada98688817e3c362e9d38e2b2b6ce79df4bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dad75f-7dbf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755691983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691983, "uuid": "44e54a73-2caa-49bf-9b45-dfd28ffe1833", "comment": "Malware payload (Mirai)", "value": "8d3e46640d8fc7602ec169ebd61393af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691983, "uuid": "af73e7b2-977d-4de9-8e9f-ead0a1ce8777", "comment": "Malware payload (Mirai)", "value": "a0dadf45c70268ca36bbdac0299957ef11631fc6824abff7e4c17b7317b7631b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691983, "uuid": "6904d9dd-a36d-4dfc-a82d-cae7749095fa", "comment": "Malware payload (Mirai)", "value": "0326b90955bcc761a8caeec082b2cecee13325a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691983, "uuid": "5e7f3cd2-611c-4978-b2fb-f9ceca8304cd", "comment": "Malware payload (Mirai)", "value": "3a9046694606a4ba9e84bf4d5903e96c0de12c8cd0b2df87d40dcc69ab242920a88d7dee1ae39b99b20d16401bd2b778", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691983, "uuid": "4e052993-6877-4dde-8c38-54172f73f30b", "value": "T1BF639E73C52E2ED4C1994174B4B88E781B63B14882531FFA5A99C5AAD04BEFCF20D3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691983, "uuid": "7323aa07-e33d-4f26-8082-a5f2b714b1f6", "value": "1536:2cwtWivoc8/3Ol8mbBOY+jglOLiWKE9AFK0D4nCH3cMJQryxtZy3S:2cGAc8/3OamkBgWMEX08na4yxtZy3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755691983, "uuid": "ac4c148a-a9ff-485f-b22f-a911513e5765", "value": 73180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755691983, "uuid": "c8fb3864-715f-4d7a-8be2-0a2235699ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691983, "uuid": "20265e65-6ef8-4779-ae7a-7cc06f691446", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08652229-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698860, "uuid": "552e1700-8d7b-452f-b174-ca04f734ab01", "comment": "Malware payload", "value": "2fb55ae0b3f8a6f412657306651ee4e8", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698860, "uuid": "554f2f98-ec57-4d59-a21e-7d5898ce4cc5", "comment": "Malware payload", "value": "a0f4b047bd9dfce4ede136b62be5cbc682f7aa93f85fb457e0579c818868d603", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698860, "uuid": "e3f89b75-feee-4d53-bdc1-6cc3924aab94", "comment": "Malware payload", "value": "8fd23d7f11ba10ce459cef11c4dbd0b477e6fbb7", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698860, "uuid": "fff89c9c-fa25-4af8-bdb2-d666681fb38a", "comment": "Malware payload", "value": "f1359df293e8ee40dcf146399f38bb5f69f89b466e00e327923941e04c748902cc4867a6840c0be8c3f70c2bfb3590ab", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698860, "uuid": "633efa33-4fc0-400c-a15b-bf0cd8fb0040", "value": "T16DB5C4D2B4B8C659FD244432D257FCBDAF129DA85878910DB240B1BA70B1F73112FE2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698860, "uuid": "096b9549-53d9-4620-b87a-ebb3297da30d", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698860, "uuid": "4c376835-7d79-4543-bad8-6750485df06f", "value": "3072:lGOfZMRnxR9y7b7Vj/9jRZ5vua3sNEAYe111MqAaZytJxb7YeV9H8icSmhiI1vd:Pf4nvAbPDPa4tJt3rSiCvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698860, "uuid": "07f9f1fe-096f-495b-ac14-47f99b2e4638", "value": 2332160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698860, "uuid": "9ec45858-9634-40b0-ba56-8872f204d091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698860, "uuid": "c71eec48-a54f-4033-992a-65a22d1b84e7", "value": "a0f4b047bd9dfce4ede136b62be5cbc682f7aa93f85fb457e0579c818868d603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc99d962-7dfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (RustyStealer)", "timestamp": 1755718087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718087, "uuid": "bda9fed0-a802-4c07-b3c2-56c27aca8583", "comment": "Malware payload (RustyStealer)", "value": "d2a33e90e99d3264abad4c06f875f7ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718087, "uuid": "15c0fd09-997a-4ac1-b3a2-46bd3d34450c", "comment": "Malware payload (RustyStealer)", "value": "a18efca88f1fbd5271c03343ab2bc7ff7ad295797b11bf07f70b3da356f21b64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718087, "uuid": "53bedf0a-2ecc-4b8d-a6e3-c0586f11921d", "comment": "Malware payload (RustyStealer)", "value": "a859ef1b1f2b11332007a0a6f10a7fbf99fb6666", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755718087, "uuid": "ebf54448-2db5-4783-bd64-2902df0a3997", "comment": "Malware payload (RustyStealer)", "value": "4e3592f65d52ead22552c98c59f6343316b71eafd5d6aadbede76001c2be8646a5e97256c75ba445699d2c978f3cdc29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718087, "uuid": "aaf390e4-2c60-40cd-8aa1-ad9cad8a0898", "value": "T18F565B43F7A641EDC06AC474871A5233FB72B88907217AEB56D086313F62FE06A7D758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718087, "uuid": "9ce8a3cf-91a0-4210-957e-2de96e48ecd0", "value": "323400e787f54999075321a066873519", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718087, "uuid": "d12d4f4a-b471-49b1-b10f-d6567febf930", "value": "98304:fA4jk7VkRPnyAkvi9QgHYItQG6daQbjvsy9icVUEEEEEEEEEMEEEEEEEEvEE7EEh:FIIfmIQGSaQbjqcRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755718087, "uuid": "3dffa3d9-0b04-4adc-beae-51e2c48419d8", "value": 6219776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755718087, "uuid": "b1f1badc-2f4b-46ae-b7d9-27a1ae919307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755718087, "uuid": "1edf20e2-58f4-40e5-91ee-b63b9fbf90cf", "value": "Exostra Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe7821b-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755671116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671116, "uuid": "a66126e4-ee05-4694-bc89-1819bd3b5af4", "comment": "Malware payload (Gafgyt)", "value": "6a4704b8f443ab693e8f187468a5ea6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671116, "uuid": "5d74d011-925b-4d1b-8376-f4b6aafaa70f", "comment": "Malware payload (Gafgyt)", "value": "a2287ee119c76b2b77f49e8af1dde094519ec73a3bd68b146ea66ae9b4d9d325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671116, "uuid": "1769d52a-85e7-4e64-9eb1-aacbe3793454", "comment": "Malware payload (Gafgyt)", "value": "417a318841014bbbdde36fe02b920f994761a440", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671116, "uuid": "707f3047-c0bc-492d-8555-f39af667b531", "comment": "Malware payload (Gafgyt)", "value": "f5952a47af2c9fc46b30782e5717fd3f36cfec8c6fd6a1618b1402259fe838099e62e6a57e1904e2eaa53c3d0260d074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671116, "uuid": "c0f6f581-be99-4f0f-9187-3fddeaaf90f2", "value": "T199D36B73C83AAF68D265D174B4318F781B93E91481472FBE69A6C6758083DDCF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671116, "uuid": "640a974d-d62c-4d24-985f-59588b84af91", "value": "3072:YvRJC0D39WdS/152ffQ5GnFJxePWnx3SdCaD:Mtbfd52As0ensdCaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671116, "uuid": "853bc902-4bef-470b-8433-ff86a9378931", "value": 138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671116, "uuid": "1862032c-4345-42c4-a803-2889a43ca324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671116, "uuid": "e7015de0-65da-404f-a99a-84045955c043", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443067e7-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1755723012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723012, "uuid": "2249b3b8-a895-45fe-98e0-91c433934d4c", "comment": "Malware payload (njrat)", "value": "3c1c70d5248614028ca55df968bab141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723012, "uuid": "192036a1-98d7-480f-963b-336ced275594", "comment": "Malware payload (njrat)", "value": "a2397f806d6dcb70772f436afd0a18c8cc83825de44541f99ed53f37563c12ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723012, "uuid": "266361ac-8e07-4897-af64-890e2c678209", "comment": "Malware payload (njrat)", "value": "a58040f835cf06da128d9832a84657cac5739954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723012, "uuid": "fc1ec0b0-b130-4ca4-a0a6-28d3e9008434", "comment": "Malware payload (njrat)", "value": "b3164078d91e3b218d0b29fa6aadc91e1284abbff6c3c700e2172d9d37034a66d7000b85cdff8d9a0f0928951e129962", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723012, "uuid": "0fd2cfca-bbca-4606-b2b1-eefb38f004c9", "value": "T14FE22CADFBE64465D1BD0AB50571950053B4D103E523F77E4ECA24E62B3B2D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723012, "uuid": "fdfa29dd-ecb2-43fa-983e-ec24a870f02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723012, "uuid": "b75734da-cf2e-415b-8097-ae5c6da80659", "value": "768:LTBHIZBDTuzxZ+K18z/SpHvMIQmIDUu0tiShj:Rc6HhdQVkbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723012, "uuid": "44e84e4d-adcf-4371-b6b9-23fe953ba71c", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723012, "uuid": "0e5bd964-a0f8-4b1d-8271-d856e84afba4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723012, "uuid": "7cca44fa-018d-4bc7-ba92-d7299502a808", "value": "3c1c70d5248614028ca55df968bab141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec5ceb6-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703487, "uuid": "2f06a67d-aa69-4064-96ed-794c4765f428", "comment": "Malware payload (Mirai)", "value": "9f8a24f323daf54008d70d90b3510e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703487, "uuid": "32d347ae-9ea1-4b9d-ae30-59c150de39ce", "comment": "Malware payload (Mirai)", "value": "a286960cf28636055c1e427ed4409eea5c39bf1f99920cc93f040fd14240e675", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703487, "uuid": "c8ed8dc4-b10a-4f11-a11e-f4f5afa95885", "comment": "Malware payload (Mirai)", "value": "218d0b777d2db4079eb9e20bf48431255839053d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703487, "uuid": "87a469f0-781c-47a4-b114-60e861c4540c", "comment": "Malware payload (Mirai)", "value": "b1d21fc8f2b083649b48ce5c7d350f97b0457f76c2b27a70789910317f8947c20150ea3ed80e233a0cb38d26fbdb6e7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703487, "uuid": "1bad95a2-71bd-4359-bca9-9b505b01bef5", "value": "T1A3E2D0EFF1CC7C96C43A8C3DD0ED03610D61B059A78F5B2AB3395D88A91052FE45A56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703487, "uuid": "d430c74b-5f81-4bb8-a509-708d9511d369", "value": "768:/1lGEzbII1C86kkpvuZvJqtiqEXWw6+uylWG:vII1KkYAJqYow6+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703487, "uuid": "5fd44704-8105-4fd9-a179-94b092b6d5d7", "value": 31944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703487, "uuid": "1b7a77b9-717b-4791-aedc-d0f99099e492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703487, "uuid": "0e605c01-09e6-4110-aa6d-2bb93922f667", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3c9306-7d86-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667541, "uuid": "650569b1-f8cf-466c-9792-e05dc591a662", "comment": "Malware payload (Mirai)", "value": "8a7e779f7191d92fb1a2dcb327c44ecc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667541, "uuid": "f869adf7-b1e3-4ee1-bd54-a2a2054020ac", "comment": "Malware payload (Mirai)", "value": "a2f27aee86bc42bd900de06899925a0074f765d3e3fb677c5b5d7d98b074e57f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667541, "uuid": "17a6d0bf-116d-4d63-822d-414b2ce8f788", "comment": "Malware payload (Mirai)", "value": "872f35485196cd8e414c05ffde4958047f10add3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667541, "uuid": "5acc5a66-92ad-4c86-ab5c-2afcbdf53c8e", "comment": "Malware payload (Mirai)", "value": "0014c14f3ea4d85ad846910d5a393d7b4146ad607fa25bd6f4ee2efc5c3c3df0626276b9ee356bfc17af9803645c130f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667541, "uuid": "14653b2a-bec5-4430-a80a-6dc5a0080af6", "value": "T1A9244C93B905DEF7F80FE77204D30B257132FB6109535A72B2177976AA3A2C4282AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667541, "uuid": "3461daff-93fe-49a4-88c0-67674625ca72", "value": "6144:ma+XK7scCy1yYXjtmwGa1U+4LxAUv0/UNawzw1tGL//sAWDWfvBefd:PpscCVaMAUvlw1tGL//sAWDWfvBefd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667541, "uuid": "abba9f4c-293a-44f7-83bf-becd0ba67713", "value": 222327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667541, "uuid": "291415f8-c3c0-4418-8667-beb58a17af15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667541, "uuid": "fb603a7c-3ec1-41de-8ae1-3bffe527f94d", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798e27c-7e04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721702, "uuid": "b20f7f3c-3d24-41a1-b53f-aad7df88deaf", "comment": "Malware payload (Mirai)", "value": "9836ab6d3aa45269bc65d3a7b251e654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721702, "uuid": "00627455-bebf-42f2-a901-4e82c7ec8eb4", "comment": "Malware payload (Mirai)", "value": "a326f9d6f51a02c38d9d98c682a01537b2dae7d96385c9e9f5ca510931abef71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721702, "uuid": "7bbe727e-7b61-4f6f-ac1c-a74829faf9dd", "comment": "Malware payload (Mirai)", "value": "3de70d446a156dcd63cffc61f682c6fcaf9aab14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721702, "uuid": "ab40ff04-aa83-4fe3-bf97-70c0429f19ee", "comment": "Malware payload (Mirai)", "value": "52d44d0e41c4b9db3f21a5655d9ed3b58deaac0bfc386bb111f91226ff49de76fd68714e2851352501d750bd43eb2339", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721702, "uuid": "4d99004f-6648-4740-9457-aae5aa2e653f", "value": "T15BF32A46E6418B13C0D61776BADF420533239BA4E3DB73069928BFF43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721702, "uuid": "b9e1f88d-b52f-4fa9-85cb-7d20393d059b", "value": "3072:62bmltnI4BxaB/xGP00Cv/+YZ+a9L6Mj2MDpwSxVec03:pbmlt3xaB/xGPe/7+kL6O2MDpwSxVt03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721702, "uuid": "79d12df2-c32d-4d69-ab21-489491d21976", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721702, "uuid": "3b0da4c4-a283-4bb7-87af-9613d3699d97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721702, "uuid": "18f297c8-7bb9-4910-aa69-57f2ad43ca04", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02cd816b-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702286, "uuid": "22950e79-58ed-4ad9-8ffe-7647a0cb81db", "comment": "Malware payload (Mirai)", "value": "8eb0b77e44fd138781715741aa301f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702286, "uuid": "7cc6362c-746d-40f7-ab2a-06b6c5977ef7", "comment": "Malware payload (Mirai)", "value": "a3a4afc7862b3480a8f9fd5662653c38bbf7c159e3bb1e0757bb0673a371b8ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702286, "uuid": "6b2f76d2-b5cf-469a-b56a-933e6cdee211", "comment": "Malware payload (Mirai)", "value": "a5cbc2530dc7199ae8f1ed5059f4b3b19ea17447", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702286, "uuid": "29c44971-2217-4a5c-86c1-760f2b28bbdd", "comment": "Malware payload (Mirai)", "value": "5b97bd473db7513418136d5fbe4f220882f79b6c3ee3c40b2947a90fab257ce8715f3b8685bb5a538130910d90574fdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702286, "uuid": "323b2960-d3fc-4ef0-a5c5-2a4aae6284be", "value": "T1B8633D39F0064BA6C0875474B4ACEF3A2F2256C46392AD7327B547F56CA7857B804FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702286, "uuid": "651464c1-0c76-4af8-b20c-dce4d3fd2698", "value": "768:gCCqK0Knll4wjtDLjmjuG3+jCa0G9eivuaZiHfN800RT7Vb2w:gCCqK0KnLVtDHCLeziHfS00RNbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702286, "uuid": "1f46054c-7371-4d06-96d6-f94b3f79337f", "value": 70732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702286, "uuid": "e5a5ba0e-7a4a-4157-8b8c-068ae52ec837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702286, "uuid": "194363f0-129f-4b76-8dca-9104af573676", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc8f890-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686356, "uuid": "11122b8a-9a56-4ebc-bfc3-3ed01e132065", "comment": "Malware payload", "value": "cbf95bbbde0f7cd736d7abe4b66049e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686356, "uuid": "c7a8c216-ee29-4892-97ec-b0a8b51ce71e", "comment": "Malware payload", "value": "a41ddb60e3b7e2cecb367203303e660dc11a915185ab0beb45378ada0c78f776", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686356, "uuid": "4654770e-e0ed-4e09-8787-d628b54a8f9b", "comment": "Malware payload", "value": "b8cf4105e8696952aa559fbd8b271b51feb5be5a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686356, "uuid": "33ccdb69-9801-466a-9c28-43480f7eafc7", "comment": "Malware payload", "value": "708410f3163eb726576a8ff999405cb38992414f87015ba92baacf5662387e9349d290a4a9b740a4ccd571cddede761c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686356, "uuid": "14d4ee5c-7880-4459-9bad-6a563e860bce", "value": "T189F3551928C2D0D44B96C6D0E7479D2F9704E7C64573FCFE924B9AD02B26922BED2327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686356, "uuid": "500e4940-2b13-4ea3-8bd1-da10c9d2a0ff", "value": "768:z6L8x0WTeE0vrxa4JSi8LplbI/oR0Rdx1lWo/ON9QJXM:SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686356, "uuid": "98ed6d6c-95a9-4ec8-a2ab-6e9d8634e270", "value": 162750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686356, "uuid": "289e14e2-4a2f-401b-9031-76c9e2dba06c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686356, "uuid": "bc533bef-b6dc-4569-b12d-12e22e8bb4c2", "value": "a41ddb60e3b7e2cecb367203303e660dc11a915185ab0beb45378ada0c78f776.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4353d5f9-7e15-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1755729023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755729023, "uuid": "10903c55-b96f-41c5-acaa-83014a3cae15", "comment": "Malware payload (ValleyRAT)", "value": "d183a27930707385e431ff1a839ffb28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755729023, "uuid": "fcfcf3d9-f9d4-4c60-b98b-cc29282d04ec", "comment": "Malware payload (ValleyRAT)", "value": "a5239a1819251f534404be9ae065d1ed819c8e49214222338d4395a390201788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755729023, "uuid": "c9575a53-53eb-473f-9605-9820d4091940", "comment": "Malware payload (ValleyRAT)", "value": "1869936ac649f0b72976e76820705f408fb7c592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755729023, "uuid": "74f28bb2-4cd3-4466-acaf-cfe7fca535c3", "comment": "Malware payload (ValleyRAT)", "value": "19fd03b27a5e796bc5e7f1ae95463fda07715bf7d8c37b27c5353cdb4cfc463eb6b15ceeba45b3184d8dea4f39d6c78b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755729023, "uuid": "e37198a1-ab37-4b90-b7cc-9b8ab57da8fb", "value": "T11DB37B2172A0C072C093253199F9EBB24E7EF93117B845CBB7E416BA5F603C16A7539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755729023, "uuid": "c633a493-044a-4916-b0da-0c510bead86c", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755729023, "uuid": "c8779224-81ef-43be-9122-0eb17c1a4589", "value": "3072:ybWjdIPbcia0NFtwwnILn3py6D268XEPKy2:ybWjMbcCtwwnchx1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755729023, "uuid": "0754a1f0-cf91-4aab-9110-9200eeb0f7dc", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755729023, "uuid": "8a6ec3cc-4017-4d7d-ac5b-c2976056b4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755729023, "uuid": "3508efa5-4313-45b8-85cd-2e0d16af2558", "value": "2025-08-20d183a27930707385e431ff1a839ffb28ama.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e865e8f0-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755721569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "72cfdd83-47f6-43b8-a287-a2b0334fb7a4", "comment": "Malware payload", "value": "a81650ba699dc9c8c7ca342508ebd10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "eb32bcd6-c4b4-45e4-9131-eb5b94febd26", "comment": "Malware payload", "value": "a578df0d4c61a1f53a56dc181b810b9c85dbc8d29201ebe72bee2d461685b70b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "7aa825b1-1f90-4c0a-8ae4-a9341073a8de", "comment": "Malware payload", "value": "622a1dd720ed000eaadf638e1cce71f188f8f177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721569, "uuid": "eff239a2-7bf2-4f9b-b54d-0148f3a25194", "comment": "Malware payload", "value": "3dfbc937505742b8d4f3feff12d7f1bf0364fd58eac85f706c4a4b87a98e386ebcaf19f00922cbe160e4c479ee9eff27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "7f9304f0-6a48-45bf-b1cb-cddeb76690d0", "value": "T12C76238F15CEC4E4C4D54630962B8B9672B28EDACD84CC2F69C87C4996B1F76A0F6D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "f7b7e62f-f925-4fca-8afe-ec987818a65e", "value": "5fd7a64f782f2a19b3a934fcf8a06b19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "a930ebb1-871e-4020-be45-5bf7ae2a500b", "value": "196608:TIfMFhW0rKhCXD0oNFHnbs0bSbJUv4AvWJ1JHG8a9oFtpbcS7wwe:82KhKQovHD2bO4vJ1JVhFnbel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721569, "uuid": "0f0cc0ea-6e0e-45f3-a932-6055d96f57b1", "value": 7250824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721569, "uuid": "eb4b995b-3b02-4853-80f0-b8958bf36a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721569, "uuid": "0eb5b1bc-92c2-43f7-a312-9d688e2abe71", "value": "NexoraLi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8c046e-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755697227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697227, "uuid": "2f155d81-2843-4973-b21f-ef4ac3ed4140", "comment": "Malware payload (XWorm)", "value": "fc2fdd3092209746c6dd0a9cdbc946e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697227, "uuid": "49d29180-dc4e-4581-ad57-505d01c933a6", "comment": "Malware payload (XWorm)", "value": "a622496b016b530214c3e577193e9d6343bd81407bd75162055bf92734e86608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697227, "uuid": "c73a2bee-1034-47c7-b1e5-631f47bed118", "comment": "Malware payload (XWorm)", "value": "04bdd7f9e29d3535bf6174eecb3a3b308721edfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697227, "uuid": "d9176451-8258-4513-8490-cbcd365832d5", "comment": "Malware payload (XWorm)", "value": "7262770c6502ab03254133a814890cc0b17033918bee41353315518a4b042702ad75598926f58daaa796179484705a5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697227, "uuid": "49e46e50-2748-4b92-a614-4dc02224153c", "value": "T153A5390267EC0169F1F36B71DAB992609AF77C619A3ACF4F12800D4E1DB7A909935733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697227, "uuid": "0f6aeda4-e866-4939-94f4-91e7b371e839", "value": "112bfbb18727302cb5425c20a464b02e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697227, "uuid": "2ba947e5-5ac2-40ec-9953-876333b77d94", "value": "24576:UKqpCZGE96zN4tqEKmJM60PkE16YeGVBhEv748BdEU9RcxPSi7OWBBJfwCVVQNI0:N0okNZCWOLT4yXGQ6m6K2MtENK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697227, "uuid": "42a48aa1-2bd4-4739-bfde-2edf60da27c4", "value": 2080383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697227, "uuid": "69b82ec2-c091-473a-980b-0e168d0e1684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697227, "uuid": "60fef034-d69a-4ac7-b8ad-e8ed65a0d010", "value": "fc2fdd3092209746c6dd0a9cdbc946e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6d8111-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701875, "uuid": "bfcdc03c-b6cb-4b3a-a8f2-3d33bfe2b9aa", "comment": "Malware payload (Mirai)", "value": "512e1ec49731f52c0f108b5e32ce0f02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701875, "uuid": "75ef6902-3d0b-4688-9d34-f3f637e09145", "comment": "Malware payload (Mirai)", "value": "a6d4df5619748d7331bd5d7d207a88dfa3a41ad40368795252fee3b3c9861559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701875, "uuid": "ccf213f2-d6a9-4921-9791-a4515a14a613", "comment": "Malware payload (Mirai)", "value": "dc773a24ea643dcaa8117c39977684b8bf472bba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701875, "uuid": "df1c9c8c-4952-4324-93f1-9c5fb0f7f825", "comment": "Malware payload (Mirai)", "value": "7113cf1800b97acc17208daaabb6386204ce157a02cdb4419ada4ba8ce51ef40bfbd471ffe897a0d0d20338502b7e987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701875, "uuid": "e67d6aee-c473-474e-af0b-f0ed73e4f19f", "value": "T18073A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701875, "uuid": "65cb456e-9d3a-4229-ab36-6c8ff242f1f9", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStk:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701875, "uuid": "1b76a543-e777-4526-833a-7037b7e77baa", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701875, "uuid": "606399c6-f3a6-44c6-bd24-1324af7a225f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701875, "uuid": "600e4146-61e4-46ed-a83e-94fe9edf9fa0", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a2f12c-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Downloader.Upatre)", "timestamp": 1755706237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706237, "uuid": "c6ae8d98-d23a-44d0-9523-a0c0bd4d696b", "comment": "Malware payload (Downloader.Upatre)", "value": "9e90425c690674b0d8c8ecea2f05a7c9", "object_relation": "md5", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706237, "uuid": "7efab465-2b2e-46c2-a26b-2a9f339fec6a", "comment": "Malware payload (Downloader.Upatre)", "value": "a743fa898008077b9c7331547520cce94ec1cd8f95323c2bf3c91c4e7a66875d", "object_relation": "sha256", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706237, "uuid": "4a3ad007-8199-46bf-9761-face387bc18c", "comment": "Malware payload (Downloader.Upatre)", "value": "f2550159ec31d0998566e9a62971ba1584eb231a", "object_relation": "sha1", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706237, "uuid": "1efb5d2f-3cd4-469f-8354-e7c2b83bc672", "comment": "Malware payload (Downloader.Upatre)", "value": "e68b95e55f3a3d0dde428abd6e1f18be9d86a59c4c92a3ba0aa28cc78404083c616837a28ac37ca59e45c7e2db457082", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader.Upatre", "colour": "#7F9961", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706237, "uuid": "63003feb-a66e-48b0-9fce-97491808d81c", "value": "T1FC54CF427AC5C461E6610DB314F79E129B7EFEB21B60994FAB40675F0834BC0E75AB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706237, "uuid": "51624726-e8aa-41a3-9306-6e8f8900b771", "value": "51468df6d34135d894aaf8dd7f890ffa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706237, "uuid": "65fd9808-d2ad-4dbf-9365-7f3ef29dc80b", "value": "6144:qTJ5H3Iir/eHeynvka0N0EX0p10f8ENx:qTJN4irGTsa0SEEp10f8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706237, "uuid": "1e07dd51-13d2-4e71-b052-306e970e1614", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706237, "uuid": "ec34e178-84a9-4a50-877f-683eed5d8198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706237, "uuid": "0688f3d8-ec3f-4d95-90f4-9e0606ee1c15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d91865-7da5-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1755681053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681053, "uuid": "674f9ffa-7344-4398-819f-c422fdd8193c", "comment": "Malware payload (VIPKeylogger)", "value": "5b2400998040b86af09f9230ddad0677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681053, "uuid": "54aa4042-e9dc-4dc3-8878-4282a4b67ce4", "comment": "Malware payload (VIPKeylogger)", "value": "a78b0fd44e0c8d66c11da559be59526849a49b690817faa30035037d2414f3f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681053, "uuid": "f31bb294-d5ae-4fbf-bbc0-9980f09c279b", "comment": "Malware payload (VIPKeylogger)", "value": "d1fc9d2466f2365fe3c8236f18a599476715282f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755681053, "uuid": "638e6073-1dee-498e-8bca-4f98528496be", "comment": "Malware payload (VIPKeylogger)", "value": "1959b756aeb33ba09ada0fc102ae238e74e551a8c8ed166c57c70bab89f579f998a1be0ecf12aa016dce9b17a1dd8a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681053, "uuid": "11b54439-817d-43b9-93ad-34d0e5ad71a5", "value": "T100953340B6C2C847CEC47571ED7A5DA749F3BE1E2229E5532349A83EB6A20E4487F3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681053, "uuid": "a7e964c5-3b24-45ca-ade3-eb02ded2d23a", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681053, "uuid": "265b40ae-8590-46b2-9348-16cf6d399ecc", "value": "24576:CB8ce6+abPYSJUFhgxSRk1Hz7e5Zg/UyBDi7rwxu5/3CMDY0CLh2M9B6RC2Pq0u:2eDSWDCSKHfe8wou5aph/B6Q0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755681053, "uuid": "ee1be976-95b7-4381-90c7-f425c1dfd266", "value": 1931680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755681053, "uuid": "e5ffac5c-85a8-468e-a9b6-32aea3054189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755681053, "uuid": "a8667dec-430f-400d-8069-edeaacc7ed8b", "value": "teklif talebi 20250328_ ASELSAN AS 20250531.000 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015f30a0-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700566, "uuid": "05ad76a1-682f-4879-84ec-134d9a126429", "comment": "Malware payload", "value": "76399223e300e0b80b5e69fb23d94bfc", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700566, "uuid": "4fce9893-21d8-46a3-9412-7f59e6aa7db7", "comment": "Malware payload", "value": "a7f0a75c1980620538309ecb9a642e11bda794cbf904ef20775f8c3adbf3435c", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700566, "uuid": "35a8e904-e351-4b45-8713-ff7b435fffb3", "comment": "Malware payload", "value": "a42730ff673c3a9599feee53c910927707776673", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700566, "uuid": "c3ea8102-e2fe-46f5-be29-923af1712b3a", "comment": "Malware payload", "value": "d1a35654b1afe572c0b34db0eee4debdb42a7bb7bd298cdf1bc3e8c41d241f7cd2d00a6765a679e68a34a3d333b705a3", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700566, "uuid": "e3045df8-93aa-4a25-bbd0-c76d9434673f", "value": "T183F58D06FBC681A1DC8A4039D1A7DB3E4D394F14972287C38B917DA99932EC1DE3E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700566, "uuid": "69acbe05-1c9f-4d8b-8609-bd86013d52c2", "value": "62e68c5348ddfdd006fc49ede008a5ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700566, "uuid": "4e5e48d8-4a3f-4d05-bd60-b14a2637acc0", "value": "49152:9WLr5E7x0At+FI2wiEOyKeCSC+dmsmqPoawAczQnFsnFxnFcF6VKBHanRJJf:kLr87KMADalfn2n3nm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700566, "uuid": "a302bb4d-910c-473f-94a6-cdb325bd4ddc", "value": 3324688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700566, "uuid": "27f7d871-8cd5-4030-8d86-90966d02dc20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700566, "uuid": "fa465976-c74d-4be8-bc68-cf8ebfc0ee1c", "value": "a7f0a75c1980620538309ecb9a642e11bda794cbf904ef20775f8c3adbf3435c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3f9643-7d74-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755659993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659993, "uuid": "c5a91662-49c4-487c-a42f-bc7756f84268", "comment": "Malware payload", "value": "d680ec28ce69ed12d4b064d1a14da9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659993, "uuid": "92ec55a4-32dd-4218-8fb2-33d8f241e02d", "comment": "Malware payload", "value": "a9067c1b7ccf22d4ec41a45451761d4b1f496a89744cde4d119bff1d213e6607", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659993, "uuid": "16bfe568-2900-4e92-be35-4197fdc38a60", "comment": "Malware payload", "value": "df895bffd8691cb898280b860186702af619c009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755659993, "uuid": "32201358-7600-43f0-b945-22f7619f893f", "comment": "Malware payload", "value": "2cfc8c7af3dd655e1a3dfd9a493634c997a78d4313fc54b854c23cdf84ea628ac5dc421faeb103ade9a83cdc91a6cc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659993, "uuid": "71839106-76bd-4393-8a3c-51d6a07850b5", "value": "T1E3B3039D32E071DECA67D8729F986C6DEA51747B871B5203A02306ADDA0D887CF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659993, "uuid": "71f683bf-3377-4234-92c5-21f849ce3793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659993, "uuid": "94295d89-e4f1-4474-b954-93125568a2e0", "value": "3072:qKfW3R2FyzE1bM9zNhyjxDfXzrjlhv3vmLv:qKO3R2ScbEzNhyjxDfXzrjlhv3vmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755659993, "uuid": "9c31cc77-1b30-4e08-ab85-be965e9509d4", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755659993, "uuid": "6c083889-60cc-4bbf-a3af-6e79e046a89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755659993, "uuid": "8ea9e2ab-0789-4e52-9201-68967832b03d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.15769727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32328fc5-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701507, "uuid": "0a9ab69f-97bf-4588-9a7c-42a22b886909", "comment": "Malware payload (Mirai)", "value": "943f67095fd1744580422aaae36cca25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701507, "uuid": "5b527737-fe25-42f1-800d-1387381ce7cd", "comment": "Malware payload (Mirai)", "value": "ab6071c4e5bbf49df217dfc1870200736e93f6f48357ab1817d2a3b2d70ad864", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701507, "uuid": "a8017d5d-e1e7-4975-bdb8-2ff0cc53f39a", "comment": "Malware payload (Mirai)", "value": "ced641f07075743e11180cb81cb1eae5aa2cd0ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701507, "uuid": "4fb2ee76-c372-44ef-bd35-7ceacf4bcec7", "comment": "Malware payload (Mirai)", "value": "5cd7f5ddfd0475cfbe46a6a5f4f8ec26c5c180dd9cdaea465784394419861fb98d2abb8bcc7b9ac899c3558de424d1f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701507, "uuid": "449d0bc7-aa8e-44fa-ac0a-2c9706cc4eee", "value": "T1EE24B90E6E228F7EF6A5C63447B79E209B5D23D613E1D640E1ACD2111E6438E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701507, "uuid": "d2c22b29-19a8-4be0-8f34-476b3767fad4", "value": "3072:caNxC3E/3Lrs6UoK/JEcW5Ffsn5gKz+bCGO749bOL7asq46hh1P9c00:rNxCUvns6UoK/J0caKP7/vap9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701507, "uuid": "defe2095-3b71-4fc5-8833-b5d74ae19f55", "value": 229708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701507, "uuid": "86622fbd-6878-45ea-917e-bcf9bdef4a4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701507, "uuid": "65cad52d-bf87-43b5-b231-ed6b66aa59f9", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a675d1-7d64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653144, "uuid": "9eba97b1-d700-48f8-a87d-f2ddc8a70525", "comment": "Malware payload (Mirai)", "value": "e2a73db0c2dd769fa945e58a92a6b984", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653144, "uuid": "eb3391cb-9236-4b41-8a36-e49f4cfeef8b", "comment": "Malware payload (Mirai)", "value": "aba0c821bd0999ecf8517b02d03ea6b8ee764aed838b2d399e3c5cf560cefac1", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653144, "uuid": "1e159231-fc97-43c1-92ce-ba86260b6b95", "comment": "Malware payload (Mirai)", "value": "cef4e8f4ce9b4b3906ac5235a7b7c699ef13f810", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653144, "uuid": "2632e645-7adb-4002-98b3-96773bc9fdcf", "comment": "Malware payload (Mirai)", "value": "40b5bdce25dd481cb04c443218cbf9181d0012f585c141c2e297fb7c90371b7d1f5004164d56aa0e6a0ee0db8ef4741c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653144, "uuid": "fcd6190b-6935-4765-9776-6afd6ab43599", "value": "T1A6E56C2EF9A214BDCAB6C4B0CA2F86726D35749CC11179772194DA703FA7F301B19AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653144, "uuid": "aeeebc23-304e-401a-be63-096033adce0a", "value": "98304:Jyjp0Rf1KaTyDdk7Z0b4tz2Wns4A+1iwOWtie+Xpl:+p+M1eie+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653144, "uuid": "ff12a70b-f477-42c3-b4ce-18aa4cf9fad8", "value": 3145824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653144, "uuid": "c7b57d76-48f1-4513-a10f-d060e31d4b96", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653144, "uuid": "44bcada3-98ea-4bc2-a226-ad7317c063c6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b61bbb6-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699079, "uuid": "b51472b5-6000-4b29-9bfd-794035a3f399", "comment": "Malware payload", "value": "0c9befebe26b97d74d716c8ce8e8a9d4", "object_relation": "md5", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699079, "uuid": "b9ab6548-33bd-4025-877d-d0ff905d0247", "comment": "Malware payload", "value": "ac40f12e7d9c97adeb99f266b889bba97c880fc2cc6a5740b521127ab0d170c4", "object_relation": "sha256", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699079, "uuid": "682f4abf-0397-4221-a68c-91955b9ed662", "comment": "Malware payload", "value": "d314cef0d3bd967816fefbb0da3cbc127629388e", "object_relation": "sha1", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699079, "uuid": "da3f8059-c3ed-412d-9941-d9d69d9f20be", "comment": "Malware payload", "value": "d62f2ffe7ff6abcef530829cb04e3aa0e25e6aaae10c9322c77984f82867e1912a1456de3c8d42ccca9bb883c8bab0d9", "object_relation": "sha3-384", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699079, "uuid": "894ae6df-880a-46b2-8886-d79386d32a66", "value": "T1CA4506D3B8888951FD2844375097BDFDEB169CCC9CB8A10AB24472F954B2D722237F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699079, "uuid": "61de44f8-3d95-43aa-adda-8950ce297b60", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699079, "uuid": "7175ca42-e515-496c-830b-03d0bbbad621", "value": "3072:svvE3RpGuKyUa7Jr/9ZRZ5afa3rNEAYe111MUvdpE:Wvmplsaz5Pvdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699079, "uuid": "d172ac66-1d2d-4678-b630-2e1c0499a2c2", "value": 1215128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699079, "uuid": "d47724c7-0e89-475f-ac00-ccc078260f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699079, "uuid": "fd182429-3de9-48d3-a01d-32a685f5c96b", "value": "ac40f12e7d9c97adeb99f266b889bba97c880fc2cc6a5740b521127ab0d170c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32315a2-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701804, "uuid": "582fd9b3-2394-4e88-bb52-cf577d00b42a", "comment": "Malware payload (Mirai)", "value": "5bcde536f43a582623fd65637d9e0fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701804, "uuid": "45c25cf3-9b1e-4638-b578-6b282571d004", "comment": "Malware payload (Mirai)", "value": "ad374de1bc701b1d59e28ef49468c53233b9c32ecc37a54739b039827418e89f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701804, "uuid": "b6d16254-0eac-4c59-bc3e-3e7021805c72", "comment": "Malware payload (Mirai)", "value": "3de3271398cef8ef62da465bfdd66722b6e34b11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701804, "uuid": "c1fe9323-5e2a-4aae-975d-07e45e1f9c0b", "comment": "Malware payload (Mirai)", "value": "33696005faf1100adbd2c47401dcd80579ebe7da18e47abae900ab1a01a2df105ef95f3aceba98f5f49bf642067e4f00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701804, "uuid": "84f298f2-c28d-4765-9f3d-cfb48d74e5e1", "value": "T194C2D0E07726FA31C420AC3DE52A4D8A3A510A7C91FF353664259C358FC1A9B63F84E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701804, "uuid": "dbcf1383-0a6f-46de-ba84-41fb98978ab3", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwr99q3UELun:PKy4qfqoeJdXWgQLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701804, "uuid": "623a1e3f-8fff-4b29-9488-fcd6069ec88b", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701804, "uuid": "1577c642-8609-45cd-ae82-bfbdf0b2099e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701804, "uuid": "c833383b-f952-4f71-80fe-ee9340a15810", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e507e05-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1755695997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695997, "uuid": "825d0832-3993-4044-b120-eb433fb27b54", "comment": "Malware payload (Stealc)", "value": "243ced70a3a869cda1edaf8f038a3a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695997, "uuid": "9d14d64d-1700-4de0-8973-6402e03c4177", "comment": "Malware payload (Stealc)", "value": "adfb54bc178bd596a6d011a2dcd782cffe3e7bb37cbd07d1ac5daaaf307094ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695997, "uuid": "ae6f2304-1367-4889-9a99-1d06793a7c59", "comment": "Malware payload (Stealc)", "value": "a54733c8ac9e31d58afc1c076120597518b26e65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695997, "uuid": "85fceb74-a1ed-4bd5-9c73-49ccbdc070a3", "comment": "Malware payload (Stealc)", "value": "832bc45a281bf6099ccc6b737f632c535a3cdec93b9481edd07bc4bf39065659e7ce9bfe5f9311908301720bf4f5a6cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695997, "uuid": "9e317518-ca49-4388-b384-96719e6d7d3f", "value": "T12165E114E83970DAEDD74071AF365201F8327D7B4F342AEB50D856B11A5AEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695997, "uuid": "cdf2579c-3578-4ee5-bbd3-68728b5fd68a", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695997, "uuid": "4b68d87a-a3de-4201-908b-b07ab0b0c472", "value": "24576:2qHhP0Hccxas/JLDBL37IBaixEH3xIuTAhv8M:HHhMHccxrd7IAoEXxFAhEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695997, "uuid": "dccb86b6-34fc-4f25-97d8-bd963566369b", "value": 1486848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695997, "uuid": "0f7adfb3-e842-418b-a575-af6a7a2084a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695997, "uuid": "9f4c5101-090c-4d57-90da-9a121fb4bc65", "value": "SecuriteInfo.com.Win64.MalwareX-gen.75939432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715c841a-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755702042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702042, "uuid": "93890385-9918-4947-bc77-73056e5b7636", "comment": "Malware payload (XWorm)", "value": "fd45dd72e29bd2b4c0728fe4880f92ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702042, "uuid": "a38d3798-45c1-47e1-82d3-16925f5f05bc", "comment": "Malware payload (XWorm)", "value": "ae3b091dc9baa4497d5da784515c69539eeafd4d38bca1e42a3588fb8c56e47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702042, "uuid": "fac22055-4dd5-47b7-b41d-93c69415a922", "comment": "Malware payload (XWorm)", "value": "9f2ec5b04d9a3bf36f273b802d04fd41e0c35e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702042, "uuid": "72c1f5d1-0a87-4801-af72-1c62932f2566", "comment": "Malware payload (XWorm)", "value": "5d6a23c4bb42e13a363e1f4d923a47ffd4af3117507944fb5a88e303b40a75fda6df0a46f82a81a55a52951e381c2858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702042, "uuid": "b31803b8-9836-4d44-a1f4-327c70550bef", "value": "T11787332832F9C567EE49333BC4DFA84551C0DF8F21B7D89E00291F17E66295EC58AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702042, "uuid": "410bcaa1-ac58-4181-8fb7-5ec1bc1f86c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702042, "uuid": "fc0fd3da-6cf4-48f7-8915-e19a02f5bc7e", "value": "786432:hh++0Yqw2Zm1e3OtrRzbMcfPydLVaNEDpQoYeW9YsMqxprXpu+wXo6aaCh:7+1FZBOHbMEadQEDpQo/WZMulg+wXo66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702042, "uuid": "ff06a43e-293d-4a90-be2f-3595560424dd", "value": 37264896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702042, "uuid": "3008d85a-d4be-4d43-a824-15410ad8ce67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702042, "uuid": "75f2afdc-625c-4a24-8552-ab9cbeaf71a3", "value": "fd45dd72e29bd2b4c0728fe4880f92ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511b4ebc-7dc5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1755694687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694687, "uuid": "e695c86b-8105-47f1-986e-cb1dbfc6016e", "comment": "Malware payload (Formbook)", "value": "77bb7e58c81684e5b380ea7a15bb8f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694687, "uuid": "5128ae13-9954-4db2-9a96-eb7c567b123a", "comment": "Malware payload (Formbook)", "value": "af6376d7d5de38d0d7acf754db0d4c4f77ba49a48eb1cb4d240b16d3725d58dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694687, "uuid": "d462c87e-6861-48ca-8495-aef93e4bb1e0", "comment": "Malware payload (Formbook)", "value": "cb17e0d7578e2b2ddfadb7c4c382e8c22c33e413", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694687, "uuid": "acd295e1-6b26-49ef-8c58-99f0c06b941f", "comment": "Malware payload (Formbook)", "value": "ef01ba62cee39c3c2d877b9653f4c7704acf7ef2c7ce16f91a8f992e547aadaeab09fdcf55f3dc2967385524b17ad887", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694687, "uuid": "09f4d906-b9ea-4857-83dd-4b5d05d4306e", "value": "T142F42396A5C196B5C0107330C423CDA49A7979B08D05732E8B6EF17FAC313D3E97A66E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694687, "uuid": "4697fa2a-cc66-49a6-a977-4e71ad70e256", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694687, "uuid": "102414f3-c79d-4221-91e3-802ef3ee7c79", "value": "12288:cz7hU5I5yuNHIgzSFKxWltRohBfSTso93U97xbbDaFjN6O1IOHUfn8sbBv6pUbpr:cf+iN57Gtene3WBCFjNPUfnfNv6pUso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694687, "uuid": "378964f8-a43d-4eaa-9d03-09b66da260f8", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694687, "uuid": "fdc2f631-f387-492f-b712-581cf67ff5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694687, "uuid": "d71c3385-e3f8-4ea8-8fb1-7f11237d04dd", "value": "New Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118b9a4d-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1755700593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700593, "uuid": "08d0d607-c20a-43f7-ab77-c139414c15f1", "comment": "Malware payload (Gh0stRAT)", "value": "ea516528e77b89630d0428052858c383", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700593, "uuid": "2e9b1a60-d23c-4f7d-b128-a001116ed9b7", "comment": "Malware payload (Gh0stRAT)", "value": "af7a09d5f5a6da0541e1a1f736efc3dcbd59adb715904c8cd8aa3b31d2bdebc9", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700593, "uuid": "e2fb25bc-6bcb-4dc5-b330-2b5848268587", "comment": "Malware payload (Gh0stRAT)", "value": "48b891777ab4ffbf92c0e71b241b460a7939eea0", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700593, "uuid": "af1f93cd-ca69-44b7-8c83-a9d7fcf92dff", "comment": "Malware payload (Gh0stRAT)", "value": "8b11c3f864dd56e85659cf4869ea2a59bcf4f8143785639cb0165ee5f60de05fb52df59b46f8ad8eee3d74e963d96446", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700593, "uuid": "784e0748-8e7d-48de-88bc-2f0410924e54", "value": "T1BEC5AF0BFF8245A2D8DE417D12A757BF4D398A18872496D3CFA128ED98316D0673F398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700593, "uuid": "cf15fa09-899f-4d44-aad4-aa42c682ff19", "value": "ea7f01c685540a759edb849475962385", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700593, "uuid": "27bd316f-6d6b-4003-850b-6b79ea2333e9", "value": "49152:J2rmEVwx2EOvraB0i8ioRL7MPomOPByRSzJvTtIsI2Iwo9gJ+r:J2rxw/OvZiygA7yR+vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700593, "uuid": "97c5d853-fc94-4ec1-b1da-4182e547cd9a", "value": 2668304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700593, "uuid": "cd60688a-2f50-4849-a5b9-f5019fd3a643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700593, "uuid": "914f7daf-082c-42fc-a797-5ef881a55f74", "value": "af7a09d5f5a6da0541e1a1f736efc3dcbd59adb715904c8cd8aa3b31d2bdebc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c4f696-7d61-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1755651656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755651656, "uuid": "1f24f574-f8d0-4fd9-b839-3238c1cf77bb", "comment": "Malware payload (ValleyRAT)", "value": "ffdb6e34d6ebb58b04d8a174c1d9e585", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755651656, "uuid": "c9163cf4-2f50-4c90-b564-d39a69caf9dc", "comment": "Malware payload (ValleyRAT)", "value": "afc1c609c61f0fd57af799442d036c222fe91b8e038a9b8aa3e65601406c9a0a", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755651656, "uuid": "a371b3b2-9b28-4d17-8187-2baa6a9a3bf9", "comment": "Malware payload (ValleyRAT)", "value": "4ce20f42bd617116688c62d68823eda63fa4ff15", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755651656, "uuid": "69f4a22c-7d9c-4829-9a83-ff93cfeea73e", "comment": "Malware payload (ValleyRAT)", "value": "90f4929d6bbcea06b35335ce1aa85847ca0ed2047fb97722b952197805578ed10bc52235b1bb1c3da68a503d2335ca04", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755651656, "uuid": "905e0c04-5cd8-47cd-9305-3b548e8a7678", "value": "T15EF71806F702CCD6F12A8274945B4F95A331ECB19A61872332AC371DAFEF38C5EA6554", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755651656, "uuid": "a1beb138-cf84-45c4-b769-699ac4d50ca0", "value": "9b49ff97f0d9020b722efed0bb97fdcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755651656, "uuid": "d314e726-7b36-47ae-a3e1-ad4e41f5ec0a", "value": "196608:iii2PoqFNKZaZfelfMiKH22Fw27QZseATWvGKA6SnjBqtiEPFNPy9iRlHrx6/m30:iJvu7trBzjl9ifrWm8H4AQi7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755651656, "uuid": "713a8b37-96ce-4da2-977a-b1faa3ea4b41", "value": 72048640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755651656, "uuid": "b71efd9f-a2a1-435f-a6a6-2a78b55021bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755651656, "uuid": "5613b8df-f359-4545-8a16-7a8b5fc0bb14", "value": "bui.856201002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd6f55c-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677661, "uuid": "b27e9ae4-534f-4777-972f-6a3bb2583ccb", "comment": "Malware payload (Mirai)", "value": "b1497dcfaddcc307f4cb6629e5590e88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677661, "uuid": "cf1b3477-e4e8-4b5a-a47e-7fe1aafd44db", "comment": "Malware payload (Mirai)", "value": "b0b079a2411e7bea391255a3375e89995123ea4061598a03ad5b68fcdde3859c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677661, "uuid": "5dd62332-dd24-45a8-98a0-544ebb4954a3", "comment": "Malware payload (Mirai)", "value": "923f4a374c2a1f94c4630dc1a3947ea88e034cc6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677661, "uuid": "ff8c8bd3-9731-43b2-b08a-47febd2314b4", "comment": "Malware payload (Mirai)", "value": "12c0806dd606608161745214cb0055c3f0eb025624996096c4272d065765073d71b2904e85bdb5a4e0fa78e3ee41c4e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677661, "uuid": "64150a7b-b814-4004-9624-534741bc2503", "value": "T155B3D509BF610EB7DCABDD3B0AE9170124CC691B12A87F767570C81DB21B64F66E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677661, "uuid": "843f5ab7-a780-47e3-956c-aeef30c9394e", "value": "3072:BI2e72FcC4pQiMCtLlBFQU+qmie1yxtZywk:BI2CCXbwtLlBFcqu1yxtZywk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677661, "uuid": "52c4d228-3c88-4fdf-94a6-103a3546ead2", "value": 109816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677661, "uuid": "aae392ca-ab5e-438d-85df-06ac2458c89b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677661, "uuid": "330986cc-c093-4b83-b117-574691031872", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ff91cc-7d9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755676582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676582, "uuid": "8829568d-41b9-42c1-aaa4-50ec632fb7f3", "comment": "Malware payload", "value": "e99221eb78df17dd1181fc164df53b22", "object_relation": "md5", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676582, "uuid": "a745907f-3390-4577-8cab-4b998d620da9", "comment": "Malware payload", "value": "b1be273c627ef67cb48216d5daedca04eef409f964722ec682d03386bfe5756f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676582, "uuid": "daa4b207-e388-481a-ae2e-af140a910717", "comment": "Malware payload", "value": "5573ca17822ee24f18f8c39f236a7abe99430475", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676582, "uuid": "c0e7b00c-e061-4ae8-b9bb-82f1a57ed3c6", "comment": "Malware payload", "value": "2a811f51e4ccd612d10b29263c48bfc8eca380e8669215f55d32cb4e4819e5f66a41c7e973486083165b74c4a65a2c3b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676582, "uuid": "091c697b-3809-4411-88c2-fd2ba7f179a9", "value": "T14D047D8C6466D037CA474FF291A29F035A10FC823B93A46EE6816CE579B0E815BF7137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676582, "uuid": "65d7ebe9-1499-44cf-b990-44f2999d742f", "value": "10c959f88898267b23caddd079baff3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676582, "uuid": "7e14c357-b698-49ae-8352-442a40acc679", "value": "3072:G1S8tMw2Hcve9susxmjbpFvB5JBqlMCQVbIonhWR:/cKvB5bqlMCQVbDQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676582, "uuid": "64b962fa-f5ce-4166-9fc1-f950114072f0", "value": 177520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676582, "uuid": "745e1436-cfd4-437d-978b-ed35e495c019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676582, "uuid": "2ac1c436-d07c-414e-a789-ab1464b292cd", "value": "JCreate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b68828de-7d97-11f0-91c6-42010a9c0006", "comment": "Malware payload (BQTLock)", "timestamp": 1755675100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675100, "uuid": "eec7d4c4-0100-41cf-8911-2fa4320c943f", "comment": "Malware payload (BQTLock)", "value": "1859f56847ccabc6581a56f55041955f", "object_relation": "md5", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675100, "uuid": "8de4b2d9-66b9-49d9-a3ef-7ae1e79a5fb9", "comment": "Malware payload (BQTLock)", "value": "b211537ea626fae4ad2ef5ee2652633dc68aaf20da6eb953a44f266c4106b367", "object_relation": "sha256", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675100, "uuid": "a03425e9-e6e2-4784-a1e0-f1bfaaeef1c5", "comment": "Malware payload (BQTLock)", "value": "d4999a1bd31343ef380147b10c2a185411cd5413", "object_relation": "sha1", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675100, "uuid": "85638787-8807-44ff-bcbe-ed1b974e672c", "comment": "Malware payload (BQTLock)", "value": "025503076f9cafdef81ad47215a22e37843a5675cb5aae155a08be69262c81d3555378394dc46134ec4f2afa55849981", "object_relation": "sha3-384", "Tag": [ { "name": "208-99-44-55", "colour": "#241680", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675100, "uuid": "1089f27d-226c-42d1-b749-56a0062eb101", "value": "T1BF865B6BE17720EDC66BC1748257A732BA30B81400747E7F6A54DBB12F61E901F6EB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675100, "uuid": "2503c349-c72c-4777-808d-16de975db786", "value": "96e2c2ef4b21c8c7d61113fac3c4bdae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675100, "uuid": "e21a1ea2-23b8-486d-af95-09310d98b1b9", "value": "98304:mjt9/0y2EP7GEBd3TPXgfCYUWIf+ccwacGafsCILeeHZv+quETo:mz/32oTPMpCCeoZlDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675100, "uuid": "90952524-14da-491a-bafe-cefb28cd0ae8", "value": 7976448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675100, "uuid": "2f559fd3-790d-4cb7-9038-e63029062fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675100, "uuid": "8265d9d4-7bd2-4b82-a29e-d228157775dd", "value": "b211537ea626fae4ad2ef5ee2652633dc68aaf20da6eb953a44f266c4106b367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc7af86-7d87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755668025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668025, "uuid": "55b9afc6-5b48-451c-a057-c716fd94d36f", "comment": "Malware payload (Mirai)", "value": "1b4d296637ebf5535292eaa38ec8af9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668025, "uuid": "c94c9df5-ca9a-4ae3-961c-f1ae6fb1c873", "comment": "Malware payload (Mirai)", "value": "b2d6610134fb653326cb406ec2e15ae89fcb8cb07bd2b7057cf87e3e43b6c9c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668025, "uuid": "64fec88a-125a-4811-a87f-ea5478d218a9", "comment": "Malware payload (Mirai)", "value": "d8f0639a0a167a4612e80988a31e2afb639e12eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668025, "uuid": "5d6efd29-5486-4250-8fe2-b941601952e1", "comment": "Malware payload (Mirai)", "value": "90f4fb6dccb74ade6654c787ca78125962ce175e0b0e5c2dbbd492a20091d42bbf1ad9c7887cf8cbc935ef9c581e43a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668025, "uuid": "2f6ed297-6197-4417-bdad-ad638a458efd", "value": "T1D9142945EA418B03C4972BB9FADF424533339764D7EB73059928AFB43F8679A4F22502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668025, "uuid": "69f7fdc8-2e73-4296-9c21-de4ca3507aa7", "value": "6144:xBzcQHnV/XwSoBn3S4kx+pZHaZhrGdawBxjWfOiKr2KgV/Bq7Rbv8:zzcQHV/XwSocX+pZHaZxGdawnC2iKLAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668025, "uuid": "ee5813d4-45eb-41dd-ae8e-847f0abdba09", "value": 206037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668025, "uuid": "cf175827-5b2b-4dd9-8ce1-37c01e5994a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668025, "uuid": "9d0433ab-e830-4217-8af6-08e68280dbf8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0697f7a-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701799, "uuid": "c552b660-e254-4b57-8863-305a190f6212", "comment": "Malware payload (Mirai)", "value": "0d3f9cb0748341e98bf218ae430d1686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701799, "uuid": "8f764503-eabe-46e4-9016-fc819f3765a1", "comment": "Malware payload (Mirai)", "value": "b347cba1be1c0551f1fe95f2de4a3c3db7693287804c998afc25062af0a957db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701799, "uuid": "fb9a4e3b-6d1c-4a03-9276-40b7ed612259", "comment": "Malware payload (Mirai)", "value": "4a4295cbd268e1165ec28b2b3f264e1213160fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701799, "uuid": "c0a1195f-fe37-458b-8e5d-ccafcef73548", "comment": "Malware payload (Mirai)", "value": "6eaa6e03e7281612b630ad455d8ca68ec534686116fb65a6cddf4c502f7d89c9d22434a13f0c16a338ab64a13ac950d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701799, "uuid": "6065af30-91fb-4b31-b648-8b67aa286199", "value": "T1D182DF3061AB74F4CBF14430FAAECEC6971A0BF8D1FC36D217596B78894210651F92DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701799, "uuid": "03fc3575-2b8d-43aa-b62a-1091264d1140", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa4yhymdGUop5h5lG:2dV0P6+kom0tVAoNvm+to14ys3UoznlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701799, "uuid": "294a72e9-a18a-4fe9-ae5b-4531ca66424c", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701799, "uuid": "0eecd488-f2ab-4626-af6f-0c1fa6417990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701799, "uuid": "26bc1a8c-b5cb-4d56-a93a-0f2e062a3c09", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6058a08e-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1755693424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693424, "uuid": "2d451bb0-ac68-4a38-95a4-bf5a5a13bdd5", "comment": "Malware payload (HijackLoader)", "value": "cabbd20f395dfc9383ad3d55e76be4da", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693424, "uuid": "e4a795ae-d127-4b74-b53f-dfdd1bcf03dc", "comment": "Malware payload (HijackLoader)", "value": "b3b4d546cc1e82113e041876c694af3149f085ada1285728298aadc71d8d82f2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693424, "uuid": "586a57ee-9373-478d-a782-c9813d584253", "comment": "Malware payload (HijackLoader)", "value": "ffe782c6e7371a2d7aba830f04173727942d6a54", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693424, "uuid": "7d88f9cd-c613-48a5-9d54-8abb22a2f43c", "comment": "Malware payload (HijackLoader)", "value": "8382f4388e522e48dc4857a78b7bf65ba51bed3ada286679e5d3442fdd4a7893da04f89a21cf3a10d4e1a896abf0c5e1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693424, "uuid": "befb1e9f-dfe2-4948-9859-4371e66c6d40", "value": "T175B6CF20A3958477D1B32A39486FEB94A8397E301A30D55B7EFC6D0C6E74B807B26357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693424, "uuid": "ca8c9bb6-7242-41cd-8264-e49b6b73b508", "value": "196608:UdyWF78dw7lVc24dWI3PAdIH3bjdZ8Jsv6tWKFdu9CV:UdHFQcVf4dWUrYJsv6tWKFdu9CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693424, "uuid": "755c0152-10f8-456c-b067-8c8e740ae84b", "value": 11046696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693424, "uuid": "421084ab-3791-4439-b04c-7540552b031d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693424, "uuid": "ab61660b-9b61-4039-9070-10d31fb0a567", "value": "scrdll.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3a1482-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755697440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697440, "uuid": "eefb02e7-4b5b-487e-870b-581ecde53bbb", "comment": "Malware payload", "value": "d51448e77298c05966d5becac5e39f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697440, "uuid": "5e6f1670-49c6-4209-9089-bfd6a8fd2442", "comment": "Malware payload", "value": "b3bffc13d7b6c97ef986cc9d525a8f9f4acfc927b9ec7184f43ed6d2098b10ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697440, "uuid": "547bef22-e20e-4152-8505-ebf747440a59", "comment": "Malware payload", "value": "08af769da4a93b8f8c0dfdcebf396f72e17056ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697440, "uuid": "ea5896f1-95ab-40f8-bd8b-8b0b231937db", "comment": "Malware payload", "value": "c9304c6a44a22c1249fb884c590da4156025fdf3b839e62e0d1541ea26d0dbde38315e7d8a6db6de79adf5541c03c948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697440, "uuid": "3dbb8ba1-1ccd-47a6-ae72-bb7d84602f7f", "value": "T163087C4263EA09D5E9FB9A3489E65213D673BC067F3086DF324C172A1F736E08976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697440, "uuid": "b93a659e-43a3-4a4c-b4c5-6cc79d4c94b4", "value": "cce1b27dcdd3bb731f7ca33eedec725b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697440, "uuid": "1f207a58-8a7c-4d68-b6db-b4742ad48c28", "value": "393216:pn4GveXJiVlkkCx7mRynvVnYo+A3HZC5r8dgVRsfQOKGwkRfCPe9rLtIg9bhPhxV:pYOhqiqfnJJF2gLPkoMWutgPdBsiYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697440, "uuid": "0fa0cbf9-0d0e-4833-85dc-80924e756022", "value": 83335538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697440, "uuid": "61d21c63-a3bc-48c7-bc85-78c7ab393559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697440, "uuid": "2125922b-dcff-4b52-8ca5-1886fe6b7d44", "value": "NewlnstaIl_Ofic.1.9.80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d575c38d-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755697486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697486, "uuid": "0ed19e95-0f26-4adb-bac8-8502c77646f5", "comment": "Malware payload", "value": "910e2362ce946fb6d047a61487ef9a6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697486, "uuid": "9ca5eb0c-f228-4dc0-b272-6b6f0f6ae76b", "comment": "Malware payload", "value": "b44df798d6d8eb235baefc57f36104823d25f8fa97c97110224323b67b137103", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697486, "uuid": "d21e4981-817f-4bf3-8a3f-db1aab936132", "comment": "Malware payload", "value": "6e7afe9a71d2e1105701c7cf305f8363c62bf2ba", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697486, "uuid": "197b612f-e6a4-4db1-ade6-3a8ea2944869", "comment": "Malware payload", "value": "4f69f6d3ccb24a051bf886a19c9d2519014e051bc1df8160f451a2906d8bba94bfbf6c1e182f0d384caebbae0c12f154", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697486, "uuid": "32557885-baf0-418c-86fc-b027e4d49601", "value": "T122E0EDCD72A3E1BF84644D08B2B36626D50DB5E021709FD9FB456572C889AC3B064F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697486, "uuid": "0009ba10-56d0-4a98-9000-d3cf13faf551", "value": "6:5DBlCIVmRVc5Fl+8m489alw4LZPlSa/4ga4FClQf84iAKLFb:5jChq5z+8f89+9LZdSaQga4oo5LKxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697486, "uuid": "3c1d1bae-b57d-4342-a237-b73db0cfc588", "value": 383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697486, "uuid": "21ec8041-d6ef-4aee-9d47-d788b9b17b17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697486, "uuid": "66ae2d83-f940-4aca-976a-f03ba1e17312", "value": "toto", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c747fe45-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679423, "uuid": "82db5f2b-f21e-4760-ba32-5ae7f67b4edf", "comment": "Malware payload", "value": "1b03f68bc485f4ffede2a3d935e6f7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679423, "uuid": "830f4fcf-456e-4bb1-ae3b-e11d2dd9fd9a", "comment": "Malware payload", "value": "b51951e1b4a820b55d9a5340d9a7b0048094e5764471587a03c213c40a9834ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679423, "uuid": "880cb4f2-4a84-47af-9d2a-c1f19810d091", "comment": "Malware payload", "value": "9e0fe3d314e69cc0f4616a6b0ab740002e207a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679423, "uuid": "d4c40b0c-9183-42a3-8c8f-a49ea14efed5", "comment": "Malware payload", "value": "1df8f5d9eb5f63bcca0f1e09dfec02dcab892d37c8140016fd03950568737aa8dc9e830e37620ba02407ac487374f3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679423, "uuid": "121a7f08-f6c9-4269-b14b-e4d6994d612f", "value": "T129C7336BE7A909A4E4B7E4724523E713EE337D055233BBBB1588600F07373929526F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679423, "uuid": "f6b00155-a8f7-4b2e-8097-160eb6755556", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679423, "uuid": "ff03f3c5-a5c4-4890-8165-7b9029e9c6f9", "value": "1572864:4LwTHA+4siw6O6tR4kb9FgzIthUHMYFh+nY:a+piu6t6kUIPoMC+nY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679423, "uuid": "0f883a2d-b3b4-4daf-97ec-b53548dc9983", "value": 56626766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679423, "uuid": "9e436c84-a231-4acf-8f3c-9125c688c99e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679423, "uuid": "88b94b91-827c-49f0-a101-6809f3dd5d9b", "value": "Test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da695690-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1755697494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697494, "uuid": "cbfe8fc9-b389-4246-8101-885327337639", "comment": "Malware payload (Vidar)", "value": "68e72fba3a0a2ef45d7a05eda4545224", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697494, "uuid": "23f2e62a-9de8-44ff-a358-daf1c1628637", "comment": "Malware payload (Vidar)", "value": "b51dfbab2254fb8882316153e898feb9236a4ceea571980496da12bcf3df1164", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697494, "uuid": "3edcb221-8c50-4728-9f34-7c2e672f14f2", "comment": "Malware payload (Vidar)", "value": "b5cc49413552664596b50489ab6bc2f6995fcd62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697494, "uuid": "4f9581ef-79a6-42a5-9871-79b2019c1609", "comment": "Malware payload (Vidar)", "value": "ea09b69ac2f621483b065df914b8c195bb2a86035fd7990062059058a9506894cdace1408ea3b0d4475e3b78e79bc217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697494, "uuid": "4d9af8e0-6dce-482e-8505-615e1d4e57b9", "value": "T19B853A12B8D234BDE1FDF1324AA67731763278B903336783258716AE8675BA47E2D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697494, "uuid": "6875d3bf-5175-4910-97a4-f8803bac1c59", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697494, "uuid": "01e3cf32-6e03-4fa4-966f-a127a4939397", "value": "12288:lzEQDF2kMfSi89lTcS5kkD1CXNHGCLG9TYfdTcg4tdhTHjOiHrVkN/2ftIl:lppTMfSiKlTcSakD1w0/9TYNY5N+ytIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697494, "uuid": "35692754-4c82-490d-846d-d8fb04e4a1ef", "value": 1761680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697494, "uuid": "3c66a484-9901-4c13-8d36-fb02768057a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697494, "uuid": "9d2f8ac5-a940-42f3-b724-21750f4f74ff", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc058002-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721548, "uuid": "54b57fee-5bae-4722-90ab-490f1b1b8a8a", "comment": "Malware payload (Mirai)", "value": "c5d2fe6a750e4115193d2e5ce74966bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721548, "uuid": "64c84ba6-0b13-41c9-add8-07095ff3152a", "comment": "Malware payload (Mirai)", "value": "b5767d5df62d332a4b4906c00c44674c5c0c20e2a3206a29eeae0425f81644fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721548, "uuid": "be00e763-a487-4032-b10c-66e1ab564ab2", "comment": "Malware payload (Mirai)", "value": "7ccc4fdc55022545c4df084ba978bc078cb696cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721548, "uuid": "c23558dc-3145-4b2a-9434-68d62c5ac038", "comment": "Malware payload (Mirai)", "value": "3da0d745f6238b9f33f06e2fc38d9fd87122fc281860e7f9ce7a6c8d46bb324fb316ed6a386ce0a2503206310e6a2eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721548, "uuid": "2da728a9-5bd0-47cd-8575-e41532433669", "value": "T1DC432925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721548, "uuid": "6d31e7d7-7ea0-4a8d-a37e-322a71785e55", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDP:eL0AxvSHfymp0xgunvCkV6vTMDauo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721548, "uuid": "932b108e-f54e-4243-aed4-56f9978a6916", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721548, "uuid": "f1e31313-3bb9-4dea-8263-e715950d7b6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721548, "uuid": "cb95f468-f331-4764-9075-e25c9ea0d9b1", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cbb4f3-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701805, "uuid": "71a22f7f-63fa-4776-bed3-293918b96c74", "comment": "Malware payload (Mirai)", "value": "8a638573e5651cb6f847049869bceddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701805, "uuid": "adfe1d56-b996-4b17-a272-5e6a77799b79", "comment": "Malware payload (Mirai)", "value": "b5a6d8beac4377ee9ed1d4c840a041663fc0a65e0b7d650a9e93d96cfb393b9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701805, "uuid": "cead9456-3367-4d62-ad93-87a834c37bfc", "comment": "Malware payload (Mirai)", "value": "3a89600faca1a8b7c01f3eca6a6658136408231e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701805, "uuid": "ac75737e-1f06-4f18-b887-d0375706dd8e", "comment": "Malware payload (Mirai)", "value": "7ba88bebce2559618b68f97172956232060766be98bf211c2140be660be9de4216081295cc393f12c9ecbea94846ab5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701805, "uuid": "3fe94ff5-30a7-4905-9609-1e657c42d4f7", "value": "T1BCA2D025D345AEF4DFEF9D9493C2C2C27BF543CA2686C8E340EEAF016916056B788D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701805, "uuid": "6ade1e33-357f-4ae0-b2bd-71a3c8aefd3d", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5u/M4uVcqgw05VxJ4:9RxsSVsMD6xiJJE5zRWNUU4uVcqgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701805, "uuid": "29340148-9eb5-40d9-b633-160b7c25809e", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701805, "uuid": "aefcd6a0-11f5-46d6-8a5a-ca4baacfd7f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701805, "uuid": "894ffb08-e0ad-4c76-835d-778a83aeb4ac", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bd2b01-7df2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755714270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714270, "uuid": "237b8cfc-1d2f-48ec-a6fb-7c15a3b45e86", "comment": "Malware payload", "value": "00e2683beaefc0885e6166acfa00b6cd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714270, "uuid": "b38f8527-97a5-4392-9d39-8f5902b82d68", "comment": "Malware payload", "value": "b5cc70d0891be5c164a28d09d090884c78c45d70cdca506ee1f1dd50ce07a40f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714270, "uuid": "7783f799-e1d6-4690-ad1e-4781c6fbe841", "comment": "Malware payload", "value": "bbf72e6c949a5b5f8d7f2adcfdcc0c5ec1423ced", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714270, "uuid": "4a12f73e-6ca3-4684-8a20-3be97cd1a43f", "comment": "Malware payload", "value": "449583a0d9e15438688c3cb50bf83aeac906e0f4fd0feae427000de54098ded631a9195908fe09b91f1ffae87831ae82", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714270, "uuid": "58db445f-2a06-4687-8e64-cfeb77faa1d9", "value": "T103C60147FB048A4AC4F783B249335B9026270E678B4397D76964397D3C776D06E8AACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714270, "uuid": "f95a5c85-0e96-41b9-a41e-5bdfbb8f2c7f", "value": "196608:5r7MCOX2wrxZImUkz5Q+rTRH1e1YcGZG2RNpkjqSQmT47q6tKx/odLifPbv8dUx:53KImLQwTjVPZG4Npk+SQ77q6tyodLKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755714270, "uuid": "af06d993-4307-4229-8a84-fe2f8b95eb61", "value": 12300486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755714270, "uuid": "2d454000-b67f-4e70-8ab3-d707ca27db66", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714270, "uuid": "104a3002-d594-4a27-8d3d-a2a4985e3b19", "value": "update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9b4ece-7dc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1755695996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695996, "uuid": "d71770b7-01f9-4a6d-9630-2b38892501f2", "comment": "Malware payload (Stealc)", "value": "a2af3dcbacc7cd5e49a0b07bb25e534f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695996, "uuid": "c30f265d-3bda-49e7-b754-cc5707b6950c", "comment": "Malware payload (Stealc)", "value": "b614be79d0c6b529345bf056ca1201bc1ffdba0d85677c648297a993706b5498", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695996, "uuid": "d4c7fd4b-6d5f-40fa-acbb-c7a8a7c35765", "comment": "Malware payload (Stealc)", "value": "f90d4072fd34eea62b1c6ef748a61978f0862c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695996, "uuid": "3968218b-870a-4c5b-8a03-e57c21b1f170", "comment": "Malware payload (Stealc)", "value": "894e2e6887b52de30d2e5ca4196e3db951be0835b628a5c830759a2caea581c71037dcf5db09e8fdd77bd86dd6fa5ae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695996, "uuid": "605bfc82-c046-48d2-a4f0-d30aeb49eeaa", "value": "T16A7623AB058F84F4D5C51934652B86C732F39DCA48858C1A9DC4FC81AE72FB9A4F6C87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695996, "uuid": "c5fc70c8-f4cc-4cab-99d7-1959fb398eea", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695996, "uuid": "17f70d86-b266-463e-9589-63722c79f111", "value": "196608:JPBIrY08PuSCp404oy5zpQr4crYTFf2xki1ZSAvpfuxq9vzhD3kwU:bIc1Cp4E4JFi1Z5vpfvDUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695996, "uuid": "8c9abd9a-478f-4f96-9f68-d691622cd06c", "value": 7198600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695996, "uuid": "526de225-c7c5-49aa-b5b7-07cdf1ce78d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695996, "uuid": "f54fbd4a-6489-48ea-8c90-a67a742d1d5f", "value": "SecuriteInfo.com.Win32.Evo-gen.24133462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c61b61-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755706242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706242, "uuid": "83ec9535-d996-4d3e-8c18-5704212c8c40", "comment": "Malware payload (XWorm)", "value": "bd40c0edbd812402d7106b7580a0caff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706242, "uuid": "2b91a69c-5a9e-4b58-a29c-875b005d5bc8", "comment": "Malware payload (XWorm)", "value": "b614ed89cb0d56d32813856b16ee7b7c916a5e7c3a5cba2e97d9d8c6a59215c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706242, "uuid": "0ba1cf0a-4841-419c-8f87-dcd436cfaaad", "comment": "Malware payload (XWorm)", "value": "590b98f212d78c3c862841d35f7a7282b45bbb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706242, "uuid": "9d9c3756-9b46-421f-bd47-d855b2ec2965", "comment": "Malware payload (XWorm)", "value": "dcd874372b77ae34b014e42b1ae3321e3ae4ac4c6b9ddbf906275c88d84ab54976ff8cd7d7412c8263fbb4221bd100f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706242, "uuid": "dd8348eb-6e44-4630-88e5-5437194e85b1", "value": "T14CF35D1D6F8A749BE42C4EB15876E6C1067CEFA5F4A2579C24E4BE3D7792870C900BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706242, "uuid": "b60bb024-2562-454f-9d87-252d6ca219b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706242, "uuid": "6d0cb13f-58b6-4b3d-a61e-744d0c7de4cc", "value": "3072:BbIFB9rUOpoIvRUGKXs+S++7KFSbxeY+qDDrMc:gB9WGqStKEbxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706242, "uuid": "62e615b6-09fc-4774-89f3-6066e3911385", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706242, "uuid": "d7377c7b-1e81-4e10-9fd7-4dff88fc5073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706242, "uuid": "07992bff-6d1c-414f-a7e6-899608f55a10", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dc800e-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683155, "uuid": "72221905-d373-4a10-ab2b-44ebe0bd23b8", "comment": "Malware payload", "value": "40e9302e2328b2246f77b1a87a79da11", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683155, "uuid": "6fbf3122-db98-4523-a95b-ab249eb5ef57", "comment": "Malware payload", "value": "b67a3dfe111b6702ffbe82b9c31f3cb456e873c3d5af7c971290f7f5fd95c3db", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683155, "uuid": "b05539b1-e3be-45d7-b383-6456233ccecf", "comment": "Malware payload", "value": "a0eec57833c319a3945c91986d6e3827f69d63db", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683155, "uuid": "b374e59f-ead0-4798-90e0-99386edcb0c6", "comment": "Malware payload", "value": "4d44ca835bf47ebc42ddd71a1f593f5d5f59fec021ecba7aee60a7a721ff5cea323ca01ccc1115ff063b6cda0ddac01a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683155, "uuid": "c5c0bb50-43b1-4fb5-bd4b-ee3e82e878e8", "value": "T1A643189263DC07A1EA4804DA11B9A51BD1F2D03D39662AC4E9F3A757F839653FCB8370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683155, "uuid": "e1d4d858-c0bc-4a7b-b25d-169f4164f8ba", "value": "384:64R4uWSZRQEjUNBHWaeQkplT7gNYZA4R4uZI2c7zM:rR40RQEoNBKQkfCYfR48Rc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683155, "uuid": "33820e49-7d80-4066-b9e5-6662ba439cea", "value": 56652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683155, "uuid": "9d45926a-360d-4965-8497-6bfdb70aeb95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683155, "uuid": "69983c09-8ec8-406c-87b4-1b37138f54cd", "value": "par.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647be678-7d66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653917, "uuid": "fb24f5e6-c3d1-45c3-bf36-98470481ef68", "comment": "Malware payload (Mirai)", "value": "f5bad2d019a3d8e10ca79efd745d5cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653917, "uuid": "bc2e391c-047d-4041-b841-fe1a63a251dd", "comment": "Malware payload (Mirai)", "value": "b75cf01007e85ac67ea9e6044b0242c4b0e6c4db89803262ba98246968c4c85f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653917, "uuid": "ffb9a032-9f56-4a31-8a0b-6a79ae44e21a", "comment": "Malware payload (Mirai)", "value": "fcff2d4bf7f1e0873696ba6bd5c7ca6acb09ec38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653917, "uuid": "7004c062-53d2-4633-9af7-238b542a97b4", "comment": "Malware payload (Mirai)", "value": "2b7dd990412b04200b46c99eb4432fa46d8d9cb4d0b3bf679f3b66eeb62c60e57a59a7c497a5210e540761215ab23a2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653917, "uuid": "fedb053b-8761-4987-9059-a596367e7f5b", "value": "T13E33F752FC82859AC5C067B2A76E568A73A2A3A4D1DF3313DC584F1036C565F8EB7E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653917, "uuid": "39aa190d-9cff-4c3c-8f0b-7b5ddae654c2", "value": "1536:00qySotgV3657lJ6nn5QPTp5BI/0wGp8:dqyftgV36s5C5BIMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653917, "uuid": "2d089d77-50cd-48a2-bbe2-d6b3684f3be0", "value": 53744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653917, "uuid": "bf829268-217f-4454-a7d6-080baffd31a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653917, "uuid": "5b52ef17-b210-482a-a521-9f85255f3cda", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b5f485-7d8c-11f0-91c6-42010a9c0006", "comment": "Malware payload (BQTLock)", "timestamp": 1755670240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670240, "uuid": "becfc395-952d-434d-b2ec-035f70113d52", "comment": "Malware payload (BQTLock)", "value": "a6d91094a222da6576260abf52a07b79", "object_relation": "md5", "Tag": [ { "name": "92-113-146-56", "colour": "#8062D3", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670240, "uuid": "eb55f849-bc97-4c2f-be00-36db6b9d3ef2", "comment": "Malware payload (BQTLock)", "value": "b7796a3b1812f329c43d5d37bbb6d8032b7bc06b15af29f555eb3e0c7b1b1c3d", "object_relation": "sha256", "Tag": [ { "name": "92-113-146-56", "colour": "#8062D3", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670240, "uuid": "cf9d30bc-6707-49c4-820f-ba5b5155cd35", "comment": "Malware payload (BQTLock)", "value": "6fa76affe2bcf806e0abf98c1086971395324697", "object_relation": "sha1", "Tag": [ { "name": "92-113-146-56", "colour": "#8062D3", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670240, "uuid": "f9891626-5c0f-4b92-a5f2-aa1acc32fe66", "comment": "Malware payload (BQTLock)", "value": "cdae69e13417fcb91f9c113972e8a1db62333652266f1aeac8fb13a34cfd55bf47afe31f42f119fc7d107856c74c84b3", "object_relation": "sha3-384", "Tag": [ { "name": "92-113-146-56", "colour": "#8062D3", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot7060776700", "colour": "#9D67C7", "exportable": true, "hide_tag": false }, { "name": "BQTLock", "colour": "#E5CAF6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670240, "uuid": "c06bf971-c566-41e6-9129-2331746d179b", "value": "T16D865B7BE16710D8C5ABC174C25BB371BD30B46500347E6E2E60D7B6AF62E601E6EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670240, "uuid": "2d197439-1f12-4351-9a33-dab6ea4516eb", "value": "11ec149f1a1a7008be9ae73504b4745f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670240, "uuid": "7cb6efec-ed89-4975-a992-9a9866466ee4", "value": "98304:7J0FJH/VVu41t1hIIMKEFQMcMC8Yssz0t0Ah9DzJoPtu/+zNY:7JAH/7ueOK+PJoFsMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755670240, "uuid": "67d6ce27-ecdd-423c-b3ce-b63d602ec46d", "value": 8526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755670240, "uuid": "0687a44e-7d53-4676-a935-a54057a28bdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670240, "uuid": "748d1126-215a-4e8d-82f6-a55c7b296a0c", "value": "BQTLock_Payload_20250811_184656.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d2e5e4-7d97-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1755675010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675010, "uuid": "a2f37d89-47a5-48a1-b55e-35c4df41468d", "comment": "Malware payload (AgentTesla)", "value": "f99fa9d56880301b4819bf769150d0ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675010, "uuid": "3099aef3-d67b-45b3-ac68-9e1cfdff6d4a", "comment": "Malware payload (AgentTesla)", "value": "b7897827242addbf963c57f44ae4a2623cdd56c00935e30c9bd2231fa8eb8b31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675010, "uuid": "7960696d-8f2c-4768-a6cb-3fa4fe5e5518", "comment": "Malware payload (AgentTesla)", "value": "ee4dc820b59f4d7c7b2e42dd889cd6e5e2e2c46c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675010, "uuid": "1c04af3d-f78b-432c-9556-69e6f824c6cc", "comment": "Malware payload (AgentTesla)", "value": "6b015aeb0866c5fdf3841472f44657521140e207216b8c5c3f3e3ee3cf2b212f6545f51ded71b2a0d6c2569c1aaf2805", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675010, "uuid": "17845225-e705-41a0-b836-9bc8d3b0b21a", "value": "T1A865F107B9CD16E1C88C96399E6AF33C2375AD00A077CD457C8AF609453A7265AF393E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675010, "uuid": "27e0ca67-373c-43ec-82b1-e2228e9f9b60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675010, "uuid": "1c0e1656-48c7-4ad3-893b-12946522b218", "value": "24576:pwkaiyDjyRzTjgFjsxIL5nR5f99Ukk6PHpC11OnACh55Xl:p7aJDOlTAjs2BoDgJC11aFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675010, "uuid": "1a566c14-799f-44a1-bb33-277b65700ede", "value": 1464320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675010, "uuid": "e3429b87-3e53-44db-8994-047a10849795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675010, "uuid": "1bd35987-47e5-4a6d-8545-0b1c6873d6f9", "value": "z1Dry-DockSpecifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd6269a-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755721226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721226, "uuid": "6c14d401-3145-4f63-9940-12040b4555e2", "comment": "Malware payload (XWorm)", "value": "468da3d8e83b0107ec3297eeaf2c406a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721226, "uuid": "d9fc3809-5512-4b54-beda-c5a7510bed50", "comment": "Malware payload (XWorm)", "value": "b84565d97560dd94fe5eb2e7b41cce498f254d5a4eed32aa4e260dcc9a9d9ffa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721226, "uuid": "6833afcb-7aa5-40eb-b1ad-f76c2b6d4bb9", "comment": "Malware payload (XWorm)", "value": "81b6af00f74fa3c3bec58f39721dfb331f690ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721226, "uuid": "ebbb8cd2-c8dd-45ea-bf84-2122fbcbe10f", "comment": "Malware payload (XWorm)", "value": "a08af10f511404eb8aece9e94ac3e09a9c468bb8fd22f50c505004e86aa30032592a1b17d58dff9471ced501cccca1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721226, "uuid": "edc063ba-824a-47ec-a40b-3b7bb585ac06", "value": "T1325512897D45B087C3D965768E42B3B42D8161EE26B0D4171FFCC3DF5BA0A8892AE4D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721226, "uuid": "36f29851-c9c2-4d11-8c87-351c0d0fad50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721226, "uuid": "a20e8602-57a1-437c-a049-f70f3bb214b4", "value": "24576:MMvnndmYKYvejoqV2gIHNGpWrdHEN4NMLEyZhCZjHtYTSiUa:3ndmYKAejoW3+NCZMRHtYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721226, "uuid": "d3367826-c74e-4048-9e6c-b9aa1ed31b6b", "value": 1401856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721226, "uuid": "adb605e8-51c1-4274-a3bc-a64c15a2e914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721226, "uuid": "9a8d703e-3f2a-46cc-8e37-97fdd86a3ada", "value": "468da3d8e83b0107ec3297eeaf2c406a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67474e55-7da4-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1755680550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680550, "uuid": "28bd0509-6124-4ba8-b74f-3a1f6309d1fb", "comment": "Malware payload (SnakeKeylogger)", "value": "396aa2aa01356cadbd8b5f2a345d44ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680550, "uuid": "c9396908-1059-429a-8386-05abd53cf005", "comment": "Malware payload (SnakeKeylogger)", "value": "b89ac159c50e85f4f66fb3a0295504fd885b1d6acc96159cf1e4c5886d0afbb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680550, "uuid": "f881ad99-9ac8-434f-958e-16e7f63febf8", "comment": "Malware payload (SnakeKeylogger)", "value": "7760e27a1bf7204d77701473400660a0b995c46f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755680550, "uuid": "50624a97-5a4e-4e3a-ab45-57304e72b931", "comment": "Malware payload (SnakeKeylogger)", "value": "b74ac20668bdf7f1356403a6c7587cc664e6ba2d989ea315776f9d529c2a0502bd3c7045e02327b78ae26e20b79c96da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680550, "uuid": "d9233934-ddf0-4b37-9a54-38836650d28e", "value": "T135B422929AC0AD54D18163318832CC9099747972DE09777A8B2DE62F3C71393EDB3B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680550, "uuid": "92a7a614-fccc-4173-ba92-fcd0f2932155", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680550, "uuid": "e070d6bb-fbed-47f8-b46a-4c21e1bd97aa", "value": "12288:Az7hU5I5yuNHIgzSFKxWltRohBfSTso93URwqE56Wdq7qOhO:Af+iN57Gtene3356bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755680550, "uuid": "a32bc64b-8704-45c4-ba18-db209618a8b5", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755680550, "uuid": "28f1f0d1-780c-4c1d-92fb-2bbb3fe9cd58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755680550, "uuid": "50875171-7d4b-47dc-9d44-12d25b1a8268", "value": "rinvoiceAR29230714N.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638dc743-7d8d-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755670666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670666, "uuid": "28209004-40ab-48c8-89bc-0f93480f3317", "comment": "Malware payload (LummaStealer)", "value": "e4dfaffa64e9543c317e1871829c9323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670666, "uuid": "f1b427d1-cd96-4c75-818b-95fd11704c79", "comment": "Malware payload (LummaStealer)", "value": "b8cffd6c100d40528c30fe56db7e7c3e9e4c5d3059641eb3a1f08a69a04d147e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670666, "uuid": "7e3dcb95-acf5-4e8d-9ff2-cdb4d982f086", "comment": "Malware payload (LummaStealer)", "value": "ffe5d1922e83e82ad96780a1006165640995f0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670666, "uuid": "57b9286d-35ea-4a40-a438-53dc93d98d70", "comment": "Malware payload (LummaStealer)", "value": "23f5ad0281f7379a5b6ca7bd2c1d909ba5e10fa0fa0b7be8bf18488f3167a71033d62eb2d1ce0c8700cc2055bc6a805d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670666, "uuid": "aa1356c9-6ce4-402b-89bd-bfa1fc21361f", "value": "T1AA55D019A87A91DAFCD340F12B5A9111F423BD37CF382EEB81E4A7601556DED093E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670666, "uuid": "c73f7f5b-b3bc-4460-86f8-cd4ae8b3cd0d", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670666, "uuid": "8c6d9c26-51e5-41dc-b2d3-062eb64ee24f", "value": "24576:tRaP10vxZsz3mb0rHoTS6a2Em88LMLfxIXZaKlA3FfdwFPe:tRagx2zWgrHgS6L5ML5yZRlA3pqFPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755670666, "uuid": "617b04a3-d1d6-48ea-8def-7fe54c5b9844", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755670666, "uuid": "6ea402b1-022d-441f-9316-b848c624bd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670666, "uuid": "6f5c7498-e096-44a7-8767-5593dd444b08", "value": "Equa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c268cd-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701813, "uuid": "53283c8a-51c4-4ae4-93fd-60693e3ad2e6", "comment": "Malware payload (Mirai)", "value": "450a948a6f00122b8f747f44945de2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701813, "uuid": "7f7d064c-c5b6-420a-9d3b-fe4eb66c34d8", "comment": "Malware payload (Mirai)", "value": "b8d674cec7c48ec354fea58d29189c1675779e6f2d4a329945f4ed1adf1ea425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701813, "uuid": "b66df078-cfc2-46a4-892b-a08580d4b63b", "comment": "Malware payload (Mirai)", "value": "10229376e3a507bffe3d3329547cbc8fe0a97c86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701813, "uuid": "82de8fa8-e4be-4943-925d-69c63d6ac69b", "comment": "Malware payload (Mirai)", "value": "6db99c86cde36ad9121f31cc5c8bf41f3bd8f9f90b28cf7b709eab7327f0ab55ed6fea477dff3f4557687570040a5ffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701813, "uuid": "3512de7c-35e5-44f0-8353-179e9e228693", "value": "T180F30945B8819B15D5D012BEFE1E128E33231B7CE2DF72029D24AF647B8A96F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701813, "uuid": "246e46a7-552e-4dbc-b061-97341c24df65", "value": "3072:SaDIfOZR2bX5I0z9Qite8X92GWba3pnrBn7RrEdoWNPopx:SaD09bpI0B9DXgGoaZBRr9WNwpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701813, "uuid": "0fe7edb4-5ab3-46a6-99f9-fec002121e78", "value": 167580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701813, "uuid": "2d9ff195-23e0-490c-9127-4ba37d934055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701813, "uuid": "ec4e4b81-4409-436a-88b6-8e9602c43bb5", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebf6e84-7daf-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755685207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685207, "uuid": "3cdf6cd5-61bf-40fb-ba6c-125c850152f0", "comment": "Malware payload (Rhadamanthys)", "value": "0f79fd3571d08dc1ee4c856eccb4a9d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685207, "uuid": "7858d5b5-076e-43cc-adcc-54196495f8c6", "comment": "Malware payload (Rhadamanthys)", "value": "b91a974e9d0a0f438b8b6d1752bd9a08f953225e2dd48c39e3da0ec7779c3e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685207, "uuid": "0ad9beca-f86a-4124-af98-518c03bb23d0", "comment": "Malware payload (Rhadamanthys)", "value": "80527856b44c68093d7850fb3a8f3f299c0c6cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685207, "uuid": "a8beac8d-54ee-449c-9456-b2ac1589967d", "comment": "Malware payload (Rhadamanthys)", "value": "2da9ee76d0e894cc22bb91d5a4077e349787904112abb0388d272b5d7f8f424919e6b693ba440712664e9406aa3b2fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685207, "uuid": "86d0612a-355d-41f4-b3b3-beddb1760f59", "value": "T1E075335167E1CDA0F4F16E711E71AB050E6F7C6D0D74A50E0BA8AD8E683644788EC3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685207, "uuid": "0836cbdc-9ab5-4789-a1df-10e0c1a4ca20", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685207, "uuid": "132ea858-b9e7-484f-837f-779cf1c34928", "value": "24576:KmM8mgnkAusNpH05XMHA5ZFbovQ5Svo1ok2YX8Ptznu9Zg982gkB6v57xWSjKrmC:19M5HZFbQQYpkSBnubg93gkI7xWSjKCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685207, "uuid": "097a43bc-c65a-4dac-8d71-5d0d73efcfba", "value": 1599244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685207, "uuid": "259139bf-1fca-4a3e-ad79-395fad9590f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685207, "uuid": "2ef70f3e-aba9-470f-8de1-1f24c0b12de1", "value": "RobloxHacks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f1975bb-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755671115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671115, "uuid": "b5d26174-cd7c-4bd8-b21d-41f1444dfaaf", "comment": "Malware payload (Mirai)", "value": "ef22a5f9d794f036cadd6325999142ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671115, "uuid": "0ede8161-9094-4072-bd88-c3292f47eb02", "comment": "Malware payload (Mirai)", "value": "b9af1689b7651a2114cf98f5b3aba25b818cc38382d72afb10cdcbaf7e1a0e0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671115, "uuid": "c7ebf668-e1f9-4947-8d6f-0599b1f69243", "comment": "Malware payload (Mirai)", "value": "514a3848be8e158f85eede9e962cf450f4b0bd47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671115, "uuid": "40f7fa30-7450-448b-9871-2d758d8136bf", "comment": "Malware payload (Mirai)", "value": "f7250e35c98e318b16a2af2bbc161c5499a4d58dfe8932c87129c746e043fb753e0a4d59f7ab6592ad495211bf149321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671115, "uuid": "d454ab4a-a37f-4c01-99cd-7f06d826d838", "value": "T1C614950E6E228F7EF768873547B74E30976C23D626E1D645E2ACD1005E6029E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671115, "uuid": "dfc5aa8c-58d6-40ea-85c0-c97287223833", "value": "3072:to7/yuVctnbSmFxywUx1C1JXDrfWJ3HSxrUgmBrWJ5SlYdscqn:to7/yuVctbSEgwwIJXE3SKgMWJ5dscc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671115, "uuid": "0ee90aa4-b171-49ed-94e9-2408a5e06303", "value": 207320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671115, "uuid": "03ee78f9-6799-4149-931e-78d2de4c408b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671115, "uuid": "acf2706c-6978-44f9-8a76-c1cb840bbbb0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c756ee6e-7dd4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755701327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701327, "uuid": "58d588b2-2b10-4b51-8201-d25f53fee202", "comment": "Malware payload (Amadey)", "value": "fdb6f1e48ff8ec82a5d30d1aa2084078", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701327, "uuid": "14727ae5-9ceb-47bf-9309-26ed3861341a", "comment": "Malware payload (Amadey)", "value": "ba9dfea27d075639e627720e191c5f0dbfc689f8ed55213a4179b7b7bb4658d2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701327, "uuid": "80049574-748a-4aad-a82b-9bfaa52cedb7", "comment": "Malware payload (Amadey)", "value": "cc62b7e2eb91656f42279317da20ff0ba3b7c4cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701327, "uuid": "0e64314a-7804-4db2-8f59-9bf72b45c034", "comment": "Malware payload (Amadey)", "value": "93fa69670b6b2082e6bad3a1dfb9993a85bbbf1d5b3ac18dba88c8c8ef6834882560b840d8ab280010d0c1743e99444d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701327, "uuid": "3c3c909b-1572-4f42-9057-9e4336141725", "value": "T19F163311B1D8103BE87403B05AEA11971739BBB3A3A581FB579BDC2E18B2535B379327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701327, "uuid": "b949bba3-c3fa-4e92-add9-ca2ab65b9bff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701327, "uuid": "59135170-6875-420d-918d-bf8dcc697cbb", "value": "49152:Vr+b/Wlq7Ng/+aIz4isr1JeewBGFZGHX01UspzRA0EGCD8jwQF4LiIR3IJrzGp4M:4bWlENNs9r1IhGFgHFYELgrW8rqCHBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701327, "uuid": "d4c95f8c-e0c0-4969-8d74-d1f7052c9d4f", "value": 4388352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701327, "uuid": "4bf6b4b6-9ecf-4c96-b22d-422b60f021f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701327, "uuid": "a4e00811-c5e4-4c33-a68c-57e699e8ced0", "value": "BB1[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2f0d9e-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700557, "uuid": "3d7e5719-51fb-4c44-ad1e-8bd38e324211", "comment": "Malware payload", "value": "dbf3f2916a3ebd3244ece2105543eb44", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700557, "uuid": "7a701385-6a65-4772-bc8b-af7636435077", "comment": "Malware payload", "value": "bb69bd5548854ba89e0ca821b33c572a9a0969ad47a46d0229f07d4f854bfc6a", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700557, "uuid": "08070db2-c945-4119-9817-1c2514c46df4", "comment": "Malware payload", "value": "ddad312120cb01294bf9017ab4d19aebc68c1cb6", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700557, "uuid": "1325db7d-29eb-4d0f-a514-0c43a4f02844", "comment": "Malware payload", "value": "dd212c39bebd7862a4ea01cfdd84faa3358f2ed339dda57c3bd6e43ffa11f67d65776e40bf1f3fbdbc71aa9bfa43efb9", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700557, "uuid": "d39daf29-57df-40ca-a713-fc2a29ca74e7", "value": "T1B2956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700557, "uuid": "ccbdded3-61af-47d3-bb97-6b1d9135b6cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700557, "uuid": "b3353231-b8d5-4e03-afe5-c0e2b9da66b1", "value": "24576:mWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2q:Ht3UCiag6CKM2zCyZuOjJaxSS5qhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700557, "uuid": "00f2cb75-55db-4eaf-9ddb-6c66ff67d24b", "value": 1911568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700557, "uuid": "54a286b4-c681-49ec-a821-792553e44070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700557, "uuid": "a58ce22a-b4a6-4671-8671-7e2a63165e8c", "value": "bb69bd5548854ba89e0ca821b33c572a9a0969ad47a46d0229f07d4f854bfc6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037666cc-7dcc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755697563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697563, "uuid": "424a4624-4471-4bdf-b9d7-b4a9621a2786", "comment": "Malware payload", "value": "c56adcb34677019aa65e97ba0207aa95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697563, "uuid": "ee723b03-6ce2-4484-a541-f89b1607069f", "comment": "Malware payload", "value": "bbb1c469c47466f737478191e926140382678d9af3e342ea7bd3395f7b1d68bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697563, "uuid": "4749fbc3-3911-4d08-a8ed-e88a0f89313d", "comment": "Malware payload", "value": "4212b050a718f322a2e3bc378f58774a7b7aa12a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697563, "uuid": "a7767a0c-5ba5-46dd-8f2f-46281fdcc9ad", "comment": "Malware payload", "value": "e1a9ae789dd49aa5ab97c32e87d188fb715a4c0a5984007d66075f7f4259a6f27112ca03f66d9637f072747bcd1a4d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697563, "uuid": "158aec0e-f40c-44e3-b9c3-3a69aad487bf", "value": "T17A087C4263EA05D6E9FB9A3489E65213D673BC067F3086DF324C172A1F736E08976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697563, "uuid": "9c37db4f-c03a-4420-9b80-5edb734d9529", "value": "cce1b27dcdd3bb731f7ca33eedec725b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697563, "uuid": "3c6a5c91-dac9-4533-b16b-f6d30ebfe8c7", "value": "393216:Sn4GveXJiVlkkCx7mRynvVnYo+A3HZC5r8dgVRsfQOKGwkRfCPe9rLtIg9bhPhxH:SYOhqiqfnJJF2gLPkoMWutgPdBsiYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697563, "uuid": "6540b060-c61e-48ba-a8a1-f59770f9279d", "value": 83264996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697563, "uuid": "1eaf7234-cbaf-4911-8b71-23cddd718a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697563, "uuid": "6d794230-f3da-403a-a98c-4012d97eb747", "value": "Setup_Newest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f80b3b-7df9-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755716978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716978, "uuid": "032a2abb-8d16-427d-a121-3c15e8c5c07d", "comment": "Malware payload (AsyncRAT)", "value": "7a5449da6bd540691171a59a391f2630", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716978, "uuid": "de270b42-fab5-4006-adb6-b82caf469612", "comment": "Malware payload (AsyncRAT)", "value": "bc107361c64b3e72d3e33a6fd06901bbfba5b26271b9a222f83caa4f55d36440", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716978, "uuid": "bd10fb62-312a-486e-aa5c-c43498eb59b6", "comment": "Malware payload (AsyncRAT)", "value": "b5e05e33c2d23b42144770cf6757c61732dd1ba9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716978, "uuid": "66e360af-099a-4cc5-9ac9-6aabdd1364ef", "comment": "Malware payload (AsyncRAT)", "value": "424f08af6a64e8a4e0ba32676bbc8ef2376989b7fbc0b09e0cad671a0f71aaadbd5c1b6d12aef1d2429f51c1a66c50c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716978, "uuid": "6d63a35e-794e-496c-a309-7cbe3fcc4606", "value": "T1DAC64912F2818416E87815B004174AB075B4BE497F6CD9B67CCA772C2AF61ECB92F7E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716978, "uuid": "bb557262-49ca-4a65-8de7-7d2f44cac40a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716978, "uuid": "6b56af6f-27c4-48a3-8041-9c1d754233ed", "value": "98304:oTs0M4+8D3f37ST/JPa71uWTvLP9Pk6gAK6n4ldyNhe7ul5V9tRGaOB:oTkg37mPah7L1kehn4ie7w938", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716978, "uuid": "c11ad9cf-3672-4659-bf28-71eb583be23c", "value": 12500480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716978, "uuid": "2bb30401-e8df-4a48-9017-d1dc17b02b53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716978, "uuid": "c66806da-df79-4372-9add-4a4493a65d73", "value": "XWorm V6.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c40545f-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755693363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693363, "uuid": "e6c61c90-6ad4-4ba5-bcb7-0d3e37801566", "comment": "Malware payload", "value": "8bc4cf987fb37c3f46e38c23bcca3716", "object_relation": "md5", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693363, "uuid": "9d3bb4e2-8cbf-43c0-a6da-8b313cd8acd1", "comment": "Malware payload", "value": "bc2db918859eb52855cf825b90ed58fa8071d3cb61421900ea707fdc80d5d628", "object_relation": "sha256", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693363, "uuid": "a6918c59-afce-4abb-af64-cddd17b17f34", "comment": "Malware payload", "value": "b559e17b7df9de6d871ad6c2882c859ea57be476", "object_relation": "sha1", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693363, "uuid": "f70f1cb2-0c48-4c5e-99e4-cca9924ad51c", "comment": "Malware payload", "value": "3246e63125d584a78ed877f6eb20aaec4a0bc83bac32dad3123be3614ca60ae6c12aa0985dca5ba53475b4a547cd945b", "object_relation": "sha3-384", "Tag": [ { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693363, "uuid": "3391141b-43d2-4046-9ade-95caa42f0a4a", "value": "T1BDC3021ED90F28354896931C62AB5940F7358CDFC861DF5A797CA2038BFC6C26652F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693363, "uuid": "3db4fbdb-e3ce-4de4-9d5d-452bdfa4115f", "value": "3072:r478efBoo4A1gbRZmpEYs8xdHFH25ei+m5bxCKY4:68eanRAyY9dlHS964", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693363, "uuid": "501be9d7-e25f-44a7-9829-fea0bd042c64", "value": 121850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693363, "uuid": "4120ff48-41f8-463f-8702-4c40fa2b59e4", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693363, "uuid": "02ef59ed-9787-4181-896d-353028f5ac1f", "value": "MAEU109755452_Bill_of_Lading_2025-08-18.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb13176-7df7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755716100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716100, "uuid": "d936470c-353e-4c6e-931c-f31104f6412d", "comment": "Malware payload", "value": "458260b44f8190c16fbce00fcdeb9b9d", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716100, "uuid": "d3c9ddf8-08ae-46bc-ab93-ef716d1e81d6", "comment": "Malware payload", "value": "bcacb9b88e19596912b0d0af4d5f2e884910cd84fef6af7448d203c4981e2eb6", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716100, "uuid": "601de227-bec7-40ed-9790-67cd5096c0bc", "comment": "Malware payload", "value": "5aee6e602a715ef3df309d5e1a504e2816565013", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716100, "uuid": "b24dc881-2bf0-4fb2-bdcc-a69b63de23f7", "comment": "Malware payload", "value": "4b02b70e5a8b6cfb1ec4e62ba148def419ef985ec8f12d42984e44789de8053b545002a5ed97f3ef59449f4e0a14f58c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716100, "uuid": "a3f960f3-f964-4ee2-aea6-ad01a8dd0fd9", "value": "T121252238E78AF2E8C3EBD93C761D3D72938C249A34E2D44B4A5B8D16790BF29151325D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716100, "uuid": "49e7ceb4-1cdf-4027-a40d-914302f4a22c", "value": "24576:8cNasxRhO0PsUENKzPry9QWRzw7KFusPPiYFx5s2usb:8IaMR9Eu1WRzw2QsPPiYVs2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716100, "uuid": "76360b8e-4809-412f-b1ad-16134fd81a99", "value": 990656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716100, "uuid": "71479c75-0c44-4f1f-9b12-6c9fb4f3ebca", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716100, "uuid": "2a7f8ce0-c41e-4ea3-96c0-1ef8c5055287", "value": "2025-08-20-Task_List.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c33498d-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755695537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695537, "uuid": "970b431d-79a9-4749-9055-851dcb3bca72", "comment": "Malware payload (RemcosRAT)", "value": "5e5ec0b0ea46fb0876c5d19b85f16c9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695537, "uuid": "b8c60b27-5107-483b-af88-3096421e90dd", "comment": "Malware payload (RemcosRAT)", "value": "bd1c5601927d12de1111934a27ce3e4c669b35922cf72ce0ea4a76796d8b9b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695537, "uuid": "372706a7-e224-4346-96b2-8a1ea5234071", "comment": "Malware payload (RemcosRAT)", "value": "d8816f10ae06e4c5c087722d00cab070dfd93655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695537, "uuid": "13a3fe9d-b5eb-4e65-9340-30613f482b52", "comment": "Malware payload (RemcosRAT)", "value": "8e4e13edbc667527bbaaf1d11fb2898cc4b08f3d401c293eff9b74b83063770786e366cf38330055aaaad065dd99f519", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695537, "uuid": "40485588-7493-459f-b701-6e983eaa62fc", "value": "T1ABC5B05D94B05DC25024FE74AAC5F793CCEA17851A274B920FE5E2A67202C43FF6B362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695537, "uuid": "f9f49c37-ec2f-42f1-b5da-b103259e9790", "value": "24576:tUKBreanrnRemAa0NlQfYkUR/W+yqpk4Ty:uK0/ZYY/pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695537, "uuid": "17af3ae3-8840-4ec1-85fb-f1a467a80fda", "value": 2666556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695537, "uuid": "dcf6304c-3373-485c-b5e5-bf7fc71457aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695537, "uuid": "658d9e07-ffff-4f86-acf4-2cd26f655c75", "value": "0000000000000000000000000006.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85141bb0-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755697351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697351, "uuid": "a4e8950b-168e-4c67-b76e-30caa40cc826", "comment": "Malware payload (LummaStealer)", "value": "2672f886b9c5cf4bfb39df3915a346ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697351, "uuid": "04648dc1-ed33-4a9b-9792-e91d5d109640", "comment": "Malware payload (LummaStealer)", "value": "bd3cd8bf7dfdc80604a6f4dbbee83b31b82ae5082a8f45aa525732264280ea4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697351, "uuid": "03adb220-2572-4afa-a8ad-b77f8977c139", "comment": "Malware payload (LummaStealer)", "value": "4c188cfdec14047273503b4a08d9eaab5edf9a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697351, "uuid": "dfb82796-5ee3-48f4-ac7e-e10421fbe5ed", "comment": "Malware payload (LummaStealer)", "value": "8ea289737113d04ab619d86799bebe6049d280da2cdbf1d7baa9d61a778d75e261b81e0fe5527f4b15961836f3509fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697351, "uuid": "6f25de47-212c-44e5-9c93-57ea2441f5e8", "value": "T10A663326A7E55404F0F66771AEF2462097BBBECC1931CB5F2184709E0971E849E72B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697351, "uuid": "e8dc240f-6d1e-4cec-a302-49be869f2c5e", "value": "8edf48a510b9e14906303c564a1e9a7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697351, "uuid": "acb70ab8-f8d1-4ffe-9695-426d44d7d60b", "value": "196608:YGSSNno/kEB9lEKIPOfpBjpAVr1wYoao:An/ke+gLj+x83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697351, "uuid": "ef23b9d6-0dd0-4b8b-b5dd-3f98e353f883", "value": 7043072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697351, "uuid": "e2a21946-5979-4cab-9ee8-ccb55eecb3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697351, "uuid": "c68a3d14-e23a-4054-b711-f5159c45d752", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a969b6-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692763, "uuid": "475059e2-a5f4-4c6d-8982-626fb31bebde", "comment": "Malware payload (LummaStealer)", "value": "a7e62ba3653962e5571bed11db6ac4f8", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692763, "uuid": "ad869686-3774-41f9-b89b-c5e4a63a7489", "comment": "Malware payload (LummaStealer)", "value": "bd48a0e2b6038130537b279be3e89a7b7d41ee315a8b04c0d9af572d6c16a950", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692763, "uuid": "2cc9380b-6148-4f84-9dae-63b7fb07f944", "comment": "Malware payload (LummaStealer)", "value": "5bca595c754e909ed45f3bcf5b5be94f01aab7da", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692763, "uuid": "30261275-2e1d-4bc1-8a9d-30d3c1591876", "comment": "Malware payload (LummaStealer)", "value": "1c733ad331a152b6d5579f03effa5e944114e037e8af63ebf104a0d86c4c7bce754bb58044555a3f1aa0855414da4605", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692763, "uuid": "87ab2565-d57d-4f33-b423-f0c3c5eba240", "value": "T1A76512C29677CD5BC05C1A7818B6CA7423B5CE486EB2C712A3D4BC0BB656F56FC0538A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692763, "uuid": "656a825f-12db-4e7a-93d2-2222d0804f37", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692763, "uuid": "3adf9bb7-f7af-4c4e-8111-116bab460ee7", "value": "24576:6VD3eawauS+9aV3up8jRumsTZpZOr+QDemJCP1KPjGSUmVAdYiGj/wiBVXVw2twc:6Fe1foVeiWTZpZvQScCQPTAy7Lwe1V9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692763, "uuid": "b6319522-1a05-40e0-b8dc-2cb59aecbd56", "value": 1440934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692763, "uuid": "02c4a3b5-46db-4d70-8762-d001175c71d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692763, "uuid": "e56a1b32-bc52-4cbd-b3c0-38e86789807b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36693df6-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755648686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648686, "uuid": "0c397863-6517-4b3a-b13f-e096601eca14", "comment": "Malware payload (LummaStealer)", "value": "f1fddf1be9a608c6c96d8e7187451c79", "object_relation": "md5", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648686, "uuid": "a42675d7-1a67-441c-a58a-6bdaf6f0175d", "comment": "Malware payload (LummaStealer)", "value": "bd64d89733bfb05e2b01cfd550cb27911d5505b823ee22ddefb35c04adf28db2", "object_relation": "sha256", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648686, "uuid": "95c5cd52-f094-472c-8264-5159dc3c12c5", "comment": "Malware payload (LummaStealer)", "value": "bafe4e8c69cabeed80c3ff77466ec0da56a9a5b0", "object_relation": "sha1", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648686, "uuid": "3decb073-f041-4720-a3f8-29a17435e9f1", "comment": "Malware payload (LummaStealer)", "value": "7727dae958e85c752177628b3a39bdb2cd86c5f4bc03ae4e9c220a3194090622f1bff47386b17d161c273a6925e130ba", "object_relation": "sha3-384", "Tag": [ { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648686, "uuid": "1f2e3d3a-1ee1-42e0-87b2-1212128afc30", "value": "T1F4742988D617A475FA8718F89299E3FB5B391A27C32CCDC7C7A4EF505953BE2107018A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648686, "uuid": "cb20ae7e-de69-41bb-8a07-22996992bad7", "value": "8201be06c2aaca822e0e9d80bca67582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648686, "uuid": "ec839f28-6d6c-4211-9556-6b0cc4720eaf", "value": "6144:9Fyv22F/BajpEHyk9nZNGmvS3KSf7w9WXlkwxn:rQzFp3Sk9ZskS3KSMWXlk8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648686, "uuid": "25c07203-7763-4d00-bee9-edac3e183392", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648686, "uuid": "dbcfece3-b653-4904-982b-582b5fde6612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648686, "uuid": "0412105f-920e-42be-81c7-45011a5014cd", "value": "bd64d89733bfb05e2b01cfd550cb27911d5505b823ee22ddefb35c04adf28db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6117bd9-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667422, "uuid": "46eab3c7-024b-4410-9c61-831e47091fce", "comment": "Malware payload (Mirai)", "value": "047e8a4336307b5b1f69d9a2b871f992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667422, "uuid": "ee9dad66-fadf-4929-ab8b-b558236c8f31", "comment": "Malware payload (Mirai)", "value": "be445d05566e9958abe617a77e8b138586c4f228cf35abcd0b3e0b497c24d1d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667422, "uuid": "05e05484-4827-4b32-a90e-71f4b5cf2dab", "comment": "Malware payload (Mirai)", "value": "61cc07f85db8599e5cca7f4bf8ccf6cbb9821285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667422, "uuid": "407fc99d-cb32-4854-b736-b97fe64ce5e0", "comment": "Malware payload (Mirai)", "value": "437c281a5b6c91831d5c6b627b506646e7260943edf7845288524afeecdd89c8f51aa9fcf943ed981eb958d080cb4370", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667422, "uuid": "14c46fef-53e4-4b6c-8409-83b45799c138", "value": "T15054AD57EB068C6AC1A606F54ECB075D5733C0004F1BDBDB7A2C26386E576DE9C5AB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667422, "uuid": "e94d2c7a-aebf-42f3-9b52-48ca89571d64", "value": "6144:VusT8FOCAPv26wh+HZlCHo+6fi4qW1uV3fqzuLupmdQC:Vu8CAn+wiwi4PijCpmdQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667422, "uuid": "091df824-dcb6-4221-8f14-c0f381c1fb67", "value": 290532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667422, "uuid": "7aa4c0c3-ce04-489b-af31-1f384c789fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667422, "uuid": "4a3d198c-02da-468d-bd3b-d042960e3147", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c495345-7de1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706624, "uuid": "ff426206-dbc9-4d28-9a48-f3e3b09ebc5e", "comment": "Malware payload", "value": "18e1f174924ac76b5649c293f21bf0a9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706624, "uuid": "e4079457-300a-4237-9739-65fa9e0c4de1", "comment": "Malware payload", "value": "be9abf12327ed612122c821d4a25fb300f8aa0c262dbcf8d1d764ed246f1bf07", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706624, "uuid": "f6be6678-650a-4268-8553-17641a92d542", "comment": "Malware payload", "value": "e3be6a1a0432602e42611e2434c4c292b605379b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706624, "uuid": "f6eab0e1-c1c9-46a6-b3de-2dbd659e5e4c", "comment": "Malware payload", "value": "b8472067e78828784fb508d5d7288d82d1cce8141bfc33a1dd3c5e32574eac361046170191200d94409978c22e5178b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706624, "uuid": "9cd854e2-3425-4c35-9344-5b7b2c1dd37d", "value": "T138541A2299709075EBD621F997E76BDD91B08B22431543CF57E03CC92E52BD3F63828A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706624, "uuid": "aeac7e29-916b-429c-a6bc-7b4be3e2a324", "value": "4b32cb13a1d12d18a9a2c05e9e82a47d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706624, "uuid": "030cfedf-97fa-47c4-b3a7-b99738c810e7", "value": "6144:ajnf7QTmNJT4GkLLoYS+CGSx3vZukYJxoB6172jV/Eio0lLfWWeathA/E+VODp5v:ajnf7QTmNJT4GkLLoYS+CGSx3vZukYJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706624, "uuid": "f438dd5b-315d-4edc-a008-07208f7a5644", "value": 297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706624, "uuid": "56e22f42-d88a-4971-a679-3d80f61efb78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706624, "uuid": "b783ccc3-77a5-4b23-b7a5-d0bf8e7a8588", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bb3bf4-7d98-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1755675320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675320, "uuid": "8efdcc14-5ac0-444f-977e-4e5c3feb0de3", "comment": "Malware payload (SalatStealer)", "value": "0560b350492240b8ca7def34dc4b7562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675320, "uuid": "00c1fbb2-dc72-4e33-9166-5cb9abe08444", "comment": "Malware payload (SalatStealer)", "value": "bfcdae4588c1b626da361fde10af24a3c0d2c7c22c848beebcf8a5d31d8e93b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675320, "uuid": "cfb5927e-8881-4acc-bf24-1cf3471f9ae9", "comment": "Malware payload (SalatStealer)", "value": "4085e7d9583ce76c86f9a138bd92357164076cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675320, "uuid": "b6ef7f84-0807-4e24-b532-3e717fab21b8", "comment": "Malware payload (SalatStealer)", "value": "e701b689dc16b456be0411a8302c5029ce01f8c8c40219843b6b65ab84fb4711ebf68ebfe2dfe5f08c6e72e1a1e0f8e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675320, "uuid": "28734837-42e0-4bea-b62d-3157056f295d", "value": "T127E533569B841D41EC7C53B78148411F96A2438AE6D02DDBFFBB502E8E7386663B1C73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675320, "uuid": "95984dd8-8a9c-43bd-b7c4-1c8bfaa7c02f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675320, "uuid": "e9b9a8a3-4815-497c-b16b-dbcf4309826c", "value": "98304:keMud4J2aL2Brnkn+GxF/Ixk7fSkc5GuGPeysY:keMuy1Lkzkn5AxyfSkgZGP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675320, "uuid": "e486a6de-231a-458f-b9ae-be45eeaaab88", "value": 3287040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675320, "uuid": "77507b2a-d085-4203-b478-dd3cc16f5806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675320, "uuid": "809273ee-5f49-4f1f-a667-cf78eb450412", "value": "Xeno1240Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18fcfd3-7dd4-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755701264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701264, "uuid": "2f5c0836-0e35-4485-8fb4-684a4d9b86dc", "comment": "Malware payload (LummaStealer)", "value": "1fd70a931d005b7b32c1df6107056762", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701264, "uuid": "8a5764d2-5218-4e94-8789-908501a50397", "comment": "Malware payload (LummaStealer)", "value": "bfd62493f02254967099a6e6ab922c0fbf00363659a030dc303cede7d2709295", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701264, "uuid": "80e188fd-27c6-4b14-8b08-26740aea9134", "comment": "Malware payload (LummaStealer)", "value": "d0c1ebe432ef412dd63f69c9adf27df827b31bac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701264, "uuid": "8bdd84df-724c-4685-aeef-d77828f75e94", "comment": "Malware payload (LummaStealer)", "value": "74fd2865bbb724770eb2e58bfd62ed1e5d3619d4390b8b84998138df74936bb2286364e5d9c8043c2ac4ce02a99707fa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701264, "uuid": "2d7c74e3-749a-46a8-b7b2-19b955785f60", "value": "T1E215C126A5F0C433D2B62B7C9D1B56A9DC2A7E303D34ED4B2BE40C8D5F392527825297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701264, "uuid": "7bef9443-e0c5-4cca-af55-0d8d53e87bcf", "value": "dc6d8b5646aa412f75a87b06fd63080b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701264, "uuid": "a2053644-9d19-4912-af5e-98c9d5cf3193", "value": "24576:qfqIgqXr3y0b8ibgTas2j215cBzgpyyJH:qrgsrC0b7s28mBkpyyJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701264, "uuid": "050ee0dd-629c-4739-8115-e7b41f698066", "value": 942368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701264, "uuid": "4549c33d-46ab-4a64-b9a8-ed2c427a4281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701264, "uuid": "1cbe9403-e36d-438b-9368-a2981b18143b", "value": "1lapisthird[1].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2874c8db-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677868, "uuid": "86e3e761-7786-439e-b16f-0b01325cb13c", "comment": "Malware payload (Mirai)", "value": "4ea27b269d04e1a4981caa7aacd9de6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677868, "uuid": "b680e878-e653-4d8d-b341-a076f4a5fedc", "comment": "Malware payload (Mirai)", "value": "bfe33de20a53eca2ca39483ee7203fead12339c8ff9529cb3d2f740c7543f5b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677868, "uuid": "3fddb58d-9579-4ef4-9523-dbcb181c0370", "comment": "Malware payload (Mirai)", "value": "71fef2807efde49d3de01db97a24f5120eea5d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677868, "uuid": "172384ab-4bac-4106-ac0b-6b7af595b843", "comment": "Malware payload (Mirai)", "value": "274ec11fdd8410209ae266dd1fc71621b693d88e6d0ad3dd753efd246bc95b8f8751896100533ff52956c46179cbcf6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677868, "uuid": "620f8d42-50d7-49ac-9db9-2417cc058636", "value": "T12D932996F9814F12C5D013BEFA2E018E33131778E2DEB2239D146F24778A96B0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677868, "uuid": "f74ae2a1-3b0a-4d03-8130-8ee7fb1e80cc", "value": "1536:7XnjEcMKRXwcD2uvtTkzu/M69YLnK5PG7x5PAKdGTTarIWGEdMWijcIX6CKQ5IYJ:fxwE4zuxKLCPG9uKdGTTaacU6CKQmryV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677868, "uuid": "6ed96e2c-6c3e-4e96-a3d2-f7bffd28ce34", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677868, "uuid": "60800eb0-c2b4-4e25-9450-52f313191005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677868, "uuid": "01005ac5-c44a-4cb0-927e-ecd5ddbb7e88", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fb2a9b-7d7f-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755664816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664816, "uuid": "07f8ecc1-87f1-4def-b090-eb93f37e33f1", "comment": "Malware payload (QuasarRAT)", "value": "c6d011cd9a7bc7275d92597d92e57294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664816, "uuid": "fc774cb8-da6f-4d34-8ac1-1e6fbeda68df", "comment": "Malware payload (QuasarRAT)", "value": "bfeebb9bc0a5d9543ed907a650defe0ffe6d2b7e8db4a6fd710d16eadcbab276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664816, "uuid": "a0203035-dfeb-40bf-a2bb-f8e0084c5a11", "comment": "Malware payload (QuasarRAT)", "value": "547df8b76708909010a97319871437fa754cdd32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755664816, "uuid": "6d8ee2e3-7c70-48cc-b1cb-e20d64369137", "comment": "Malware payload (QuasarRAT)", "value": "dcda6fceb976d1aa47a29171776d5409ae5859d5e7b0cdf2d16c72487fea0f3bbdd01d61d8e8ebd116fa13880b361de6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664816, "uuid": "55a29037-ea13-4b64-93c4-e598ab038322", "value": "T14DE54A1437F85E23E1BBE273D5B0041267F1EC2AB3A3FB5B6181677A1C53B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664816, "uuid": "f2181562-c8fa-48fc-8fb5-223696aefd46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664816, "uuid": "7a1d00b3-3f66-48fa-86dc-499c53b07671", "value": "49152:HvSI22SsaNYfdPBldt698dBcjHEEak1JnOoGdiEXTHHB72eh2NT:Hv/22SsaNYfdPBldt6+dBcjHEEaFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755664816, "uuid": "427e00e5-c38e-4d83-9a47-79f2cab89a8c", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755664816, "uuid": "3faa141b-7386-4fed-8c64-bb90db4f2ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755664816, "uuid": "423781fc-a775-488c-ab82-d34e455a2805", "value": "client-nigger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5440fdb9-7d6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755656896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656896, "uuid": "ffa4c36b-59ef-4557-8fca-98e211bc20e2", "comment": "Malware payload (Mirai)", "value": "7aa13c9d4369ffdc21ddfc8e83d04d08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656896, "uuid": "a04eec92-478b-4579-977c-7eeb60d99ec1", "comment": "Malware payload (Mirai)", "value": "c10096f6de0274bc035ce081329eff8dfb298e483adc8432041b744ce58acefc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656896, "uuid": "63402aaa-5836-409c-a47d-ab5e1c1e3e36", "comment": "Malware payload (Mirai)", "value": "99d4a85f00b40e7ebc32a583d05f03d5dc2ab4f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656896, "uuid": "0618e3f3-f020-44cf-bd55-baca7bfa26d7", "comment": "Malware payload (Mirai)", "value": "4171da5f581997b39ae07643e22f5d44856a138596a448d064be27c99646436d70f8f69ec4752abc16edf42e3324571b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656896, "uuid": "2e83a433-cdd7-4ca0-9f57-d8b79dbbf2f6", "value": "T125D2E064BB4EC4DEE98AC4B581F40BC035F48FA1925BE645640EFF62DA860E93C42DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656896, "uuid": "6843a30a-c43b-4754-b835-783b794fd323", "value": "768:RRcPaa7QOoGU5wvblXetzoNE42mdZDwjA1JgGlzDpbuR1JM:QPaJOojGlXetgaQ8jAvVJuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656896, "uuid": "df23cc5c-8df1-43a7-a5bc-3bd0f1684b5f", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656896, "uuid": "cfee793e-f108-4503-bc76-8a0dde7cf866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656896, "uuid": "30b87abe-5f33-4d16-9a4e-d1b5875ff022", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af85266-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701870, "uuid": "35d04e98-7498-460f-baeb-291dbf0c9e8c", "comment": "Malware payload (Mirai)", "value": "96045ed6e6cda5445c938e1605d9004e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701870, "uuid": "d38f60ce-f8d2-4e7a-814f-5f506747cda1", "comment": "Malware payload (Mirai)", "value": "c16cd4d6bc93ef095af954652c9c97c38c20cba22533d917461affb2c0733acc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701870, "uuid": "fa50ac93-61d5-4841-9ffb-8048debf3f7a", "comment": "Malware payload (Mirai)", "value": "566b40784733ac81e6dc26173b424962525643f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701870, "uuid": "98434ddf-bcff-47cd-b7c6-036404cf4b74", "comment": "Malware payload (Mirai)", "value": "dcf13349953bb591cfc0a930a5df661d699284a60dfd6917ea91a436cc07671a7defc4b05b19393546fdbb549e9d45f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701870, "uuid": "020ebc70-ff3a-4caf-bbbe-3b6a718a3d90", "value": "T11D630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701870, "uuid": "1ea431f7-2f2f-410e-818c-79bc428d98d4", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701870, "uuid": "38ff0837-99cf-4b4c-abc2-cff77357aa97", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701870, "uuid": "96f2e77d-a054-4654-acff-5690f364162c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701870, "uuid": "a484b2f2-9e95-47c1-bbfd-509fac3008e0", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19ec31b-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755697533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697533, "uuid": "d78f7ecd-db8f-44f9-84d9-bea1b16ac2c7", "comment": "Malware payload (Amadey)", "value": "6f4151c124693d9dfd2092b7e01df0d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697533, "uuid": "e01ef763-38e6-4fa3-bbb4-635de254e3c6", "comment": "Malware payload (Amadey)", "value": "c1fcdbc77e5ab2ebfbf3bd0adc2d81bd64ed2dfdacccfea9783003cf950ac36b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697533, "uuid": "985e046e-02dc-483f-b232-43c50a115bd0", "comment": "Malware payload (Amadey)", "value": "11aad99764d62584e8252f0e2d05571be55f0a70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697533, "uuid": "30f4fc71-3fbe-4e5a-8f8d-38171aede0a0", "comment": "Malware payload (Amadey)", "value": "61622569c1618b37da5ab7a5bccaf1f8443e2ed4b10bb18b48a697781b19600c72447c5abd86cf7ed1e4b2a8af760655", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697533, "uuid": "a21f0021-5169-4947-a257-cffc7c68bf15", "value": "T1B6552323F54E74B0E144BB3EC5EB61181361CBC673E3F95AB58B13AE45A3BD9490284B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697533, "uuid": "babd4063-40d5-45f7-9eb3-67c464455b59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697533, "uuid": "ff27a8e8-f8c7-4002-be1e-e44f005930aa", "value": "24576:XB4V0DtDw8tCSAFc+sEmtFMB89wizc3gi4E5r1j7SJP6G:XaiB3CfFcmfewEcvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697533, "uuid": "76f05522-0fbe-4c25-9b67-1f551df4c78a", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697533, "uuid": "5e0ac5d1-4f26-4647-86ba-9dbfeeb2dae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697533, "uuid": "ac529887-f71c-4414-9cd7-a34a3c990cae", "value": "c1fcdbc77e5ab2ebfbf3bd0adc2d81bd64ed2dfdacccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be436d2-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755677981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677981, "uuid": "964e69cc-916e-4501-b3b3-6fb685debe79", "comment": "Malware payload (AsyncRAT)", "value": "5c156786248fac767d55bb214825ad40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677981, "uuid": "0ad23a41-e7a5-4fbb-a9b8-9478cff677c7", "comment": "Malware payload (AsyncRAT)", "value": "c2350ab8d52fe63260cd53265702a252c0022f6084445d5987b90348f0e1cc08", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677981, "uuid": "a78c481b-4a83-4524-8f98-ea9a7fb3921c", "comment": "Malware payload (AsyncRAT)", "value": "5e8d7efc0b12c949534e6f4fd6aaa22e9a8d310b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677981, "uuid": "5def437d-5d83-4bbe-91b7-8e98b2936eb7", "comment": "Malware payload (AsyncRAT)", "value": "893ebcd6c09823ca6ad88ef8fafa80362a942ab6d4a17f0d033a527d89462f31120c547e770b639ba6ec8dee45059484", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677981, "uuid": "a3cdd667-ac8b-4601-9bbc-819d663bf6c1", "value": "T1F5842325D4F17AB4CC9EB09571F933B3BCD69BD4C6EA0E90BA7944E40190081B737B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677981, "uuid": "3e30b386-616c-4dd7-9f52-e9738698d7c3", "value": "6144:JvTZR1AHrThCVAbXAJ9IN3ipR2u2BUyYmtHsfB3PRXmuRpM8:pZi09INSP2uoUydmB/Fm6pD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677981, "uuid": "ab6e2426-6b5e-43b6-b0dc-88c8280fa3b6", "value": 372600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677981, "uuid": "66b54a19-14d9-47ae-a081-416b0090842a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677981, "uuid": "394ef3a9-bcd2-4d6e-88d9-1e3764134591", "value": "Img_Abella_Danger_OnlFans_1193.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e93dc3-7dce-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698668, "uuid": "a794c6ff-a8f7-41bb-ab5d-619dcd079e70", "comment": "Malware payload", "value": "646abc719d31b3a92562ba5bb73a200e", "object_relation": "md5", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698668, "uuid": "f16d8af0-ea60-4939-b5a1-ae308312b52d", "comment": "Malware payload", "value": "c24937a44084225df5fd8b2e06a2c335ef0beac5b829f22fb3d98383957bffdf", "object_relation": "sha256", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698668, "uuid": "7592dca2-ad43-4694-bfc2-22fcc588c098", "comment": "Malware payload", "value": "76c95e176a4987de45aa54f37d115466442a34f8", "object_relation": "sha1", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698668, "uuid": "05f91ddf-881f-455f-a829-02b6ca95bbf1", "comment": "Malware payload", "value": "d50d967f9b90bbd18a491fe0b53d39696e9df0dd9530c6c223dd4ac569248d91af6bd65b1e431a3fc1c3eaf88e75e52b", "object_relation": "sha3-384", "Tag": [ { "name": "103-237-92-191", "colour": "#2448EE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698668, "uuid": "1b0ad6b8-3cab-4109-90ff-3bf9d1c54693", "value": "T17AB50B6A9F80E0CDF9D0BEB66C616521736708A9D4CC891FDCA92FE1052FF41E0675B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698668, "uuid": "c247322a-3818-4507-b6cb-3551c78e3076", "value": "6a5e409e89a5678680535aa9cccfff00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698668, "uuid": "72004e16-d124-44f1-a109-eb88829432e1", "value": "12288:+kOSaF7QGj1L/MAVBaHFITxPMstLyRgTZh7QGj1L/MAVBaHFITxPMstLyRgTZcTH:sl/ECxPMsUM/ECxPMsU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698668, "uuid": "ee6ee2b8-82ed-4455-a94e-c965b35643d6", "value": 2320896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698668, "uuid": "e924078e-7b14-4a31-93d1-2fc5b907734b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698668, "uuid": "06bb63c1-027e-474a-b8b3-f1e7f323d328", "value": "c24937a44084225df5fd8b2e06a2c335ef0beac5b829f22fb3d98383957bffdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b200d9c5-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755677669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677669, "uuid": "1e1a85a7-19d2-4128-a83d-611419c08f3d", "comment": "Malware payload (Rhadamanthys)", "value": "4daf0e47f2e3b51f98e0965428a824c8", "object_relation": "md5", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677669, "uuid": "3ea053df-741b-4311-bcdf-aa62f0986089", "comment": "Malware payload (Rhadamanthys)", "value": "c2aab7f25230b2cac2abeedac1309f1be0701cb6593684886bd0a73182480de1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677669, "uuid": "4713471a-2d13-4bd5-8763-d4cb6b467f5c", "comment": "Malware payload (Rhadamanthys)", "value": "c38f2bc3c0d28dd51f2b79080e12f842fdbbf572", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677669, "uuid": "2adbcf0b-ce9e-42d4-b2eb-493796c21d3a", "comment": "Malware payload (Rhadamanthys)", "value": "764ea4d9f18833934338dbe60564f4dd9babf777e19d404b1813ff83d5fc593bb5aa1904d6e62f0275202df34f762bbb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677669, "uuid": "20985c77-9bc6-4259-8817-34c5a383b384", "value": "T12EB63308FC808E39E35BE731DA3B5970114ECC147B95A79BB98DFA75E978B3011D8622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677669, "uuid": "7e535a6b-3091-431f-bc6a-9947b4f5627d", "value": "196608:z22ik1oMYsafElkBxvxLDmLhaQMSwHZpLL5DLhaUn4usDc7Ni5moVvcMt:z2291Xa8lkxuLhX8ZVLfn4boJcEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677669, "uuid": "f363ccc4-4135-478f-95bf-c2a5416c7ca0", "value": 10936320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677669, "uuid": "f9f20901-77ae-44cf-814b-4f2dd1c9064e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677669, "uuid": "0035d562-d9a1-4be1-be5c-c6202697e8b3", "value": "c2aab7f25230b2cac2abeedac1309f1be0701cb6593684886bd0a73182480de1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4bf807-7dc4-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755694301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694301, "uuid": "5f1c1774-136c-41c4-a6ff-fbf7ec70f801", "comment": "Malware payload (RemcosRAT)", "value": "c49b3f15c17d8d167d81aa54516a4a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694301, "uuid": "6a90a8d9-1443-44c4-8aa6-56d156a12946", "comment": "Malware payload (RemcosRAT)", "value": "c2b63dcdd1c5c063704cd931d264c898e111e8c3e2921496ba27364d0629c280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694301, "uuid": "f515678e-27f3-452f-9abf-da82b7a78cb5", "comment": "Malware payload (RemcosRAT)", "value": "bd7c9de5cc0f20670e400e9b8b4e1c3b85f5cd4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694301, "uuid": "4de10a64-bade-405b-9b24-6e91bb09ae9d", "comment": "Malware payload (RemcosRAT)", "value": "55d19b637df50659f5d67c4fbce7fd905afdd0fc97d1d99d093bd198597820b8879af8f9366c30d2858095579c20a477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694301, "uuid": "45f06fbb-23cc-4d5b-bb38-f070bc6a0d32", "value": "T100C5B05D94B05C926024FE74AAC5F7978CE907851A1B4B920FE5E2A63205C43FFBB372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694301, "uuid": "b4894f9d-2325-4149-a0e5-4b0ce2ba86ea", "value": "24576:olTWMb/nOLHh9taWwfK0VWhENMCP4m3nh7OkOPPK59yjJ0lS:oALssK5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694301, "uuid": "a0d3f2d8-6a9b-498c-b202-7586da795ad4", "value": 2666556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694301, "uuid": "3a2db873-93b9-4bdb-bcd5-6481e8421a99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694301, "uuid": "4ab41002-d286-4f11-a331-56316e96d30a", "value": "magichappeningforbestpersoninlifecareforyoutoo.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a05ee33-7dfa-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755717465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717465, "uuid": "b7cdf62f-09da-4843-add8-92614f181a5a", "comment": "Malware payload (GCleaner)", "value": "16e22570a231f96b5c080c4af9fcc198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717465, "uuid": "4515c35d-1f85-483a-b2c5-d22051f5af42", "comment": "Malware payload (GCleaner)", "value": "c3079b1f05b25daaf2add658fdb3f6fddf0c24828142e2234fa8d51b8c8b286f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717465, "uuid": "eda49b11-6139-47c6-bc54-3c8ec35ebd3d", "comment": "Malware payload (GCleaner)", "value": "b19276aaee66b8807a604feee0844453db97f716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717465, "uuid": "5f55ff61-91a6-46b0-b5f2-10c09d825de1", "comment": "Malware payload (GCleaner)", "value": "63e0c44a44ac09489569506ddc99da6d8ac434dc96ecd6c1f6e61f59ee10ac0a4b1f0254e6128eeb06339d25f96d3312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717465, "uuid": "91b9da0e-0714-40f0-8aa5-96b3e2110526", "value": "T12C06E031715E08B6D0E00978EA26D10B57D46A471C36B0FEDED09FAF1EFD7422AAE245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717465, "uuid": "bb73da89-36b5-4bc8-8d75-0c39d29538e1", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717465, "uuid": "9d514d7b-3cd2-4368-a2e2-179a9a134e9c", "value": "49152:AME5gIkYzEWHzVrlmjflmWF4cJf7YQ8SGVMOyT8i6DAWwvE6Xq0p0g6AlWObT6Tz:AMU5EIQEp0uFOdLtkVpkN6uM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717465, "uuid": "ea5b177e-d678-48b7-8dee-c4815c5a6553", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717465, "uuid": "e002c965-8975-41f3-8a66-73d203dfabbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717465, "uuid": "ee27e52a-ac2a-43f8-8eb9-0a5dbd606a7a", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.3811.23256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea241a2-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1755671436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671436, "uuid": "9a66ebd1-6a8f-431d-a735-c5ad4eafc15f", "comment": "Malware payload (SnakeKeylogger)", "value": "57b17ffa7e3441dddb6db84baf4929e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671436, "uuid": "480ab9c4-8c45-48e5-9577-e23659429b53", "comment": "Malware payload (SnakeKeylogger)", "value": "c43e60dd4fe89c7a4927b13c24972ff021986196b1fafa40e9cdc5ce81b0db5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671436, "uuid": "1a0411ba-6385-4b6c-81bd-10a0d82b91ea", "comment": "Malware payload (SnakeKeylogger)", "value": "1cf4c2b496cbc7dfe349a12bb5e2117b3ac77869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671436, "uuid": "efba2a0e-4d82-4233-9c91-0f7770cb307b", "comment": "Malware payload (SnakeKeylogger)", "value": "eb9636d08b97ccf0a7ea86812f82f1dc242373a9d09b904b3077f8ff76eed78d3a8235e06a16db8e431730fd7e0b269c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671436, "uuid": "c69440ac-4fe9-49b0-a45f-8200f6d8006b", "value": "T156F402966795EA0BD2BA27BC2C70C77443F97E9A7812D3058ED57CDB3C66B005900787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671436, "uuid": "7ee46948-98d3-4ce6-af12-ffe78d6d107c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671436, "uuid": "05c9a799-c3a5-43c9-9e96-af7aa82349f4", "value": "12288:Kv+Xu2ra3emPXNhhbXcvtXXfbe5UXKGWFK/TqXWiPU0CKkQNchan2I:g2TS9hRXcNfbYU6G+KuPU0fbN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671436, "uuid": "97bd3ab5-6e8a-4bd3-9c51-599def684b5a", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671436, "uuid": "ee5b659f-2fae-4e37-87e9-9dbc13bad8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671436, "uuid": "0e9f79ab-a7e8-440b-8a4c-a80aec700bd3", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.15274.31589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d297b2d6-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679442, "uuid": "09cbec4d-46f2-442d-a219-90d592141fe5", "comment": "Malware payload (DonutLoader)", "value": "d2356af4940b2b9902cd08fa3bb3c696", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "garmenae-pics", "colour": "#20DF6F", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679442, "uuid": "bb2bb365-d41a-46c4-a39e-bfcac8ea1c8c", "comment": "Malware payload (DonutLoader)", "value": "c4a96c1493ae6161fc05536b2aac8934a5da47e72f12ee9f6f250af839d3b6b2", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "garmenae-pics", "colour": "#20DF6F", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679442, "uuid": "0092422a-6912-46ff-a4ac-cb71b75e8bdd", "comment": "Malware payload (DonutLoader)", "value": "c9b5b5c0cf3ffe6a0ff67d81e57903919fe8a6b4", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "garmenae-pics", "colour": "#20DF6F", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679442, "uuid": "35d43d1f-8eb2-4566-84b9-5ebb17d2be10", "comment": "Malware payload (DonutLoader)", "value": "98caf6c22a4fc569f108be6320bb90d476005c1d077c103fb0517d8bf5fb1588e07b4f03e97606abf8ae68766563705c", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "garmenae-pics", "colour": "#20DF6F", "exportable": true, "hide_tag": false }, { "name": "iam-institute", "colour": "#9E376E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "uio-cam", "colour": "#90F308", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679442, "uuid": "5db8fb36-0844-47fe-a120-09b231d1c79d", "value": "T1ECB53375DF7E2DAF067C817921AF1F092B911F52806CE8EE51C2728B159F781871BC26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679442, "uuid": "eba7959e-ded6-4fcf-9aec-363c3ec3f321", "value": "24576:AbDvnaJrlpHYYXtGvV9zNfE1FlKbPK4+5LWkF6ViifVCzBp+AmHPbM9XcnNqjN6i:iOAYQ+ZAS736AmVP6XLNbGNN/n6kLmb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679442, "uuid": "d36680b7-e2b7-4388-a339-6a80194490e5", "value": 2301741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679442, "uuid": "3c164eac-872d-43d7-a2ff-33f56e90ef11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679442, "uuid": "736fac67-0f00-4e52-b578-74c42c268e57", "value": "test.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064e43c3-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700574, "uuid": "baf7e515-5d3e-43d9-b094-d88257b94e74", "comment": "Malware payload", "value": "988aae9e0e387bc404e8ed267331b66b", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700574, "uuid": "ef99f406-2bac-4742-b1ff-c7297a5a7ae5", "comment": "Malware payload", "value": "c66e8c9406251a55c5aaed06e851588e93733ecd987ce37c2941e12f541062b2", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700574, "uuid": "1e39a184-521c-4a3d-a3ad-9ec8f13817a5", "comment": "Malware payload", "value": "0ac1eb7ca804f34ff0bc0a582e96a597d723fe7d", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700574, "uuid": "842a79c3-e192-4aa8-82c3-aaefd85cc3d3", "comment": "Malware payload", "value": "4af3ed097c814a5353b82fbad2dfaa7ea3cc925564ed7576c05e5d101ebc9ef408a6f3dcef2d9676c30035d28a1abd71", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700574, "uuid": "c932b4b0-7639-4144-891c-391e8379801d", "value": "T176F58D06FBC681A1DC9A4039D1A7DB3E4D394F14972287D38B917CA99932EC0DE3E359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700574, "uuid": "7ae0e804-f9c9-4737-9164-e4e2a0162696", "value": "52155a1b9bc5ed733f4ba55d39c1629f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700574, "uuid": "8fcc7b41-75b6-4b3f-9c56-2aade4bcec1e", "value": "49152:9iLryS4Dpgfb0rmJRFEptDWTpY1AwPoe/PzQnFsnFxnFSCF6VKBHanRJJJ:ILreELEHciCe/En2n3njK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700574, "uuid": "ae6d7d63-a9ce-4f6f-8bc3-f9eb3110073b", "value": 3325200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700574, "uuid": "ad6980d2-9e5e-4e59-b2fe-0cbec9061f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700574, "uuid": "b36c88dc-b857-44a0-9efc-848f9e135e66", "value": "c66e8c9406251a55c5aaed06e851588e93733ecd987ce37c2941e12f541062b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd46ecc-7e04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721711, "uuid": "eb534b30-a49c-4f27-8dcb-926a4fe73e39", "comment": "Malware payload (Mirai)", "value": "e3c033417e5ad197c64181662d20a961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721711, "uuid": "c3ce981f-bc67-418c-a77a-d06fde229cae", "comment": "Malware payload (Mirai)", "value": "c76d0162f033c50e925b247b10e8a7d167bfbdf9372471d67d70ebb3a3b658e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721711, "uuid": "6d985042-1de4-4d28-a0a0-36376107559d", "comment": "Malware payload (Mirai)", "value": "efff48f2cd9f5d7520e48bd3f4d90a34a2ba585c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721711, "uuid": "c5c0dd5b-e33d-40a4-a3f9-bc346cd54822", "comment": "Malware payload (Mirai)", "value": "1e4a3f6efdb1485174e90c228baf31c35685301feeee0509e2c63871db1ebf8a570b887144b3c3b93643139ea4af36e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721711, "uuid": "042c07d6-0335-4b94-a748-fac94d1d2cca", "value": "T1F323E8C57882B639C3D057BBEE5F014E330497DCD1EA3357C8281B94BA8A94F1D66B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721711, "uuid": "938c4eab-c71e-4fda-a3a5-67603318e045", "value": "768:oMjcmSayWpShJu7RvFZS1uM1LnjvGDoCerCGyR0rCf6UkeSU7wCVy/rCxHghW1/G:MmyyShJ3FjvuR0rCS9nvhW75EtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721711, "uuid": "a47e1b40-74e0-47ae-be72-eefdd7adb981", "value": 49496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721711, "uuid": "0404d3c6-b199-4125-93f0-e254c0dfa111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721711, "uuid": "a082eca0-0187-460e-b392-091d80b8137a", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cdba515-7d7c-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755663407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663407, "uuid": "228c4783-3e49-4a43-a2f0-d9cc197739dc", "comment": "Malware payload (CoinMiner)", "value": "1cf4cd1d1ceb4e02dbdd7dd66a5aa66e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663407, "uuid": "9a0264a6-eccb-429b-b4c5-0777fbe97746", "comment": "Malware payload (CoinMiner)", "value": "c8014fea814262c61c09277973371fea3347bd9190966ea1c262db4ad1bf873b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663407, "uuid": "b9299e69-15db-4402-8ecf-f8aa92ded365", "comment": "Malware payload (CoinMiner)", "value": "88d5da256511c67249a1d4a796db93d40132f124", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755663407, "uuid": "fc7a289e-6a4e-422c-832e-9f88be811c17", "comment": "Malware payload (CoinMiner)", "value": "98d4b78eaf22e790fde72a3b9eadd4092ec8cffd0591138a7c92cb3b045297d7e1331c0aba26439cc399fa3e4b832bf3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663407, "uuid": "b1605f02-71e0-4fe4-af0f-a58eb18098b4", "value": "T1F06623F68C57A846C9AD0A35246BEFB44525D23AFC943EE2B2F178391434ED4F913AC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663407, "uuid": "6dbcbccd-ca14-4ca2-8f43-860184722fe9", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663407, "uuid": "b3b265ba-e291-4b9e-a006-33a7701b4314", "value": "196608:RGjbyruvL3cytmZHjX05CsEm5m26Hqc/4RzQnPpEmOOJE9oyRC2:EP2I7cLZHjX0XE8P7aPMOJEaUC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755663407, "uuid": "cffeb208-6672-4077-904e-b319e0bf6b26", "value": 6753296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755663407, "uuid": "7c88ed43-6d9d-48d2-8d3b-d7935acfa27f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755663407, "uuid": "6264ddd1-a454-4596-a078-9fac02503e8e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.37394763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c1ee72-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686348, "uuid": "be600513-23d7-49d7-81cb-d9ca8fe0da5d", "comment": "Malware payload", "value": "4e949f299bab191b6f9006d40b6d9386", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686348, "uuid": "aebd90a5-db26-453c-bb36-516549f06ead", "comment": "Malware payload", "value": "c80fb7c37a3428adc94bcb2c3447f035ec11c5cd76646899b6262fa58d8b569c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686348, "uuid": "0f4bb531-a8c5-4dc2-934f-93989c2b5782", "comment": "Malware payload", "value": "e7418cd49f9ff46176035c7f87c0aa3661065a7d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686348, "uuid": "053b1148-dc6a-4662-9977-67f16c4453ca", "comment": "Malware payload", "value": "c703fab4223b56ad00b8266d3e909613be5be99f5d49ab141ae8d6bcff3ebfac9813cdd00300223877739cd3a3247ee6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686348, "uuid": "2829785e-7d8c-493b-88dd-d808fae3057c", "value": "T12002DE8D5D6E6244D772737ACF2F8208EB76433F150387593AACA2C11F310284999EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686348, "uuid": "0e166c56-b59f-4914-9263-8757d35fb781", "value": "192:Qd4aJYP3EK/Ch8PRYV4nhdpPYMb4X3hrnETU5wvC3IMDf5i1lwsQX5iAhn5:Qd4aJYP3EK/Ch8PRYV4nhdpPTb4XRrEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686348, "uuid": "3a14be92-4380-43f7-b5eb-560b4458c95d", "value": 8491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686348, "uuid": "af8dd83a-72aa-4da1-ae9c-8db05b2ddf9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686348, "uuid": "9a0d650c-5498-4ba6-868b-52e2cd02b641", "value": "c80fb7c37a3428adc94bcb2c3447f035ec11c5cd76646899b6262fa58d8b569c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fcf83c-7d98-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755675359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675359, "uuid": "0c16d535-bb50-4d85-8cfe-eda35c7ff548", "comment": "Malware payload (XWorm)", "value": "7d8cadf5a58eb45a6364f74c6f6382a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675359, "uuid": "6560d18f-55fb-4554-98c2-69f08dfdcdb2", "comment": "Malware payload (XWorm)", "value": "c81ae09040888425c221ac0c94d36bf8b6aed848596179b5b0176fbecccbacdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675359, "uuid": "5faf2539-a8bb-4363-8694-f617df1d34b9", "comment": "Malware payload (XWorm)", "value": "68fb65ba83396736d35a05523149e04977177f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675359, "uuid": "c2fc7e96-1376-451f-b5d2-704a6a256481", "comment": "Malware payload (XWorm)", "value": "5c708e761cb454f9766df3791c4a0915f8f59618c5f136e10539d3da28877339b9b2e854ff4b723613b6ff132b288847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675359, "uuid": "a79e7975-9676-47db-8694-4e6e98b427ce", "value": "T1D136F17376118D98C0B6C7FC20A2DAB95B233EA81475824601F97E1BFAF2E411D1A5DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675359, "uuid": "6a540eaa-4ac7-476e-8b55-0aa9a55f87ad", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675359, "uuid": "f407ef23-9363-437f-9ff6-981f7727e322", "value": "98304:JVTaHpd53Ym5daZdjObR2TkqXf0FJ8PLd1ob:DTQ3YmOZdDTkSIGjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675359, "uuid": "239db282-24ac-4dbf-ba41-5fb651d78752", "value": 4871616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675359, "uuid": "8f66fd0b-d384-415f-8955-a3b0bde6b1dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675359, "uuid": "49e7dbb6-d1ec-49b5-845b-ac8e4b4d1003", "value": "real cracked 64th service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3159dc-7da0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755678945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678945, "uuid": "28a8ad49-76f4-4d37-9de7-a68857acd75f", "comment": "Malware payload (Mirai)", "value": "178603650ff146e04a833ac4babcb814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678945, "uuid": "9ca48e0e-dc37-4b3f-af09-3451e32895b7", "comment": "Malware payload (Mirai)", "value": "c8d99593cafaea8f6a13f9cd42739442c18ba9162cf1c67bba364335aeb44384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678945, "uuid": "a63cf04f-0f21-4937-8598-79e0fb44120c", "comment": "Malware payload (Mirai)", "value": "b27ad1a72ca2102c8e7391c8f214406db1e1140c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755678945, "uuid": "7a387311-6132-4de1-97bc-485affed11d5", "comment": "Malware payload (Mirai)", "value": "51a9cc8c40ead5bbc7c1ff91a551ec3d72b861716447da6ccc9a5f0d17dc87d308737a6cd5d2edc19be9228a70aa6f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678945, "uuid": "70e90f08-a998-4d7c-be82-84b363640f2b", "value": "T153639E63C9293ED8C1544174B4B88E7D0B73B14482931FFB56A9C6AA904FDBCF50E3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678945, "uuid": "f0bc3791-e73c-406b-8dcf-9d24cdb15994", "value": "1536:ydwtWcYEJv/cROfbsAb61/vlaKSGSQO0Y3CTGdOWNryxtZymS:ydIdJv/cRyNUXTSB0Y3P5yxtZymS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755678945, "uuid": "6463033e-c95c-4390-9387-bab2b4430b44", "value": 73296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755678945, "uuid": "bb9e1d9e-a950-4951-b5e4-8c26d07c9af7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755678945, "uuid": "d33e3924-a6ec-44a8-bfad-5794eade2bdf", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064c145c-7d69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755655047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655047, "uuid": "f8da0c9f-10e1-4202-8019-a3e509c223d9", "comment": "Malware payload (Mirai)", "value": "90a6ab37b6432e23e3248db942c7a57c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655047, "uuid": "29090dec-69d1-457b-b1dc-165ca3f7210e", "comment": "Malware payload (Mirai)", "value": "c9bce2aa7425750fcf3ed691635f1aa9a4eeb1a41137e9ce6285768d28a6a8ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655047, "uuid": "540b2881-859e-4546-befb-36bc7d0e2bb4", "comment": "Malware payload (Mirai)", "value": "d202f5f77049cfffa3955242b91b07fc9b24d21a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655047, "uuid": "947d3e24-918b-475e-8f71-04984ffbe333", "comment": "Malware payload (Mirai)", "value": "5b446f5257dd015de566fe167de8386c311366f84910b26796bf9e4edde80667e29e8e5af84718d43e1262bc249cd0f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655047, "uuid": "174a6aca-cc8a-48d1-8cfa-687dc0699b08", "value": "T16753028B33118C68EDE7D5F14AF95B10D81B33EBE00279424776DA9761E58A568C6F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655047, "uuid": "0c3a0e86-d4b1-4637-b5f9-b0fce646a86e", "value": "1536:QncJZhpzWPTea9mbk8NEgP43If5ABxqrMdnhKo77aQa20TVJux:QncfhaeQKf5oxqQweAVQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755655047, "uuid": "777f40ee-386d-4475-969e-10076594e980", "value": 63716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755655047, "uuid": "ce23dc59-6c1e-4532-868e-2a6b84499411", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655047, "uuid": "efeab4ab-43a2-4481-8a41-aea005e10fad", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94a7435-7d6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755656287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656287, "uuid": "fef667d9-cbc2-4c83-a3b7-ab2852d5a881", "comment": "Malware payload (Gafgyt)", "value": "a3edc9d365cf54402f31a7bee549c6d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656287, "uuid": "1e62f76c-c25b-411e-89bb-c46cedaee260", "comment": "Malware payload (Gafgyt)", "value": "ca108fe2ae79c3cd8f7322d18d880fbe96bc30a9b3778a2aca26b9f29f87b06f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656287, "uuid": "9194816e-65a9-4dcf-99ec-59ffdbe45e10", "comment": "Malware payload (Gafgyt)", "value": "27bdeb0bd3fbf0a768c469b36567b67c4f0ddbf4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656287, "uuid": "134c8dc1-7a7e-42e2-985e-0122f5787bd7", "comment": "Malware payload (Gafgyt)", "value": "1988f35f62e47ee193584d7bb2e853d89543c9b5c7398fcc372da73a85162a651a5962a4e785d95f7bd77f46ed8f0c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656287, "uuid": "f9f74a0d-bf6b-4154-926f-4eb6d58ca378", "value": "T1DFE30745FC518F12C6D656BBFB4E428D772A47A8D3EE72038D256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656287, "uuid": "1d3a23d8-e2fa-48db-89da-8ff9536e5037", "value": "3072:WlW0LJTXvtlhWb3vAE0Q11Frf1RUwZXww7cZfhk1jRickx:WlW0LJTXvtlhWbo0DFD1RUwhwwIlhkNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656287, "uuid": "d41bff83-cf08-4334-a8c2-9da6cbc10bab", "value": 146528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656287, "uuid": "199fb673-5860-4679-abf0-4008c8e9fffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656287, "uuid": "336b68b7-336f-4f53-b691-e3a668f44190", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce85e6-7d6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755656312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656312, "uuid": "2e926b4d-2a44-405d-99c4-22ee31cb97a3", "comment": "Malware payload (CoinMiner)", "value": "ef607c3ff03ca55088b37555d871386b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656312, "uuid": "65c50b78-e21e-43bc-90a8-7fd1f4ecf9bf", "comment": "Malware payload (CoinMiner)", "value": "ca5e29e745fc2b2ae5246befa0cd60214b0729d6f910e47e67bd88a3202a70e2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656312, "uuid": "071dcc22-d71a-48e9-86a7-26bdee9638b6", "comment": "Malware payload (CoinMiner)", "value": "6ee321e1da6a5e5bda31a52d1d5add3a59035409", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755656312, "uuid": "5d65f6eb-a647-44e4-abf9-358fc5b4ead5", "comment": "Malware payload (CoinMiner)", "value": "57b328e015d832de4d023ab44a8bb98961f4845eda59bb9c06674f81f266e2caefba165752d0fdaa2a0d007cbf45f879", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656312, "uuid": "844aee4c-a05c-4735-88fd-3f5b2e41e05b", "value": "T1A466232897558841E446F17E9FBB61223672D1A8634E76BE873FD1893B3E020E4539CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656312, "uuid": "3f59640a-75eb-40c6-9afa-b082a308188e", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656312, "uuid": "af6e5726-faca-4b0b-b85c-95ed9677a2cb", "value": "196608:jxXdHhOjo/sEm1/HIOU7F0LAQ6YWHrTJBoTno:hPOjKsE4IOKtQ6PLTio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755656312, "uuid": "eb94226a-8d6d-4129-822e-bdc6f3714491", "value": 6634000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755656312, "uuid": "794c96cd-d3c5-4158-a072-51992af8977c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755656312, "uuid": "33fb03bb-d932-4131-8e0a-42cd2d34860a", "value": "SecuriteInfo.com.Win64.MalwareX-gen.23788627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612f196b-7d87-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1755668085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668085, "uuid": "95f41f92-924a-4cc0-9738-3e22274ccbf5", "comment": "Malware payload (QuasarRAT)", "value": "421fd8ffc429e1d7b0485546679f31f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668085, "uuid": "33d99e70-90ff-41c6-a7de-2a0d9f3317ef", "comment": "Malware payload (QuasarRAT)", "value": "cb6b2c09cea22a69b1a265c20b9972b73e9663b59527850bb4b02d1e62986c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668085, "uuid": "dddd4940-27eb-4219-8db5-9555ff5c621d", "comment": "Malware payload (QuasarRAT)", "value": "23dd528bcfa8b763cf59bcc1eb90c6fd19b05ac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668085, "uuid": "b825248b-02fd-4e50-aba2-18c22d0fcc86", "comment": "Malware payload (QuasarRAT)", "value": "6c0898a4172d3cc1e77468439d889f80ab374c742d30eddd56ef5adf382d8dbe52ab93430614355a340e836817c25360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668085, "uuid": "ddc9da60-c8cc-4866-ab5b-b392aad5f18e", "value": "T1A7850110B7E88506F1FF1BB9E4B216454B37F662E936D74F198890AC1EA77809E503B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668085, "uuid": "637d536f-632d-41ba-aa65-65a103074e09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668085, "uuid": "f289ac8d-9af0-4bb8-920b-9aa68c0fedc2", "value": "24576:mRQCXfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfNlHoiC1S:mRQASGOGqnXpyWAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668085, "uuid": "0c3479d4-998f-4f9f-982e-ba147a5b30a6", "value": 1868288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668085, "uuid": "f8283ce4-0aea-4a41-8ecc-ff2900879a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668085, "uuid": "ce1e90fb-dcca-4c5e-8f0c-c26f7f8e347f", "value": "centrum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5e4cba-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1755692877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692877, "uuid": "67f7b383-9f1c-45df-9ea2-345c60742c66", "comment": "Malware payload (Formbook)", "value": "53caeb10cf0f802ec7597cff67bc9a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692877, "uuid": "dc250c21-cfc8-489e-9a9f-213429732400", "comment": "Malware payload (Formbook)", "value": "cba5a4c3813bbce1dfd6591d94bdd59e773c33d06d4a534da0b3cb527f0a9f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692877, "uuid": "07e6d376-531b-4baa-9ac4-7e7cf504dc40", "comment": "Malware payload (Formbook)", "value": "15350c3cde5c318bb9a4972aca9bc46cbbde0fac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692877, "uuid": "60168067-20a7-4bb0-b5f3-50382bcf879f", "comment": "Malware payload (Formbook)", "value": "6c13020166bd264f7abf7c2dce31524792ac71187e4ec3ca64dcf0730f586718905e1499a5ced9fcb982a2e5f92c0963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692877, "uuid": "432ceb39-06c7-4263-8297-cc089374ca38", "value": "T1D805CF9C3250B99FC853DA7289A4DD74AA206DAB5707D20390E71DEFBD0CA97CF141E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692877, "uuid": "2484849e-55f1-4b69-a6b1-caf4822d1ea3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692877, "uuid": "9d58f751-e2f4-4a17-b2fc-26326b19e503", "value": "12288:n7IgdXoEZLZsK480IeBdw01+DlM2I+vifF+8BmJLMUdwVM3oWrFf9MFxzjchan2i:xnZmK79Ad8JMzrkJLMRO3drFlMjjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692877, "uuid": "0d789d5c-8272-45ea-885d-3410f0e16e20", "value": 843272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692877, "uuid": "dca5c8f3-f1ca-49ab-b61a-39a8ed9345ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692877, "uuid": "a4a0ad12-9922-4583-9002-b6d205c4036d", "value": "invoices againts details PO ref below.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc9ed2a-7def-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755713012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713012, "uuid": "714e20b1-7323-44a4-9959-b1b17fc285e2", "comment": "Malware payload", "value": "27fb2b0caca35e62f25b4fe6995c2fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713012, "uuid": "072262e1-3a4a-4d9d-868d-3743552ab6a9", "comment": "Malware payload", "value": "cc12a5af606bb264861d8a1d5619f3e9454ecba7542d3cff28b22fc2f43fbbe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713012, "uuid": "3ed39304-2e61-40cf-8921-4db32536d01f", "comment": "Malware payload", "value": "b8bb6924915640f958575ee0bfef16fe17938b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713012, "uuid": "0c535892-d00d-4885-be3e-140ee257a6f0", "comment": "Malware payload", "value": "058f6a38ab6c2697d824988e4d3982660e8a7948375f62061f816e257e2c5a0a12bb4b1101daef6d9be6daaa26e87568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713012, "uuid": "e52da2a0-9112-44ff-b91c-0660fc2c795f", "value": "T17EE5919AB720220AF61B38F51BBF784D9439E7DA39580F6A6543B91185CA720FFC5313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713012, "uuid": "f4596b54-95e7-4fcb-bdeb-18f2e8098574", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713012, "uuid": "8e194b6f-5f6a-4a89-b887-d4af211b3cf4", "value": "49152:JBlJmN1LB474z4/LUy2mvhhhLyhDN9ZtbfOvwwEm:JBlJoBV0/LH3NyhDNBrOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755713012, "uuid": "bd694f0f-d0b6-4f32-92a1-4cddc9bc7a3e", "value": 3145704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755713012, "uuid": "d6db0ac3-697f-434f-944f-7d5469c6ba5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713012, "uuid": "fa342fd8-3c47-4f40-8661-957402320e02", "value": "DropCheats.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30e9fb4-7dc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695254, "uuid": "63368b3d-c619-4e34-a10c-7a17d21f408a", "comment": "Malware payload (Mirai)", "value": "2df25aa54355f25062cfd3ff83596b0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695254, "uuid": "f417ae13-cabe-4dd5-86a1-68ad214bbcf4", "comment": "Malware payload (Mirai)", "value": "cc6c9a8f743a6cbf243c168a9b5d49e8b9f9882c9068160d3fcdc300deab7cbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695254, "uuid": "060bb341-479e-4c79-ac09-09cdacdc0adb", "comment": "Malware payload (Mirai)", "value": "51dea20a0b91a86e4f62b84f0b6b1a88b42a1d34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695254, "uuid": "572fc342-c355-4aac-8ef4-80c1cbf274cb", "comment": "Malware payload (Mirai)", "value": "b15576b35e6154ef5e5ad0b1650c40facc9a16501e51800fb243113c6a15c8cd6581d9ffa22183f0cf8f999c0af8b664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695254, "uuid": "0aa308c2-742e-4226-8605-78fe1bd1a80f", "value": "T198041941FC414A13C6D712B7FA5E528D3B2617E8D3EA7203DE255F20368A99F0D3BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695254, "uuid": "3b0cb6f0-6cde-4257-a6ec-2568a1e3e574", "value": "3072:770TUMEjhOhmstargtz40zKIBqYTG76hh1nUz:77qAj8ceeMz4SKIBpa2Uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695254, "uuid": "94b760f2-cc3c-4aa3-a632-57efa48c35f6", "value": 175648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695254, "uuid": "9abe7de3-1a96-4c03-aa73-5f3600eb485d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695254, "uuid": "826a50ef-f525-4bd4-8902-d171d12fc59f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e40378a-7dd1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755699836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699836, "uuid": "aa5b3e92-dc55-4947-8f45-84e5e4cefa4a", "comment": "Malware payload (Mirai)", "value": "cf85b5bfdac75688babfeecea9e737c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699836, "uuid": "5f847dc4-b09c-4537-847a-b4c8583458ae", "comment": "Malware payload (Mirai)", "value": "cc9b8f1991ba76950d2345787ce4f20ddf1b3f218e90658d8a47c09acd3d802f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699836, "uuid": "34e8a31f-beea-47c1-a6c3-7fd34bb4972d", "comment": "Malware payload (Mirai)", "value": "b2ee6132cec98967552f53f5ae52c5d77e3cd0e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699836, "uuid": "060866a1-c1ba-4b6a-aa14-7b286bf79c9f", "comment": "Malware payload (Mirai)", "value": "55cadb88a7442361b2b05bd5c164e8b657427c6fef2dc42092c8448b432dfb6446ac297cc6cafae70a5d2b6b81e63312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699836, "uuid": "24e0621e-c941-4569-aac7-98a8dd97c096", "value": "T1BD34F60ABF510EF7D8ABDD3702EA2B0228CC545722A53B367274D518F44A64F5AE3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699836, "uuid": "d15e37f3-8aa1-4bf5-8a56-35322736be62", "value": "3072:cXPecMhFpkXoBu9X9VCp69oNBKXkvpzxX2pZtG0IY6hh1Ryq7TXen:cfecXoBu9PCp69oPNxmpS00yqvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699836, "uuid": "dd4be03c-dfbf-4f48-acf8-d9ce8ad25f9a", "value": 233072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699836, "uuid": "43794554-09e6-4888-9543-b53d6e42e542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699836, "uuid": "e34c5e7a-5fdf-4828-bc60-d790d20714e9", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab45404-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1755706219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706219, "uuid": "5636429c-58ce-4155-88ab-7e085760c32a", "comment": "Malware payload (Gh0stRAT)", "value": "97b05deee429a3daacaffa7e4d3feadc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706219, "uuid": "ac605e3b-eb06-49d2-b11c-46fb669d6276", "comment": "Malware payload (Gh0stRAT)", "value": "ccd2c7e01260f822af43e7f2e86a561b316265b0ab6f2e742de135be034c2bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706219, "uuid": "e9a51357-1698-49f1-8e82-a8caf5e442f0", "comment": "Malware payload (Gh0stRAT)", "value": "ee7ec33f013425f3284a8b460c0aa7f7fe74792f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706219, "uuid": "1d905248-abac-4baf-8503-e6a55fd6c42b", "comment": "Malware payload (Gh0stRAT)", "value": "2b8a335ffba2339d22385ca382d44526388a16a91f57bed7cc1dba4f3f2c69e02d602d1ed875ce2bedf17bb83e59a2a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706219, "uuid": "d7ed8ddc-8414-440b-ab97-144be9c7547c", "value": "T187F36A1774F0BBB6C34382750F658A3BB2E9E13CDD124993634B6B091F34BD28E6A251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706219, "uuid": "1e494a97-386c-4743-ac18-c94fe5f95b99", "value": "c8d8ab2105b98430234d0a20519aef66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706219, "uuid": "eb6c1f12-759b-40de-9d65-fffe0dbbdda2", "value": "3072:edlKPwx3EuRHSBtL7/u+YuzkTESlTmkZe:edlnx+7/u+YuIbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706219, "uuid": "33f3bd27-ca9a-4c29-9e15-d50298392a1f", "value": 159744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706219, "uuid": "200daaef-8ca1-4e80-b1ad-0e4b35a7c4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706219, "uuid": "e149e874-df45-4a36-a382-2249bc504556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd0f67d-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706222, "uuid": "c4cff24f-6bbe-44de-8347-36e714811f37", "comment": "Malware payload", "value": "4cb9795ed2eaa17bf5dfb02ed0b4049b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706222, "uuid": "d3b59c2f-f147-4d1e-b2f8-e70d97acae7c", "comment": "Malware payload", "value": "cd0c283728cc5e87ba54911f0e8ea53c86140944572cd9d94ebb6dafa8039cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706222, "uuid": "e7234ca3-770c-40ce-a4a0-a6524ec051dd", "comment": "Malware payload", "value": "c6124c02b2ae1af06dbc208650dc149c2f33def0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706222, "uuid": "e101b597-76c0-48d9-8bdb-d3f355c8895c", "comment": "Malware payload", "value": "54455669a420f83cd8a9060c019bf5fa7195baf992011f6408817ead81040364bb57875169c4191346ff541ac5ef6836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706222, "uuid": "46201707-a951-4ab2-a5bd-a29c7fb1eb9b", "value": "T1E8952317BB55E60BDA65077888B1C63C37A4CC7AB886474303A87EE8FD777910EC6681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706222, "uuid": "225900d8-1e47-462d-86b3-25010dafd9ac", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706222, "uuid": "c83cc43c-adbb-4eb1-9bd2-d0efeb7fcd28", "value": "24576:lVDy84jG2cmIGfQJxslQqjaxT7dooIHhKDcsp7uEt8WfSXLxDz6wRqDpGWnBDjmA:lqjG2lIGfExyjuT7eg5PK9DzMJm4YK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706222, "uuid": "44132ab6-aefe-4068-bc9c-763a290336ee", "value": 1945962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706222, "uuid": "d4d79cb8-fd04-4ac0-9b58-f84cd837da18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706222, "uuid": "84cc7ac6-faa0-48bb-8d10-b19c58ade86c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fda9826-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667304, "uuid": "5ffb307c-0671-41f0-9e6a-64f87526b4df", "comment": "Malware payload (Mirai)", "value": "a487d239e1ce8e26dfe9508e664eb97d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667304, "uuid": "ff11160f-519e-4ac3-b734-c0a400643be6", "comment": "Malware payload (Mirai)", "value": "cd7c45b4c659d748db1f973340ba2531160b1e987004bc9b4074ee1ac078c1d5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667304, "uuid": "36f0947b-4d89-4d14-bddd-47eddd71ec4a", "comment": "Malware payload (Mirai)", "value": "8103a6832aa1121c2edd9f9e9b0b4ef59752a485", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667304, "uuid": "e4e727bf-93a7-4717-8fed-7091fefc138e", "comment": "Malware payload (Mirai)", "value": "d5b3f0eb3f64aba3685e9301d295942054eccadce725ccd65be9def8a9741549d4b7ce814bf107f11fb93e8d85ed6e80", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667304, "uuid": "93496c8c-412e-4f9e-affd-dd804023181c", "value": "T174218D9E889D7101B0F9CB02B80397948F1EC5A7AD905F50A75DBC77CB8DC04F525A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667304, "uuid": "59043d33-3b2e-47e7-83db-151c5fbece4a", "value": "24:lI0fBzfOCfk0xzfAHb+iKYg2m4t/e3Jn4zgIiJZ1a:y05zmC8UzgbVXj/eSiNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667304, "uuid": "32574900-ba3d-43f9-873d-78aaa0cc6bd1", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667304, "uuid": "8c584811-f82c-4936-ba2f-8d392b386341", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667304, "uuid": "f74954cf-09ea-49d3-a303-610c794ec3e2", "value": "router.zyxel.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b2dffa-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721540, "uuid": "4f987875-41f9-4446-846a-789cffbd9e01", "comment": "Malware payload (Mirai)", "value": "f445387fe6323c58714a1a5e9fbe3f6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721540, "uuid": "bc817566-2904-4b44-9532-7bea8c5e28a1", "comment": "Malware payload (Mirai)", "value": "ce5f79bd134c4e312762459ab334657004c957ae31bc4f40ca897e52fcacad52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721540, "uuid": "abdecd0d-e305-44a2-a607-c2780ab74e7b", "comment": "Malware payload (Mirai)", "value": "107f144e6eed5f2d0486dd9c0a9e61dc49253ace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721540, "uuid": "7b1373e7-4b57-49a7-a21a-15bafc23fdaf", "comment": "Malware payload (Mirai)", "value": "85fd953f5d336a0c93de44dbc6a0105cc1933155d44aa19862aa640d499560708eb0a30a6c4d930fce9df6fd2586bc61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721540, "uuid": "5ed15f3b-704d-4c23-83ac-4d4698980d67", "value": "T1DCB2D0717014F8B3CBA500B76AE9DB43FB801AF8D0E873395469099DAAD5942AAF1107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721540, "uuid": "58af552c-c9a9-40fa-9eb8-59c9d0773ebb", "value": "384:eZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p7hymdGUop5h2:fX9nxn8o9wnBoWzEQf2EjKb3p7s3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721540, "uuid": "fd1fefd9-6ae7-42fd-a64a-a360920c0a33", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721540, "uuid": "7a807fc5-b1ee-4d63-ae71-24420316b11d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721540, "uuid": "a0ac02e6-6635-40bf-b0ef-bcf1af21a4a7", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcae00ff-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721550, "uuid": "97d9f599-5d62-4c50-a4f8-5a326254fe22", "comment": "Malware payload (Mirai)", "value": "b0c635c631726f5d1b98e97ea222ccc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721550, "uuid": "4c0b3c03-0488-4133-86a1-143a309a378c", "comment": "Malware payload (Mirai)", "value": "cedbb212bdcfcb06becc18b07c5a38110366c477596351c910040746707f0780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721550, "uuid": "6709f43c-7b4d-44d8-a556-0ce5cf200a3d", "comment": "Malware payload (Mirai)", "value": "3dd9e016f85c2811b56022f1e6a262631599aaa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721550, "uuid": "a6fc8a45-8a90-4bdc-9d61-b928a4bc221d", "comment": "Malware payload (Mirai)", "value": "9b0974b1fd94f44b771f58cc6fdc7ee9d77238cbe41a7d7f2dd756e05e77ab94115fee9b3aa7e586d4120d31a36bcb90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721550, "uuid": "00b5495d-015b-4b37-96e1-02f06b2afdab", "value": "T102332AE6B400DE7CF81FE77FC41B1509B631B6A616423B326367BC67AC362545922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721550, "uuid": "83e9d3dc-8ef0-47b0-bc62-68db0de03d9d", "value": "768:jNjH8SlNKHJ8rWTjVjXYDsCype05GeRSum08zqmGx3Vxz1CJCbyqzN9/fhQhi:JD8mKurmcQpe0jRrV8zLUTz1CJeyMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721550, "uuid": "7ec0ebe0-dc0b-4c5c-8c92-e4508ab59a5a", "value": 50268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721550, "uuid": "e47f3572-c3d1-454e-ac3b-ee9935efbf51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721550, "uuid": "a94a6ecc-95c6-479a-b9a5-bcf9208cbe64", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4939d525-7dbd-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755691237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691237, "uuid": "32b060d4-9587-477a-8a8f-e04dad35c4dc", "comment": "Malware payload (XWorm)", "value": "dfd1b59e6825391fb8ca57543e2b35fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691237, "uuid": "091f9b41-8fce-4a50-ac16-6dba0a587b55", "comment": "Malware payload (XWorm)", "value": "cf6b4824a833d49dc750f8361db73916310543fc225211efc147eb8b58c5c5c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691237, "uuid": "41789ea5-30b1-48ed-a14d-53eab5cc0e82", "comment": "Malware payload (XWorm)", "value": "e25793373a5f80e86777e00879d22ffd2df0199f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755691237, "uuid": "77f6fe56-ff86-4a5b-8dd7-c15750c40f2e", "comment": "Malware payload (XWorm)", "value": "a2e2bbdfff18521cf5408a6a23c31f29445bfdcddef7668aac5e1665c0cfb7eb70bff8a9cccf6d4427190288808adb95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691237, "uuid": "30d9e1aa-3a45-48d0-b2a6-f4ae9fe088a5", "value": "T1C8E23A4877E44712DAFEAFB52DF261061270D517D823EFAE0CE485E62B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691237, "uuid": "eaeb7b0a-ade1-4d84-acd6-8604a07fcbb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691237, "uuid": "a8c148db-7ee6-4c27-a6d5-74947bef00bf", "value": "768:DRPD9OQhx/Bqm3Tw49FzVFE9jG5Ojhlbw:Dd9OW/qm3U49HFE9jG5Ojvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755691237, "uuid": "b3b51d22-04c9-41f8-99ee-d5d487555d3e", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755691237, "uuid": "f1002e07-2f63-4a37-b2b8-775d92efeefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755691237, "uuid": "57292f9b-6bcb-4b79-912d-bbfcf819636d", "value": "157881578815788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c95737-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755671636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671636, "uuid": "79a167ab-aa76-467b-9354-e32ba85931d8", "comment": "Malware payload", "value": "2584ac8af87b959e88df818aeec113e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671636, "uuid": "759e3dda-b6b3-4cb1-bb19-88c88e83ae6f", "comment": "Malware payload", "value": "d029f99c7716fbc8b2deab857b7c2b9474d279abbd3f1f3349a21c45bad3a2fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671636, "uuid": "031bf61b-7e86-43d8-89c1-13932fa7872c", "comment": "Malware payload", "value": "cd40c6b9e07470f55f950884ed2b45170dd26286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671636, "uuid": "e08085a7-2ec9-452e-985d-0f1906709209", "comment": "Malware payload", "value": "85d923ecb90233cf9a9488f838c75051cc3c22a47188368f838b4c306dc8dab1921cb2d2e8977de69a448529a2ae4cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671636, "uuid": "f2b4ffb1-bac1-482b-a288-c967b82d2b16", "value": "T13016F7137F68DB1ED22822341DB1CA94A7292C5642D6992BB341F319B9F20BC4D6FDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671636, "uuid": "6403edb4-2b60-4517-80a8-ff6dff733dd2", "value": "49152:MhoSsk6TEg4Na6RTDJFkm8TxLHYQFczitPuGJB7Ff1Hwi07gOtd7yfu:GXt7yfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671636, "uuid": "664e7ff2-2112-4cef-9fcb-f73c9984e1dd", "value": 4063415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671636, "uuid": "bbdedb66-3501-4ba2-9b9f-88b476dbb1d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671636, "uuid": "b4f53d1b-cf18-4fbe-813e-bfe771264a16", "value": "niggamips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d672b84-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698868, "uuid": "68ead579-99ef-479c-a731-5b20bf90a4e6", "comment": "Malware payload", "value": "9bdff8790f65aa646b9c50507d7469e2", "object_relation": "md5", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698868, "uuid": "8ebe549c-0b17-44a4-a4b3-757812cc0bae", "comment": "Malware payload", "value": "d0e14618b882934c95176a9e5fb4a32207693aa17aa62fd4ca1426fe5563022c", "object_relation": "sha256", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698868, "uuid": "a35d89ce-6643-4304-a887-6ac8681f1973", "comment": "Malware payload", "value": "85a6940744b1316343fa7db87b8eff6d139b245f", "object_relation": "sha1", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698868, "uuid": "fc364ae0-dc5a-4ddd-ba88-27165d373bc6", "comment": "Malware payload", "value": "7be561c20eacfc93d2944d4a5da6a0e0912d3a618441e60b9788c5a9b8d28bce133ec955761166dd0bc5dbf578ffa48b", "object_relation": "sha3-384", "Tag": [ { "name": "118-99-3-33", "colour": "#0968C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698868, "uuid": "afde8890-7ecf-424d-99f1-bab9af729bcf", "value": "T1B7C5F619FFDAAC3DF49CA478659CC130845FAE2415D28462EDCFAE4BF720A8049F195B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698868, "uuid": "d5fd19bc-16ab-4679-b2b3-0ca094044242", "value": "5316646cb658259867ef69d100f31589", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698868, "uuid": "72777ecf-1756-4c49-8716-a59821e5966a", "value": "1536:mGOb7e4bOWHo66TGzGAesAgoB6uGPtFChMR3QVKG471tsWacd6XaNMeBzDTHiizs:Ev1Y3GzGB6uGP/mMY47t6XaNMgDTHNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698868, "uuid": "e49a487c-0785-465f-b829-9b01fdace4df", "value": 2717776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698868, "uuid": "b454b86e-dd16-47a8-a3d6-12951a6afbd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698868, "uuid": "fa798f06-5c9e-430f-9f4d-d1b60f7d82ef", "value": "d0e14618b882934c95176a9e5fb4a32207693aa17aa62fd4ca1426fe5563022c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292bd0b2-7d9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755677869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677869, "uuid": "89750b86-d597-445f-9d68-256d7227ead5", "comment": "Malware payload (Mirai)", "value": "0081e8b47f5e835796412aba7d056717", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677869, "uuid": "6082e130-9c1c-4b9a-bbe6-868adb05f493", "comment": "Malware payload (Mirai)", "value": "d10489a4d9fb208467a8fa61c7ff068405a7b882215d51b69a541ff2973a8050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677869, "uuid": "edcee5f0-ae37-4163-9f84-ad205eb4fda1", "comment": "Malware payload (Mirai)", "value": "5908f95d67bbfeee7c559562ced1926275cb0254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677869, "uuid": "9f9e4f6e-8d7a-4192-a453-fcb7db5db18d", "comment": "Malware payload (Mirai)", "value": "0a5baaf1a13b5be346de9bf653c947870ff292af205cd2b62b48a2069c924bc4d003a1b85a1e8844c763294629722582", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677869, "uuid": "fa61d396-7764-469b-bcdd-704d0c8c4f9e", "value": "T17D834B02735C0E47D1A719B0293F27E087BBE99121F4FA85690F9B468275E37118AFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677869, "uuid": "062b4c68-07c4-4570-b5f3-f08a5ba1dbcf", "value": "1536:gzvIpK7CH5JAbjnwYYWlpY6ACf3DI1Z6yf8UhqJfyxtZymax:eQkxj2B+Te6LffyxtZymax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677869, "uuid": "71594e20-f2ea-4166-96f2-05df7f13848c", "value": 80752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677869, "uuid": "d4420de7-ce28-4a74-b42e-c8bbca1930a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677869, "uuid": "79c0ca5f-2cab-429c-982a-d38a22712ef9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2588057-7ded-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755712003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712003, "uuid": "b1d9079e-9399-4a27-b102-753ab4c933d7", "comment": "Malware payload", "value": "e12cc85b1adcaa490ffa34444b83fe6b", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712003, "uuid": "07cdd17d-6888-48f1-b704-c940f274ce9c", "comment": "Malware payload", "value": "d15e223862e5bb47e764519b449a891ddf0593d6485bf9ea21a3936e2e500a41", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712003, "uuid": "dfdb2541-7301-47f6-a3c5-92ad414b7447", "comment": "Malware payload", "value": "689dddaa6717bcaf33e74b6954c83b36875dab95", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755712003, "uuid": "e3c68f84-2ec2-4c08-ab0f-89a44cbf4283", "comment": "Malware payload", "value": "a775aaa23b90f34b918056c4570711bcc37f1b06a18094933029721fe093361aa1d0200d0cc9921802f3371870168088", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712003, "uuid": "ffe8fce8-e4ea-4e3c-a989-e5d442fec200", "value": "T185E63323C67EA8C3DC77A3782DF3EB1A5A0ED26927A1AB4F0E2721942D590D0531735D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712003, "uuid": "0b6e78d3-b948-476a-a54f-da83135f360a", "value": "393216:c9rjcBVFq28fklve8n2Df3kY3ucN6OUPLFuctN:yjc9qclGfDf3Nuc8fTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755712003, "uuid": "36c69e7a-9872-4786-b964-945aa334c459", "value": 13884596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755712003, "uuid": "518e76fb-f3fb-43af-b0fc-a7d7fec955bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755712003, "uuid": "d62c194d-b8aa-4b46-a431-cee12904278e", "value": "0811PHStarq.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646c8776-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755671097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671097, "uuid": "4d4a572d-d972-4955-b8c0-92d58e9aa4f2", "comment": "Malware payload (Mirai)", "value": "2d24b60c6026b5585f6a25d2db7aa6ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671097, "uuid": "d276d2ff-bb6b-434c-a941-2fa4c779f403", "comment": "Malware payload (Mirai)", "value": "d27aabafaa1beb49bf4e7f8c78418fc9bbc9c175b333bc4357e515102b854350", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671097, "uuid": "85c94776-0dea-4215-829c-bb76f4ab0476", "comment": "Malware payload (Mirai)", "value": "edaff8615dd8cf5de5d27e0874ca34b3ab887b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671097, "uuid": "983cecc4-207b-4295-a7ce-2ebf070b43ad", "comment": "Malware payload (Mirai)", "value": "5d736d3d1f93e83dc769744483effdbf475f743e0b234400049034f622b49be0a3a87e2a70e95399bf9b2531cb15d0b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671097, "uuid": "51787459-b47a-41df-ad64-8d46c8c38985", "value": "T106E31945F8514F27C6D622BBFB5E428D372A17A8D2EE72039D216F20378B95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671097, "uuid": "a890cf84-d01a-463f-ab10-f988e9e132da", "value": "3072:p948cOImP3MxnuAmfhTYhuV7i1PA47A1BUYtLKrmy:pMBuffhs0By44U1BUIurmy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671097, "uuid": "b6a6edcd-b354-4ee3-90e5-5023bf1b4df2", "value": 154976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671097, "uuid": "a81f903c-17fb-4344-bbac-daed00c48b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671097, "uuid": "c78f445b-2383-4916-83f6-ef89e28af4c3", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4040b854-7e04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721717, "uuid": "3b0ab03d-bfb3-4d46-8217-fbcd73b27e5b", "comment": "Malware payload (Mirai)", "value": "98c0f1a3c659fc8d4651893ea741ce15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721717, "uuid": "abd0b156-5a58-4610-a9e8-7550ddf713e4", "comment": "Malware payload (Mirai)", "value": "d29ca199d6fcea31e0a88adae04716ea8e0a1b90f1a04ca21c91e8a17817d281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721717, "uuid": "a562e43d-0d7b-47e4-9a8f-49cea9f9b505", "comment": "Malware payload (Mirai)", "value": "cc85257adaefddd4800cdbd6229d4076b6a6a428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721717, "uuid": "7c0239d1-b414-48fc-8a52-5b2b1388459c", "comment": "Malware payload (Mirai)", "value": "d0f80cbb3c63b4023fb3138be95141d764606c9cf6dcdc233dfc73900e621a563fade67fe756d7c1ac27bab396b6a6cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721717, "uuid": "45cc0275-6ddc-4fa0-b009-ecd84e7adc76", "value": "T169C32B46EA408B13C5D61777FAAF41463322DB5493DB330689285FF43F87A9E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721717, "uuid": "20bdc3d4-1573-4f60-bd87-ffa265c8598b", "value": "3072:v8PXmy9MV9JXM9fN30yDShgFKeqBIXCwrM/9Jwu/:EPXmy9M2T0yDShg4eVXCMM/9Jwu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721717, "uuid": "c27aad79-57a4-4bcb-90ab-1094165f29a8", "value": 128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721717, "uuid": "429689d1-eccc-45b2-b213-b2d6c63af506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721717, "uuid": "d9e5c3ab-e2d8-4fe0-9b21-6c560e654648", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e575557a-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701807, "uuid": "098bf2a2-7d1c-4c3a-856c-f4a65ed21ebd", "comment": "Malware payload (Mirai)", "value": "45eb622266b89c69d87611e64e8a47a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701807, "uuid": "6fe31f8e-20a5-4e95-817a-bbbc86262f35", "comment": "Malware payload (Mirai)", "value": "d2b80cd60300d840ddba5879bf39577e9283f94cb6ad87a912910c5657a2b95c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701807, "uuid": "997b203b-136e-4a47-b9ef-ea5f89faf829", "comment": "Malware payload (Mirai)", "value": "ff80ec945ffc090413ff3abe944cb4748a56df08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701807, "uuid": "b16884d3-18ef-4db4-b47a-e6d92cea812a", "comment": "Malware payload (Mirai)", "value": "d0cd0daf5c1617553ed86ec52eedee2927680b47d53751acb9844a44bc390f41ef49359cafe7b2e05cd270ac27665aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701807, "uuid": "0f3d5785-3ab1-46ed-b844-2de4d98c4949", "value": "T1B4B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701807, "uuid": "a85d259c-f60d-4a64-aa7b-85b32b1fc5d7", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1H/LWy:c9sSyzz36YaWWgg1Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701807, "uuid": "4c5f7437-7b72-4e46-b996-f2f444c23685", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701807, "uuid": "4b068859-f63f-4822-9787-f00f269a0546", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701807, "uuid": "83054167-5888-45b3-a89f-0be3fb6c4150", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "826af1d1-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686179, "uuid": "ed9f9d5d-7ca2-4b72-92e5-4a4702ccf9e8", "comment": "Malware payload", "value": "97876df5d269a4eba5fd1331198532a4", "object_relation": "md5", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686179, "uuid": "208c1de2-a048-4c81-b7f4-b67bec69edce", "comment": "Malware payload", "value": "d34fbe522812c97f232f95bdcab23a76607d4f252c3d703e04e45fb5d0c37ee3", "object_relation": "sha256", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686179, "uuid": "c435100c-4480-4487-8268-34bc2eeb07e3", "comment": "Malware payload", "value": "57c96646e260e288dd34c214a6288f45d08fe24a", "object_relation": "sha1", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686179, "uuid": "f51feea6-e72c-4bb8-bbb8-c67bb1201f70", "comment": "Malware payload", "value": "10e2f8eb324561ee3de947ecc3aacec3f265b2e540dd69d7b5f3d8e273d0d2c93a652de88f1add3901dc7736801446a6", "object_relation": "sha3-384", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686179, "uuid": "515aba67-be6b-437c-8cb2-673af7334c53", "value": "T194E4BFB55355EC9F0A1C0EA5F418074A1C6C48E7E6B8D2F87E82B8F985991A04BFCDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686179, "uuid": "83d7b0ad-f240-4b65-afec-0587766a6a61", "value": "12288:7bVgX/uLmw+M6qunJGueRaQ8sPB3Klkfzy8265Z27FI:OqJynk/v8sPB6lkfzy82YwFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686179, "uuid": "74047e73-f218-43f5-a1c4-61509691db94", "value": 666284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686179, "uuid": "2ec8c03d-907b-4657-bc34-0690c76657f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686179, "uuid": "a3782a89-d152-4098-9b60-71ba8e8505f7", "value": "d34fbe522812c97f232f95bdcab23a76607d4f252c3d703e04e45fb5d0c37ee3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891a6b39-7dae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755684902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684902, "uuid": "93142968-1954-45a0-865c-4776b60c748f", "comment": "Malware payload (Rhadamanthys)", "value": "c7560e62b8723c1cde1ba2cfab467967", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684902, "uuid": "5ae47918-addf-4a87-80fc-c99c2720d9f2", "comment": "Malware payload (Rhadamanthys)", "value": "d3843ed393cd6d062fe92dc527769d455cd27a1c83319874ab7e80f74be43bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684902, "uuid": "bbe58d4c-7de8-4997-8b43-abf21de1a3b3", "comment": "Malware payload (Rhadamanthys)", "value": "87f2ef32850b0b9f7d62cbaf2346844424fdf82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684902, "uuid": "630af479-7979-46ed-93e9-ca3595c39f92", "comment": "Malware payload (Rhadamanthys)", "value": "96c4157cc4008d6a5dca90273b860b3fdf9617fb9585cb1ccdf855a5bf14d4f6320b43445abe92f541c06962a92d3ed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684902, "uuid": "17a85201-973f-4405-af98-291f07d18221", "value": "T103662339A9CAD5E7D9C314704307DA9EA2F425AD0D404C25FBDB68AF6171EB133AE381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684902, "uuid": "2cb48f59-e6e4-4bce-90f5-a15e430d0ee8", "value": "5fd7a64f782f2a19b3a934fcf8a06b19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684902, "uuid": "056f94ff-0294-4823-b30a-bd9c67685ace", "value": "98304:1FYLG3IhKEiUX+GV5wMSj6YaAkldH9z0v50VkYQTmXma8IIdBunKj5mi9f7An9YJ:8LFiUPwbTaAkldHVw58rgf4kfoCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684902, "uuid": "773eb9bd-9d9b-4518-af33-df71b71c9908", "value": 7007624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684902, "uuid": "197eee9f-66cb-4977-869c-cb7d69a315bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684902, "uuid": "4d659f01-51c5-4260-aaf3-174d09dfbd39", "value": "NexoLa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c144ebb3-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706471, "uuid": "966ed11f-4ec3-4a81-961b-488d3329604c", "comment": "Malware payload", "value": "f55036c6ae2b727716fef283205891b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706471, "uuid": "82344d28-22d7-4431-888e-b10a52cf2e8e", "comment": "Malware payload", "value": "d41aa300c27e2b2d250099d57a5fe949aa41e340a2757b4fca4274ed34faeec3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706471, "uuid": "971e0b74-4de5-4370-8023-5dcd30406df1", "comment": "Malware payload", "value": "1dbcc4ad101749c51534c3c8eccf3693b8e0b24a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706471, "uuid": "dae91c6a-25b1-4aa1-8a99-8a3319051d93", "comment": "Malware payload", "value": "afaf6ff445445ceb6983307c87832fce5431e1265d086988d5f28d30ab3a8e404ca301ba72d6634ff3adff2ccd609985", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706471, "uuid": "3829265b-4d3a-465b-ac01-6ed832666991", "value": "T1AF13089EA31951A0E5936076C67F4B84E770B18F17CA26EF029192511F237E1E9BDFC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706471, "uuid": "6f727724-cf93-439d-a285-77fb0d0352f7", "value": "36e39c67b3ab391df98baf06980d49a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706471, "uuid": "45b28fab-e8e4-4752-976f-355bdb56d7b8", "value": "768:ev77dJV+HKf0sZ7IG1Bhed3U6HroEyhxoPQgD18s4U9OABt:ev77dH+HKf0sZ7IGD+1oEH9/9OAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706471, "uuid": "faec8c02-2800-4f6c-9a75-7a206ad1f46f", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706471, "uuid": "ace7012b-a6dd-4e7d-a8f1-b2f3de6a5f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706471, "uuid": "be405092-4f92-4bb4-bc79-a1f53b17c904", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae25c7e-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695616, "uuid": "2abf3d7c-ab04-4fda-96e2-a9d8084f464f", "comment": "Malware payload (Mirai)", "value": "7c0cfe094fa8f1caaed9d3852979e480", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695616, "uuid": "f0f6b4ab-586b-420d-b191-8d2ee35a03b3", "comment": "Malware payload (Mirai)", "value": "d461b8e43a2ca8a41ae337513b2fd73dfc1eb56b1e751af6a12632485eb58fbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695616, "uuid": "3f95db71-e163-41ce-bf06-bef16fe119b7", "comment": "Malware payload (Mirai)", "value": "977aaa1bf17f2586a142655fc0d48df57f8e9e8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695616, "uuid": "5c96ab0d-13ed-461c-af85-63b60b37f609", "comment": "Malware payload (Mirai)", "value": "42ecdeb485148d90edfa1549e36db71ee0a714ff154b4f5a918dbde4dcb84a3df91c215517df0c99f6206aab0483a715", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695616, "uuid": "23a6f7d2-25a4-472c-bf68-9cdee0bf29f9", "value": "T17A041C52F8814F15C5D211B9FA1D218E371317B8E3DE7212AD205F707B8A9AF0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695616, "uuid": "bc93b5fa-8d8a-4329-85dd-38fef97d5d5d", "value": "3072:GTM2bwQj/3/15CFYb09vg5QypfAX2a4FdnW/DWup7thCIa6hh1gZ:1RQ73/15CFYb09vEleX2a4bnW/LhCIyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695616, "uuid": "9d0c9841-076a-4318-a478-b1690668f2ad", "value": 188540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695616, "uuid": "8ff23a70-9fb8-4dff-be8e-a2dd1fa5b33f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695616, "uuid": "0e94e30b-7420-43cb-9eae-6052ca8e8d80", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26489799-7df7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755716090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716090, "uuid": "6224fc1c-8739-4de3-9e4a-bf8caceac435", "comment": "Malware payload", "value": "c957ba5004bf70f774a5f15c4715aeea", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716090, "uuid": "36607d7f-e7b0-44dd-aed2-afd2b70773f3", "comment": "Malware payload", "value": "d49cd70556c815882ab39d8b256843559e2cd2d12fa91c2d6beda90ca739ac00", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716090, "uuid": "7df46474-e4dc-46dc-8092-c1377dff9a72", "comment": "Malware payload", "value": "f45de56bb5535ab756058b3551f2f07b2bd539a6", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716090, "uuid": "2efe9368-6737-4cb1-b311-ee787d197bb7", "comment": "Malware payload", "value": "c0a99fb007bbbaf5dc8a3aa3d0c1decf7db0bbf2329bd49eba8a534e8ec79c1ff4c32c928ac0cc405e96de39db5dbe0e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716090, "uuid": "3b01d711-06fe-44d7-b1d0-fbe097077038", "value": "T168E2C030DBFAC630D813E2B962D017C1F417F60ED69D228F2E2B90C21C639C6667AD58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716090, "uuid": "a9d4e4ee-6797-4316-8f11-2e3c27c8ea90", "value": "768:yhU9IK8qirqpwSD6XA7X4rnH4T9kYALrfqWhD38R:ZWKTMqppCA7X4rH49JKf9hD3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716090, "uuid": "c3cae6bd-ab37-4cbc-8b8c-b99b444456ee", "value": 32067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716090, "uuid": "5535304f-542e-4672-a81b-2622c75dd886", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716090, "uuid": "f4eb6378-d6b1-43c8-8802-b42f61908576", "value": "Red Spot Paint & Varnish Co IT Help Desk Info.gdoc.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3123b3cf-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755671440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671440, "uuid": "4e8ccde2-61bf-4a92-baac-814b023abad4", "comment": "Malware payload", "value": "a5fde6421460bbfc5defa95626829ea2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671440, "uuid": "f3304b9d-03e1-489f-9c53-2f5cb6cc2170", "comment": "Malware payload", "value": "d5e9a85d509d31e7c5b6a1cc99d7025034c87cff37d707f8f1a8ff564ee03aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671440, "uuid": "09bfd4ac-7d38-4f66-b740-9aa34854147f", "comment": "Malware payload", "value": "72606dc53e1eb253e838b7d0b82f4780242dd2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671440, "uuid": "561a5a39-774b-469d-85b8-5a582965fb03", "comment": "Malware payload", "value": "06491517419757e872b7e8b772cc6b82ba868b7bbbfcae89362afd465c0caff4a5fd949c6cd597e8a2becf3e7e440073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671440, "uuid": "74e7c86a-8b8f-4fc4-be0f-0b79d25c3875", "value": "T12DB3F29D32D071DECA67D8729F986C6CEA55747B831B5203A02306ADDA0D887CF543F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671440, "uuid": "08cb8c09-8eea-4dee-8385-a7fbfb2a5271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671440, "uuid": "cfbf11fb-e5f4-4393-9219-3328bacc95b1", "value": "3072:BRefzD3r1bM/jTugLo2AOWFRfJ7bq67vmLv:BR65bcjTugLo2AOWFRfJ7bq67vmLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671440, "uuid": "aa7affd2-5096-4bbc-a9e9-8e09197f209d", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671440, "uuid": "a23f170a-91e2-4340-b3c3-8a2e92e1cc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671440, "uuid": "72ade97e-f18e-48c2-9cbe-0e00a286f1da", "value": "SecuriteInfo.com.Win32.MalwareX-gen.77588959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9fe1d4-7e13-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1755728124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728124, "uuid": "39b43d66-1d0e-4c1d-aa3b-0fb3477f5bf1", "comment": "Malware payload (DCRat)", "value": "2f747ee39f63980282f3cbf307e7c598", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728124, "uuid": "13d713c9-d58b-472c-839d-65ac5c60668d", "comment": "Malware payload (DCRat)", "value": "d607bfcbe22d2dd7d7a40172c2c5e1680d5d1132c8cab4b2ce51b57ca84fe997", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728124, "uuid": "24710242-2f3f-4d84-a296-61b0c9ff0199", "comment": "Malware payload (DCRat)", "value": "ae765964d427ac11e03d2095f87e0ff95cc6faba", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755728124, "uuid": "25e4c49d-0847-4393-a6ef-869223dce102", "comment": "Malware payload (DCRat)", "value": "4656d36be8d7925f1668cacb4681707f81dfb7fdc25fd641c60c58d291158027254e6ec8665c75accd3eef85fc56b7a8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728124, "uuid": "40c6088b-3093-4a92-aff6-809c49f82c6e", "value": "T14CC52D342EEA102AB173FF7D8AE47596DA5FBBA33707585D10A1038A0723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728124, "uuid": "7a5c638e-b1f1-4e1f-b306-c9c390769099", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728124, "uuid": "e88eef9b-b23e-4cce-ad19-ec1a9d26d8ca", "value": "24576:nG2E3pEGxXjePOMWVPtavH0vL6lQd+keNENq+0vmLax:GJ3PXIzvwEOq+ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755728124, "uuid": "3d91aa84-9178-45ba-ab99-f6e763403fea", "value": 2699776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755728124, "uuid": "1e704cef-4d99-4f8f-a594-2545d08410eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755728124, "uuid": "e85ccd7e-36a6-4da5-894f-3449c6c6d279", "value": "2f747ee39f63980282f3cbf307e7c598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6bbf15b-7df7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1755716412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716412, "uuid": "8584de8b-3d65-4c4f-bee5-f79c9df2ef9f", "comment": "Malware payload (Formbook)", "value": "5654a0dd4896509ebc47aec3c0424e5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716412, "uuid": "6dbd85b6-c02f-4edd-ac16-bcfa9766d16c", "comment": "Malware payload (Formbook)", "value": "d6db45310338efda0778f101ea3378831370913796f5971fd861d9f2c3f49ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716412, "uuid": "c909398e-1067-45d8-bd39-e2c2eed0d3e4", "comment": "Malware payload (Formbook)", "value": "d0b3b8af9b7b4a65a1b8fd967e46c0fbea27ccad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755716412, "uuid": "661fb9dd-3e33-40d5-b083-2b134b3ae088", "comment": "Malware payload (Formbook)", "value": "3bea9387123d99d62d1919be224127aaab6a2f68adc816e3b1ca7bc1f7565d8020bd69b20883f2fbaf5e72d51a65bd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716412, "uuid": "7475a107-43f7-4feb-ba6f-9691e6068900", "value": "T12745CF027391D062FFAB92334B5AF6115BBC79260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716412, "uuid": "7746043a-bc37-4875-8b8c-bac555fb2ac7", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716412, "uuid": "76f25cb4-8dd6-4ea7-9ba2-58ea8b9f6205", "value": "24576:U5EmXFtKaL4/oFe5T9yyXYfP1ijXda9DjKSWaT9rXE:UPVt/LZeJbInQRa9fKqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755716412, "uuid": "d9142986-c908-4527-9e4a-9a5c888dfcc8", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755716412, "uuid": "fbff5bea-e2c0-4372-ad6f-aba8d1d4e38a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755716412, "uuid": "c25094f1-f126-417f-8831-f3cd4c94c3de", "value": "z45CV_Erika_Urbina_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e28881a8-7dc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755696649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696649, "uuid": "5d14609b-9916-456c-959a-4a4b8ff7d663", "comment": "Malware payload (Mirai)", "value": "3702804b3ca544e90f0b5fe29aa4c279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696649, "uuid": "91e09507-0960-4f06-bf8b-67a085cbb79d", "comment": "Malware payload (Mirai)", "value": "d7249d19695d2d26a5eb135043e3c72aab9d742fe8de07cf8bf1369632606944", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696649, "uuid": "5f509d86-6321-431c-bff4-cfb0c0edf65c", "comment": "Malware payload (Mirai)", "value": "18776cd59202f408ef214a5994c44853cfbfbfb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755696649, "uuid": "ab2cdd61-31c7-4518-90f0-ffbe01bdbeae", "comment": "Malware payload (Mirai)", "value": "66532a503bc3554490a983d81eecff8c48d2dc9b72825ece842585ec66de70695a8cc76e76cc4270bebcb59d7f65f028", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696649, "uuid": "7de16ff4-c46f-47a9-bdc8-60573346a1ad", "value": "T15D1438C7F801C9BEF80BE67644171915B030B7A210925B33B257B96BBC7A1D91927FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696649, "uuid": "0a7b8f4b-0233-43fe-9d16-0f97e7fd9376", "value": "3072:55XcPPsg6It7aDP3VyLO9oIvsHOwLh3y6LoglV4jbiGLd59l3OFYTuh/FN6d3:vMHsg6XfVyLKoIvsHOwhCioggLd59lf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755696649, "uuid": "d8dc4fd7-b8b1-4002-a4f7-1e6fe72091e4", "value": 191104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755696649, "uuid": "a54a50e3-ce9f-4ace-ae72-d1acf5e5e5ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755696649, "uuid": "d98a0870-e449-49b3-a4f9-05235de2d8b9", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793e1484-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755700767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700767, "uuid": "467e9471-f675-4034-8669-8817dbce73e2", "comment": "Malware payload (Mirai)", "value": "3bd5641eca5d4203aa00c9d572c1d2d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700767, "uuid": "7702fbad-f10c-40c1-8e3d-71ca205fe2ba", "comment": "Malware payload (Mirai)", "value": "d76aeabe006379df872ab41367714db085d4696ac7d6ef28cd965352e8df0ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700767, "uuid": "6fd7808e-9456-4d6f-ba85-b18702437501", "comment": "Malware payload (Mirai)", "value": "4f49b9e517ed1238aab17bf31627cc71050ea8de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700767, "uuid": "76cd3f43-2891-4741-8925-d55af65ea7e3", "comment": "Malware payload (Mirai)", "value": "6e3a068f7725a66e01a20204c38a84fbec3714cfd6f49d0f95b525891aec5f6d36c644b666a7d70cf6236d4b7d1dcc8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700767, "uuid": "c16145ff-da28-4285-ac42-98aeee00d759", "value": "T1E7935CC5F283D4F5EC4705B16137EB335B32E0B92119FA43D3A96972EC91811EA26B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700767, "uuid": "a20d7c68-797a-4837-97f3-2d689c75a6e0", "value": "1536:OUOWKJAyWxgv7q7b3maO0NETgk1b3WD3Km7937q5U1S2vTRHH:OUOtJpWxgeP3maPa51b3WKm5LyU8GV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700767, "uuid": "ba07a87f-2500-41d6-8e8f-e940d3a49622", "value": 89668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700767, "uuid": "827151d6-70ad-4d45-83e6-1a0b8d53d127", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700767, "uuid": "255fe774-6d8d-40fa-9af5-2d768ece9bb7", "value": ".ksysd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea367c15-7e0a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755724579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724579, "uuid": "f5412282-f1a5-432e-af6c-b7fffb27768f", "comment": "Malware payload", "value": "94723e34e00ff993654b53d1c39a23b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724579, "uuid": "6fb85bd7-72c7-44e1-b74d-ff4a4da89055", "comment": "Malware payload", "value": "d80041bb6bd3769aec962b6e4b6aa4a4e4d6b7a8530f00be543bde842f5b67b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724579, "uuid": "16872b54-1e20-4be8-8954-5dab7e56cee4", "comment": "Malware payload", "value": "d548474b8b05deb9fb165abfb6d79102ec3a8119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724579, "uuid": "3571f0c3-aaf6-4c53-bfc3-c934df099e0a", "comment": "Malware payload", "value": "d5f636a0a6bcee160ca15b8a4aacea9cf9f810929e3e2e6919acb7aa581c85eed512169be08756eb5297038ce935ba00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724579, "uuid": "66086b11-300a-4b7f-8070-53c8d6c3677a", "value": "T121056A1AF69220F0D87291B889A15316EA74BC784B349BDB73DC44490F73AD8AF3DB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724579, "uuid": "f5477ac0-7a0d-4360-b150-28d1c80b41d4", "value": "bc66684b1ad3db1ed30c735eee8f501c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724579, "uuid": "2c696631-8294-4fa4-9e92-f61891ccca6e", "value": "12288:+STt7wsAKJMBAFNVkF77RlzoCgfdcqvCoRtb7:+SB7wsAKaBApkF77RpoCgfdt6on7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755724579, "uuid": "b0d37867-fddc-47af-aa2d-3890ff873af0", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755724579, "uuid": "a20533a4-5ca5-41d7-b9d9-988f20a741fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724579, "uuid": "a6c5b6fc-dafe-4211-9639-041d2f15e04e", "value": "SPOOFER,MAC,DISK CHANGER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bba28e-7d64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653214, "uuid": "a6998419-4b2d-4e25-864b-3e463268250e", "comment": "Malware payload (Mirai)", "value": "d7eaef1d7c38b0aaef1b444efba705ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653214, "uuid": "8111a40d-fc44-436e-b65c-243571c3a4cf", "comment": "Malware payload (Mirai)", "value": "d808d9abc34d1b77d496ddcdec813d0cb903d886e0cee60616c9451c71d8da7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653214, "uuid": "38a152e1-02f3-4d4a-9302-7fbeb3420db3", "comment": "Malware payload (Mirai)", "value": "71e68bed4e472e96e370e1390e344a2da39867f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653214, "uuid": "aa8b9b09-163a-4b91-a941-cf74bce7d344", "comment": "Malware payload (Mirai)", "value": "dbb6c2a743c3d43a88b173f2a5e8a9c56d40b210a812c08476ce244c42077de6165eec4f56fee7d597fcd32ec50dbd20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653214, "uuid": "7f6ca8a3-e1ff-4dff-a461-abdb758bdb01", "value": "T197041C55F8814B16C1D211BAFA1D228E371317BCE3DE7212AD245F30778A9AF0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653214, "uuid": "299bb916-9da0-480d-adf3-54ddf14c89e1", "value": "3072:ghH6cudleCI0ySJdoJ9UkFrq6Xas1Kxa3640C/ibUJ113VoVVGPGG6hh1XZ:SH6cOleCI0ySJdoJ97A6XWxaCC/N110Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653214, "uuid": "40c27b51-5312-41c2-b8ac-935250540fa5", "value": 184060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653214, "uuid": "e7ee0677-6d9c-4e2f-afcd-8a7af2144115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653214, "uuid": "28075d03-0555-498b-af2f-9864b923c739", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822f7a81-7dc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755693480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693480, "uuid": "7b619b59-48fd-4d0b-86e6-93370a9bdc2d", "comment": "Malware payload (Mirai)", "value": "4d6842cfe54bd8d1b55486d86a0419a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693480, "uuid": "e05ad715-844d-476a-bfaf-68e9fdbe2ec9", "comment": "Malware payload (Mirai)", "value": "d84063f1e91b711c4c2c83a252e580c85709fb4d64999634076a375842e0c5f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693480, "uuid": "b42a4cb9-8027-4154-8205-39a8b4321d22", "comment": "Malware payload (Mirai)", "value": "7108469e7a93bb161a7672e853fae6792f225109", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693480, "uuid": "cfdbe7c6-3c50-4636-abbd-2ab2772b2586", "comment": "Malware payload (Mirai)", "value": "711ccbd64d86ce584957ff892ed8094aa8a22cfcaefe7a164cd0131bca854074382cf5ee05dd956762be394552436f5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693480, "uuid": "db60b938-ad08-476c-9e6a-b7dd8635fc77", "value": "T1A9731A82FC814A1BC2D10275B15EBA8D3B6163E9D2CB7213EE204B607AC559F1D7BF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693480, "uuid": "809b3bda-b44d-4b28-8c13-348acb57d8a7", "value": "1536:XLp2LHfh+yEOwbWDJ0tXvxVoxieYLVaPVHvH2IymQY2AUm6hh12NBjR7PR7:XLp2LH5+yEMivs6hh14BjRTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693480, "uuid": "fec2d31d-16e2-40c5-88ce-249b1dd120b5", "value": 80164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693480, "uuid": "80d5f074-8966-43e2-a79c-e471f33901f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693480, "uuid": "1f7788fa-2318-46d2-9545-e0044f22c9cf", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed76b4de-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755700962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700962, "uuid": "7031eb4d-e30b-4313-b939-903b859121d5", "comment": "Malware payload (Mirai)", "value": "0d9ae4d9aca9a8020fd87d2cc55410dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700962, "uuid": "6a5dfce3-e220-48e5-8004-93cf450d330a", "comment": "Malware payload (Mirai)", "value": "d898686417867daddb3b27945777a8eaba310b4114a86706b2dbaf792b4cc510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700962, "uuid": "6acf2367-8d8d-4b8d-8b88-25e49415aeea", "comment": "Malware payload (Mirai)", "value": "653f6ba7c87235534082a619bc4df85e52599bcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700962, "uuid": "174a3133-afdb-4056-8dc4-3e01e749eb1d", "comment": "Malware payload (Mirai)", "value": "c1bc96a81f851a644e954b617340f1474be24e01d98d8e4e1a82bc2f9eb07873c661cb0e42712669868a4200ceaf3063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700962, "uuid": "49c35ce5-8665-48fd-b1e4-a528e2c7ca3b", "value": "T14DD30845F8514F23C6C612BBFB5E428D3B2A17E8D3EE720399256F61378B85B0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700962, "uuid": "baa9f9e5-07b3-4d92-be7a-2d1a7e3adba0", "value": "1536:4vsvIM9SvMJSYcVrA27+F1AW+FT4VUl0BTT3mlIwGcuRdu55xxldZIwywHBfCQZ6:4vsQGcVrlqF1G48G33mlIfwnbrh07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700962, "uuid": "693c4cc3-0149-421e-b173-eaa4feb09b38", "value": 133856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700962, "uuid": "d1616b4d-f33c-4d36-8f57-0c78d952af2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700962, "uuid": "8876ef5d-6ff7-4f51-8789-a899e48cffb8", "value": ".netd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3b6552-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701440, "uuid": "2e1d71bf-fe0d-4d3a-88f7-41c4dc6c7b65", "comment": "Malware payload (Mirai)", "value": "69cbb5432f0f46b2c6b5272106336632", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701440, "uuid": "65a607bf-aed6-4f23-9f13-898bf2cc417e", "comment": "Malware payload (Mirai)", "value": "d8ca20746f6d9dd8e18fa800ffcf533f32557b4490ce8dc433b1989cfc1ce171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701440, "uuid": "51e7172e-f72f-4218-b5a4-f67a5cc92147", "comment": "Malware payload (Mirai)", "value": "efb011e6352cc55d8d98361d91aac986f430d878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701440, "uuid": "3162fe52-8532-4127-9326-14fc4e7d6355", "comment": "Malware payload (Mirai)", "value": "f6c4c67ff533e97d6dced856b7fb97ef449ab91d82c18f0121b80b93675df00b0a72eb1437a6bd1655da983cb5fe1c60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701440, "uuid": "6baad49c-473a-4548-a5dc-8adee7acd0d4", "value": "T144530226021050F7ECCAC5FC2CD1075633732EB09737BB88529BF4B9785525CA576BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701440, "uuid": "3c505b24-d1eb-4436-95de-d550e93a1f1b", "value": "1536:0342s2o29PBwx8GSYTpPPlKQ/Q7idtXPVJu9:0342s2o29PAhTp1KQ/0ifVQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701440, "uuid": "632c3a7e-ecf6-43c5-9bcb-1e31a4d2664d", "value": 66204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701440, "uuid": "19e6a692-035d-4279-b404-8b6bcfbec1b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701440, "uuid": "5b8321f4-0f58-49f0-8bc6-f1b50ca49b18", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db54aa85-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721547, "uuid": "b9627824-2f1b-4331-8856-831c1bf1cafd", "comment": "Malware payload (Mirai)", "value": "0dc212df9782784fa12ae497b58d169f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721547, "uuid": "6e56184e-acf5-4e7d-b0b1-e1dd0c883c13", "comment": "Malware payload (Mirai)", "value": "d9718388cae05014344fa54244cbe64324949bf2ac1a6c215dc974527f125c3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721547, "uuid": "bb472486-2bee-448f-89ff-b8d44456452c", "comment": "Malware payload (Mirai)", "value": "1055f2be68ea54097777d938668b45721079eee5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721547, "uuid": "ec19bdd0-0c58-4eeb-9c27-ed4fefddab19", "comment": "Malware payload (Mirai)", "value": "602866e648599e973ef48bfd30e75320c104088aad09c5cb110c6377f44e42a07b0203601e82ded9f1dad704e91457d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721547, "uuid": "e5019656-df9e-4674-89cd-869d6248da91", "value": "T1AF5301D285F95CF7F6A51F32C692D844FD1AEBF8F2A544302EA8C6042B6154847EE2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721547, "uuid": "73a5d9e0-2d8d-4489-aaee-376c3d1ac4fc", "value": "1536:pVQuWBecvEoConkvMTLriLs1ifAIbWPgh8:pVvW/EoCRvMTLriL8i9bHh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721547, "uuid": "d6b50168-2269-4100-97af-a323d5065e11", "value": 61832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721547, "uuid": "6df08f8b-214d-4412-90ad-dbe9d1c0ab26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721547, "uuid": "a0b49d1c-c462-4c5e-a37c-9fe6d0814fa1", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703881af-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700752, "uuid": "aa96ef52-e4a1-4129-b1e0-d3f166037494", "comment": "Malware payload", "value": "d8f772eb587ce9c937235398d44f59d8", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700752, "uuid": "4a8e5967-3cad-4aec-b6cd-6ee9c9d64a43", "comment": "Malware payload", "value": "d9e5f9a4c2aaf947e9c1a2eda1f1a5c5fa968217f01df978fea608f4756ba554", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700752, "uuid": "1e51da3b-9fe7-48d4-a591-c4e73a7853db", "comment": "Malware payload", "value": "812c32a9b7209d41b331b80a29b7d031f9fd7bd4", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700752, "uuid": "f6565e0b-7e12-4af4-956d-159641ef1c9a", "comment": "Malware payload", "value": "1abe955447548d5570d138dc6301561600dde098df2b12f2ddb01a76547bc87bc13511148d8896b4bf93594f28e51a13", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700752, "uuid": "dd97f9c3-7107-43d6-857f-870543c5f173", "value": "T1AF269DA9B97C0056D86A82BCC2872327D771B56507F057CF6A245AFA0F63BD026BF740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700752, "uuid": "2942c4e3-4e33-4cc4-9805-f682e6e36e6c", "value": "bb0103bc49266abaea121a19331aace1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700752, "uuid": "c736e923-0f91-4865-ab6e-7fea6491a9fe", "value": "49152:VVVwASOZGtlq1ggFI6yjJf0uc91gyk+ud2VpBB2B6jli+aZYjzpmEPvWp3VUR1PV:OjJSTVvIcjgSxD7+JAWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700752, "uuid": "519e124a-ce34-4af7-8a6d-3992c5682ffc", "value": 4507400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700752, "uuid": "60ddf926-0a58-497e-837f-2cddba7c42fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700752, "uuid": "31010672-e730-46c3-a848-40f21cceec7d", "value": "d9e5f9a4c2aaf947e9c1a2eda1f1a5c5fa968217f01df978fea608f4756ba554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b62d66-7daa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683153, "uuid": "514ddd3f-fbe6-4662-b867-91b3598a34ee", "comment": "Malware payload", "value": "ef0fd2733d5d84ce6ce331659d006295", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683153, "uuid": "85a28602-f77e-47f1-8f47-5a7ea69b6407", "comment": "Malware payload", "value": "d9f567ad67c485f98d1c28a27b3ae84b2da4828900032238018d97fdc315eb77", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683153, "uuid": "042d7202-bbbf-4b1b-adce-69c1a35a6a8b", "comment": "Malware payload", "value": "5ececcb0da25cc01190f84212a3e236dcba5da75", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683153, "uuid": "22f34e65-f24c-4357-8234-e613a832b1ae", "comment": "Malware payload", "value": "7022e8216c5580cdecc40b5e5a505af5e36fc8d27d31752dad89e4e5eae84b524cc4f2072f0170006217c2e8bcb84fa1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683153, "uuid": "9c77db47-8d39-4d50-8db8-1ce93d9e64c6", "value": "T12943F79163DC07A1A94804DA21B9A51BD1F2E03D79612EC4DAF3A757F83A653FCB8370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683153, "uuid": "4a7ee204-c4c6-4968-8816-a17731264ba0", "value": "384:lkxBbE7PoFewQRJArQdXjmHFcN5JkxKcHKIk4epB7:mBb4Poww78XjmHFkiKcHKr4ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683153, "uuid": "a2ecdcd0-6fd3-4b2c-9bb3-6483907c04eb", "value": 55585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683153, "uuid": "7b4ae99e-db63-4941-bc1e-43c919bcfde8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683153, "uuid": "bc902ad3-5655-40e1-862a-1da40a38e43e", "value": "new.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836afc7d-7dab-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755683604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683604, "uuid": "57150717-a5dd-45f8-88cd-9008ba17ca77", "comment": "Malware payload (LummaStealer)", "value": "b50029ee1c962dc6d8a7f3c9161e7c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683604, "uuid": "81bea95b-2e25-4796-af41-af95ebec036b", "comment": "Malware payload (LummaStealer)", "value": "d9fc4bb21fadf9bd14075bc4aa70d70896483e6342bd12a96b9799c4754c53c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683604, "uuid": "f05bb2b3-c2ae-4a6b-a8c4-03892be91b8a", "comment": "Malware payload (LummaStealer)", "value": "a7e06f43cfc7b8e99e156e90ff12e3dda664e374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683604, "uuid": "98da04dc-cf82-458d-93f4-31eb4998ce67", "comment": "Malware payload (LummaStealer)", "value": "4a379b82e12984b9956b7d0eef7f068979bf36443f49b922dab5f7f34644280bdc2c18a1662ab2f96efa1de694785a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683604, "uuid": "3f8a0402-1829-47a5-8930-54377bae89ec", "value": "T17F753A0378A528FEE6BDE1329AA26110B57270F90333778B1A89119E56D9FD47B3F314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683604, "uuid": "183c8b71-c284-442c-85ef-8869410908e7", "value": "25c4fb4a248389347ae9cf0ce6995420", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683604, "uuid": "798e0cca-e37b-423d-a62a-6511f002e638", "value": "24576:6lp3O0eMO8eFCl1RU+acgdfzZgg3pMiX/NjxOVy:W3jeMBegl1RjaVVzZggZMiPNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683604, "uuid": "678c8c3e-61a0-47f6-90c1-41b151f3f16d", "value": 1591896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683604, "uuid": "e903187e-3676-4341-a2f0-20b5f744ad22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683604, "uuid": "a7dd0af8-60df-417c-abec-875addeb4857", "value": "Boostrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74aa419b-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699041, "uuid": "b9d01739-35f7-49cc-b93a-7d1e978b51e2", "comment": "Malware payload", "value": "441b35ee7c366d4644dca741f51eb729", "object_relation": "md5", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699041, "uuid": "b864e348-6cf9-490a-9f25-f6a5f9daa6ec", "comment": "Malware payload", "value": "da34b4041090eafb852985866dd9fc5c435b5654a4c671a2c7f73be2804e2c22", "object_relation": "sha256", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699041, "uuid": "8207ca7e-efc9-4cc4-91d3-8bb16bd6645e", "comment": "Malware payload", "value": "5b4af9d5225352ce78b5009fe05ab7bbc0d9d0b1", "object_relation": "sha1", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699041, "uuid": "82336a88-5632-4412-aa3f-f4954f90407b", "comment": "Malware payload", "value": "a843c6d54ec3882f4a62e9925756fb9619dbca1eb54129c897760dbe6b69d5c031becdd5d6dc81b69607f51348c8a024", "object_relation": "sha3-384", "Tag": [ { "name": "154-91-183-174", "colour": "#19F64C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699041, "uuid": "0e829ca1-9a8c-4445-a33e-6d8131e6535c", "value": "T1194506D3B8888951FD2844375097BDFDEB169CCC9CB8910AB24472F954B2D72223BF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699041, "uuid": "9529d28d-30b0-44fb-8996-d6006ed1ae3f", "value": "0f4b0270c84616ce594b6a84c47a7717", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699041, "uuid": "f864480d-902e-4e55-8d61-335d644dd045", "value": "3072:55vlPRcFK2you7hL/97RZ5vEMa3rNEAYe111MovdNE:nvDc0UubmTPvdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699041, "uuid": "68cc225e-a2bb-4ae9-b6c3-a21096d1b91d", "value": 1215128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699041, "uuid": "da07562c-b259-4c36-9f9f-414015e61530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699041, "uuid": "b06dd571-baba-4b3f-937f-7c23ba0ee83b", "value": "da34b4041090eafb852985866dd9fc5c435b5654a4c671a2c7f73be2804e2c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aee5568-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723130, "uuid": "33fe65f0-cc3d-49ef-bbe5-da29b05f38fe", "comment": "Malware payload", "value": "ce2f9d3a89133b59262eaf8b3a09fa50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723130, "uuid": "648264ea-c45e-4a85-99b4-297ad26dc16f", "comment": "Malware payload", "value": "da3b978c918319e69d34f1a9ca6d973d2d73f755ef39f9d4de91f1d3db811dbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723130, "uuid": "65748820-282e-42aa-a50d-fbf3c7964fe8", "comment": "Malware payload", "value": "26f220920970cbcc7fc786d685606c55a2262fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723130, "uuid": "3fc9158a-3c11-4880-aa48-23205b045523", "comment": "Malware payload", "value": "2700c7593070ac75dc9316bc8717d8bc6fed730181b3eb12af67f4eebc5dd1c23de4c0bbe1007ed96526419a5b829576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723130, "uuid": "d9f0e722-b628-4b2a-9cd4-cc26de1300ae", "value": "T17615F16D33F96640E0BF7B764471021113B2F987AA23D39E4DD852BA0E737865E26363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723130, "uuid": "c66c1d35-4cec-4abf-9fa1-a213f69309ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723130, "uuid": "a4c3d310-ff47-4d73-8505-48fcf939edc5", "value": "12288:Nbm75b0NPPoZLCtPDiE+Y7A0qU1gshPU37Tp15fDpxha:h+wPufvg1gCPIhLha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723130, "uuid": "7b8fcb5a-c4b0-4379-bcbb-f89cf3490b06", "value": 908968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723130, "uuid": "2bf4acb4-1d4d-4826-80b0-5235a4f5132a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723130, "uuid": "948b0864-6671-4895-b407-aa43609de578", "value": "iLovePDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de9d20f-7db2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1755686601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686601, "uuid": "9c8efc95-df61-46db-92fb-1da5dec3b56d", "comment": "Malware payload (RemcosRAT)", "value": "d7226e3de5b3751e978c7dcd622c6e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686601, "uuid": "58ba550a-4e42-4f35-9447-e70eb26d8f76", "comment": "Malware payload (RemcosRAT)", "value": "da5a585527d794604e8acbe3a49ed032d48fd2661171079ba03a76cfa220843f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686601, "uuid": "72711e2e-a764-41aa-831b-496c5061339f", "comment": "Malware payload (RemcosRAT)", "value": "0bdbfd506e6656f3a0289001f49fb1b9191b1470", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686601, "uuid": "3fa94b1a-75c9-4d2f-a88f-62ddbf926193", "comment": "Malware payload (RemcosRAT)", "value": "46f3610fde23556ffdc4323bb616a64ec1898f93b2899e09dc57be2af13444d2b26da21413a5b9ee8dac200dde2a1c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "klm25-zapto-org", "colour": "#CBE217", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686601, "uuid": "855d93d8-261b-4a15-9a38-65e5db7d9f13", "value": "T104B4AE01B6D2C1B2D57654300D26E775DEBCBD202836997BB3DA0D57FD70180AB2ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686601, "uuid": "9f1efd29-9528-4d1d-b1dc-8ebf761383d7", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686601, "uuid": "43d579bf-4edd-415d-b0d0-c54bfdbdbf5f", "value": "12288:fvVTj8Zv1VG/V+vuwrBazq6vO6iTt+sPZKJ:H9ktVqV2Gq6vO6cttZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686601, "uuid": "0e75f65d-7534-45ab-92a6-a113dc3412bb", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686601, "uuid": "e4132abb-5b86-4424-86cb-32613931e35f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686601, "uuid": "d32e8ab3-cf5c-46c9-9cf2-2d139d555095", "value": "da5a585527d794604e8acbe3a49ed032d48fd2661171079ba03a76cfa220843f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b439a1a-7dfa-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755717386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717386, "uuid": "13faa879-88ab-4a4e-9449-de4725bf03df", "comment": "Malware payload", "value": "e4b2a18bfba95c3bf4fd54b8fe05aa79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "waspstealer", "colour": "#EDEC98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717386, "uuid": "f924e550-d760-458d-a779-b364998ab375", "comment": "Malware payload", "value": "db38899d0558b862da2d0c819c6fbdb24ef14c9a4018aa4bda7014709a7f850a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "waspstealer", "colour": "#EDEC98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717386, "uuid": "538e38be-1a4b-4a74-8156-65858759473c", "comment": "Malware payload", "value": "454af7ff137775e65a676f37bd94b58a68499140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "waspstealer", "colour": "#EDEC98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717386, "uuid": "b2b5c262-e650-450d-80a9-caa89e3005a9", "comment": "Malware payload", "value": "992acc051da63a9a50d607de6e52ac6c35101026dadfec4f8dd71a1ba4e20d446197dc5e3d8515765732cb803a692b2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "waspstealer", "colour": "#EDEC98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717386, "uuid": "2d04b305-e325-47f8-846c-e45de1b59ee9", "value": "T191E6330CA3E016F7E8F3957EE9B3CC29F22879AA1F73C4C747A052662D135E15538662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717386, "uuid": "2083cdbd-3549-40be-809c-50c5ccc33849", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717386, "uuid": "1eabbaa9-dc84-48dc-81e6-dc6a35f9d001", "value": "393216:E85vzC/UXMCHWUjqVg74wXugWUWOcMPYBSWgSp:n5vzeUXMb8ODwXu+5TPYYWgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717386, "uuid": "9f0fffdc-c02d-4680-9969-e9593e128f91", "value": 14482046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717386, "uuid": "bf5311d4-a8eb-4a60-9b07-fe1a4eb9fbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717386, "uuid": "7c126fb6-c786-4a1c-8148-5bb5644e894c", "value": "TheGameOfALfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daa713f-7e02-11f0-91c6-42010a9c0006", "comment": "Malware payload (Plugx)", "timestamp": 1755720961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720961, "uuid": "dc055137-81ec-436c-adb9-ad88e9dafddd", "comment": "Malware payload (Plugx)", "value": "2f8e853b25458fab9fd244fbe19ace33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720961, "uuid": "491a330f-0235-445f-b4ea-bccde25a3415", "comment": "Malware payload (Plugx)", "value": "db3e3e3e6e836405c6f5accb97a290645365bd3c36db310259103fbc50e39e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720961, "uuid": "cee91662-99b0-4bff-bfcd-9cdeaae75da1", "comment": "Malware payload (Plugx)", "value": "61785185e59182d8e07b041f6055947bbdbc2580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720961, "uuid": "47ae49ab-53e7-4066-98ec-0ff8d3fa77ae", "comment": "Malware payload (Plugx)", "value": "71b35d8670ed07c2e3739efe219b84797fa1d5dec3feb310a0764d5f38429125d4ddc64eb0e18618096898d917f52801", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720961, "uuid": "862dde2a-e8ea-4ca5-95ef-3d4e0a8981f0", "value": "T1C9E74942A6EB45D0F9F7AE3155F652274537BD066F3184CB620C1B2A5F332E08A73B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720961, "uuid": "3685d800-47a2-4209-9f65-c1e5957912a9", "value": "6349935017fab6295626f276167fc0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720961, "uuid": "f115485d-ec5f-4415-bdbe-1436d100acb1", "value": "393216:fgO1vAM4wCChmN4og3J0CzGFbyjCujm6KI46B5RVs+p+kQ2SR7rGvHvTUlAX6/Nd:YO1/4wC/K+GOShrsxwbE9AM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755720961, "uuid": "45669a1a-4f54-40cc-a24a-a227f68fa0e6", "value": 64546271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755720961, "uuid": "96102fd2-4268-4eb4-82bf-52f6a523a320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720961, "uuid": "69a991c8-4ed4-497e-a99c-2842673a46a7", "value": "Echelon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d01ccf-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692492, "uuid": "ee7e62cd-717a-4232-a943-8885826eebf1", "comment": "Malware payload (LummaStealer)", "value": "00a4c8a014786f525c9192bfbbf6e514", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692492, "uuid": "ff69e0ec-d9c3-4267-9847-ebe91e02267c", "comment": "Malware payload (LummaStealer)", "value": "db435e2a44fee3053b98a0111e4dbd4e312a213e6a31cb909ead13733921e05b", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692492, "uuid": "24bc1020-91df-4d07-b33b-0140c09f5ce0", "comment": "Malware payload (LummaStealer)", "value": "8e848235ae7706b9276b3cb8e7a83430030cef17", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692492, "uuid": "2aa4140c-cb4a-4835-97e6-cf34d7f25d6f", "comment": "Malware payload (LummaStealer)", "value": "3212412c1925a9d68a0883f4c7a942c73651e0eff935c4d5484d139f4d383823ef024a27a3d86cb7dce4731175d6d372", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692492, "uuid": "d6cd70fa-0e99-4aae-91fc-7ff6b8ef7ca1", "value": "T1582812DEA27852093F5746ED31F88E231B3FA0CA75D874333A74E5286AA5B71074931B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692492, "uuid": "4c154204-35e0-4c05-9dda-2da794c99214", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692492, "uuid": "e7f3848d-fab7-45c3-8020-be3d1667abb9", "value": "24576:RVDATV2yrKLfFBWVMSiZxkHGhSPAFvF9um0rhikQWbkC146dRn3sxVCL2t:R2luLfTDAGsPdBrEkQWt146Uo2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692492, "uuid": "8a952714-8368-476b-b2c5-ff357bbb4307", "value": 99614707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692492, "uuid": "e7513be9-d80c-44c3-92d7-e9af3de8cdaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692492, "uuid": "250b00e6-f71d-400d-90ff-330020303d28", "value": "\u22b3\ud83d\udd38 \ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304e6eb3-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755671439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671439, "uuid": "65c7af4b-c0cc-48be-b5bb-360c0ee0509a", "comment": "Malware payload (CoinMiner)", "value": "85bbb74ebca7d8d8fb18a9db9e2165fa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671439, "uuid": "dd27d008-9695-485a-9c5c-19e1915a1f68", "comment": "Malware payload (CoinMiner)", "value": "dc65c3c7c5c84c224d878cb0957052bc43ab56996dff8e1d5ed7973becf7bc5a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671439, "uuid": "8554ff99-4466-4623-aa47-e4e27302f994", "comment": "Malware payload (CoinMiner)", "value": "47883b71909bdb9aba9afa306721e3a45697cc5b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671439, "uuid": "5e888719-200f-43f9-96de-5a442aec78d9", "comment": "Malware payload (CoinMiner)", "value": "e5d1543bd702cfd47c1ee5445bf8787876a525a4be695965527a011336c2710a81ff6ffdc7ab3cbfadddee8322e5a7d1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671439, "uuid": "997b8d93-1ee8-4455-9519-ebeb25580357", "value": "T1826633466440A2DBDC6855FA5B1BF502815FBB3DFFC76B13D2EA8D9F07E8182B501A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671439, "uuid": "b6990750-6b0d-4553-9fb7-713c971fa5b7", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671439, "uuid": "a153dcdb-bc7b-4321-81d6-3fcc5d5d5ba0", "value": "98304:JwSdmpiICEYSKsJOjg6SwhwBrqwCVuzVWCBCvy6wAZ9oBybnEPVp8KuR7i:epiIjasAVhiyVu5WFrw9Ban2lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671439, "uuid": "e581b905-bfa5-4f97-b20e-ecec252b8c10", "value": 6566416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671439, "uuid": "27d91d11-d0ac-484b-b2c3-144cf8fc570d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671439, "uuid": "81cbaf40-13e7-4c55-aaf5-941545a2eaa3", "value": "SecuriteInfo.com.Win64.MalwareX-gen.94446143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc9e79e-7db8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755689181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689181, "uuid": "630b0e31-6325-4ce1-85fb-40f74f705bf1", "comment": "Malware payload", "value": "e56e4f5f1ba93a49a4d89db309fe1e3a", "object_relation": "md5", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689181, "uuid": "d2c9cc2c-712a-4bed-a8e8-27aea9475f4b", "comment": "Malware payload", "value": "dc942f9d89f87fab2310ae1e4568c09440b531446ae808fef03585fdfa58b2a9", "object_relation": "sha256", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689181, "uuid": "3170140f-e5bb-4b09-af15-c6c27e133f75", "comment": "Malware payload", "value": "b30dd849146998f09dc364ca358f69ad9a415455", "object_relation": "sha1", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689181, "uuid": "6b529da7-405e-4823-8648-c5de730a0f74", "comment": "Malware payload", "value": "9cbeaec0c12465317e654924c7a8eac4d1b89e8af2ee7c50c8f78a7daa28980033208a34bbf044c9ce50e079c17a0951", "object_relation": "sha3-384", "Tag": [ { "name": "3-144-37-134", "colour": "#94A70D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689181, "uuid": "9c2416c4-f2fb-4e4b-8eeb-b3f03c10f73f", "value": "T1E975063F72A8D26DC12EC13AC1A29F45F433B4B58B73C3F7929442649A06DD65E7E260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689181, "uuid": "cfe48a73-61a7-4ca5-a8b3-080b280450be", "value": "edf79819a7f7acf21cb6a46b1cf6b3d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689181, "uuid": "f42b7590-3d84-4738-acbb-3fad7bd42d06", "value": "12288:EUrke216s4T07kBUh0K846Bn6TLGa4jn4BETaLuJgoff1WtG0zbBJyR60OxLOuws:EWRs4In7iBn6ma4jn1f1W5Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755689181, "uuid": "8784ceb6-051e-4411-bcd5-c73f4f650446", "value": 1696768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755689181, "uuid": "1ccaf4b1-1cab-4fbe-8b57-9cbd214d5226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689181, "uuid": "64514c43-f969-4b92-89d4-8cc58f1f054d", "value": "dc942f9d89f87fab2310ae1e4568c09440b531446ae808fef03585fdfa58b2a9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f467303f-7dc4-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755694531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694531, "uuid": "2384a831-dfbc-4c51-bc05-c95c581bf62d", "comment": "Malware payload (XWorm)", "value": "fb9376eaf838223e5361854cdb9485cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694531, "uuid": "0508466d-0593-4a8b-a731-b29e4d66dae7", "comment": "Malware payload (XWorm)", "value": "dcc9538effe19a635714006044a83e9ab84b0355d28c07d819c44e879207b363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694531, "uuid": "568118d1-686c-4ad0-8904-2b4c297f01bf", "comment": "Malware payload (XWorm)", "value": "efbec494052d095488616bb43f4f1c0c1274d13a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694531, "uuid": "faf3da6a-b63b-4687-a899-2b8498b89084", "comment": "Malware payload (XWorm)", "value": "10aa442dcd81fb8cd19af12bdf331c9542c1a5e8b03edbb93914bd89ef0ec07ef3fdf2724195f843ddebe9b5978a1ebb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694531, "uuid": "216e5411-3b95-4395-a418-c51b09540346", "value": "T115F24C083BD44225CAFE7BF96AB371021674F5039913EB8D4CD899AB6F27BC045143AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694531, "uuid": "9c0a3093-a384-4c88-b1d8-234387a30490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694531, "uuid": "263b534a-28db-4507-8b19-528d9d3dc357", "value": "768:PLeNTDF/a/vzxcOMObFJ9YFfOMhD3lzp:PqNTDFy/rVMaFJ9YhOMF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694531, "uuid": "7a478380-b899-4fef-8830-44b02ac274c0", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694531, "uuid": "33f3438e-49c0-4bf5-b52c-329f4184fb55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694531, "uuid": "9a26c7ac-7f6b-4116-ab67-8d2be079d4b5", "value": "fb9376eaf838223e5361854cdb9485cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5397f578-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755723038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723038, "uuid": "35476269-de2f-4436-9432-ef1f9b77e9c3", "comment": "Malware payload (XWorm)", "value": "70463ca4d4999f3f343a5cca1faafe9a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723038, "uuid": "27a3a06e-6f56-442d-b882-6ed7161a60ba", "comment": "Malware payload (XWorm)", "value": "dd571605c43f67c667cf409ddffd8fadbe022d45239f7aa61e584f0c2cd274f4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723038, "uuid": "f7ddede9-48ed-4076-b13f-edced2dc82d9", "comment": "Malware payload (XWorm)", "value": "f41cd96fa1f7b41b08d9b59303dd841118aae947", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723038, "uuid": "913e7950-4909-43c7-aa57-98037fed304d", "comment": "Malware payload (XWorm)", "value": "aa152bb69fc4cacecdd6b5724e5045575deb52ff41e3eb33aeebc0f0f8ab115def1f1656d1e3e06866998fdc2badc3b6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723038, "uuid": "02348513-f01e-4c93-b9d6-2edc5969e465", "value": "T1F02419BCC9AEAEDC43BA30EA592E3342104D07A3F6B90B1CF5C055AB186444EDB79759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723038, "uuid": "6fd3c5fb-e3ae-4cc4-a9d6-94431410ad78", "value": "6144:UC94qZb+l3UXtLFWB2KU5mpIOJy0gRw1Jhmh:b1b+mKU5mpIOJy0gRw1Jhmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723038, "uuid": "2cf45fc9-cb30-4979-a9f7-2f0c407d2a6f", "value": 214402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723038, "uuid": "40387ba5-bf29-4b50-b7c3-629868eb42ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723038, "uuid": "ac84cd7e-b24d-496a-8329-352bf5020ecb", "value": "NEW ORDER -MUJICA RAILING & FENCE INC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99b0d61-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721544, "uuid": "f74b4601-5052-4fd9-a120-1ade0c3db828", "comment": "Malware payload (Mirai)", "value": "3976d218fae2d9fb078fa9e70a178d89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721544, "uuid": "49f94be0-6ba4-49d7-938c-9d3396f5db53", "comment": "Malware payload (Mirai)", "value": "dd999ce4ac491a15e28dc0f7e2371a3da21d8abc2c040b274b01ff7f473e6867", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721544, "uuid": "72fab613-e76c-4165-809f-11c1a972565e", "comment": "Malware payload (Mirai)", "value": "7ea5d3fd6c31a34a447c74dfb03ce51ab3bb53ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721544, "uuid": "632f17a7-a167-4945-96a5-2f430b74856d", "comment": "Malware payload (Mirai)", "value": "886e1bc27fd4a84ca0e09d2e10cc0421fb88ca1e544dc96bcad23020bb6633fd53352a476b8dbc1b89a6b25b074cb310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721544, "uuid": "c77e0a02-03a7-46ad-b13a-6ec208351fce", "value": "T106C2E198274919E9D2F9C17C47781B6C1DB40B66F809DC8278F8F7629D8A4753017EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721544, "uuid": "6cd08abe-1fd9-4f2c-ade1-cfbeb8bfb36d", "value": "768:I2G214DFyosXqgvV9o1ndB08+lJgGlzDpbuR1JI:I2GdDgosaaO1ndQVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721544, "uuid": "c5e8eb7f-eb98-4f3f-b9e2-cdb9f2a2cb10", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721544, "uuid": "07a75e94-9d8e-4578-8167-f8022dbce17e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721544, "uuid": "432ac3f1-34d2-48e8-a856-144f0e6b2035", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105d1e71-7db0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755685559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685559, "uuid": "5829f464-26eb-4f9d-a59a-83ca01183a61", "comment": "Malware payload (LummaStealer)", "value": "d0fd60788b9cc7ea30d3260525f6a591", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685559, "uuid": "dc33dc91-9d8a-4586-8ac1-fa8900a2820c", "comment": "Malware payload (LummaStealer)", "value": "de6d15c59403f371a073bfd959500a515496e90014f51ccef4df3130e0aab91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685559, "uuid": "9db1d051-cac9-4d7d-8ba4-2617b4cb3d01", "comment": "Malware payload (LummaStealer)", "value": "5ca6e900ef98a0b9a708d21234a791c55de77ec7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755685559, "uuid": "00930820-f329-471b-9c75-ebd4b0ced0d8", "comment": "Malware payload (LummaStealer)", "value": "277f7ee6660b58bec7ff81b7d1da2233284e0f484cd1cd206ddd0bd03e162485f94cb4ef558dea917dfddf7e2e78ed51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685559, "uuid": "3ee2040b-47b2-4aa9-b8a2-26b55914607d", "value": "T1FD45C004D87970DAECD74071AF765201F8327D7F4F242AAB51DC96B01A5AEED0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685559, "uuid": "a6321b05-fcb3-42a3-ae76-0475f8ef6afe", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685559, "uuid": "fab80672-c8ed-49b7-a861-77b194dd0b3c", "value": "12288:6CzxSeT4ZAtm8eKCk0zbVYmdh8EWcxassWJt12KfISmUjRQnepMoCDtm0nDj7aA5:6qHhP0Hccxas/JLDBgxI0DKA39r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755685559, "uuid": "5d59f7f7-f199-4bf5-8787-a68822ca50d0", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755685559, "uuid": "9e650869-bff5-476d-8f07-18c07377c0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755685559, "uuid": "7b9c10a5-427b-44d1-a142-d9416969a46f", "value": "LauncherV8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abfa43e-7ded-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755711963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711963, "uuid": "a5dd64a3-cb7c-4f3d-8daa-ef91ead436b4", "comment": "Malware payload", "value": "cb653bb39fc8b0a4201da1123ffcca20", "object_relation": "md5", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711963, "uuid": "5b186b08-a8e8-4717-a6bf-9853fca951e6", "comment": "Malware payload", "value": "de737b00039e0998b87838e099b1223c34202740e096be1905b998fc6f1840ea", "object_relation": "sha256", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711963, "uuid": "47e2dc45-68c2-45a0-980f-c2ddcb56bedb", "comment": "Malware payload", "value": "52996b3e02c39d51317aa95c5b04d989a08b13bf", "object_relation": "sha1", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711963, "uuid": "3e3e4c65-b349-4451-b0a1-13dce3532bbb", "comment": "Malware payload", "value": "c2986b3ca49a7dcbca20832ee4ee3734567bdadf575d9c03b08a6a293ddf9baa2805a9a7c77ef7055fb7cefd8e6d982c", "object_relation": "sha3-384", "Tag": [ { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711963, "uuid": "65dd30ae-aa84-4a18-9315-a24806eaefbb", "value": "T11AB633E3C5A7040BF923FA35D660D94D253C5391B66CB0FF881D42E5BCA94889E6DC2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711963, "uuid": "8274ef2e-0489-47a6-8dde-3d717013a958", "value": "196608:RvKpZlfHaLfUQMGveaMckIWFWqQ7GQMElfE1xc8KtBrM8:9KpDHabUQf2lckISW1hxNtS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711963, "uuid": "55a87e81-756e-4916-b264-137735b436b2", "value": 10511616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711963, "uuid": "9d23161e-f3c5-4183-a88f-832ef3dbddff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711963, "uuid": "d3b4cae5-ccf3-49a8-be2f-bd33f676349c", "value": "x86_boy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083f8355-7d8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1755669224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669224, "uuid": "844f4852-aa8c-497c-b6da-d8e4092edf99", "comment": "Malware payload (DiscordTokenStealer)", "value": "bbc57624c17d0868fc697d9730f09e71", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669224, "uuid": "296fc6f1-d7c8-4864-8803-c88a0f9105e7", "comment": "Malware payload (DiscordTokenStealer)", "value": "decc04659e75a1461535ea4726cd4c2c82384e5d5142fa9c4614dc76ed62215e", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669224, "uuid": "5c86d54d-05e3-4624-a7df-e2a0a52cb325", "comment": "Malware payload (DiscordTokenStealer)", "value": "fb6a6a1a75de6e27f8a71474fda12d3fbb7523b3", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755669224, "uuid": "44f194f1-d0f4-4d05-b577-2538700bf121", "comment": "Malware payload (DiscordTokenStealer)", "value": "7cc54b7b36eb733531c7a1a7250d65e7f90ab062d98a71e197af43904ec2245053fcaea138b630e025d175195157c4a8", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669224, "uuid": "339f037c-5ed1-4ae0-8454-8802234ba315", "value": "T1849733DA1E5700CAE8FB973B639792256AD37CE64764D08BA7D409020F676D0ED78F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669224, "uuid": "ba426048-c879-4cc0-ae64-e746d36ca400", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669224, "uuid": "1115a27f-e5e6-4da9-87a1-935023e0ec2c", "value": "786432:sKRCW817uwq3ObRqza1QtIxhPA5HDwD/iJCuAzKsM8ax6kCI6gxcDGLY:rCWKu3CRsmiIxhPyjK/iIZ+y1xg3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755669224, "uuid": "880d1901-8e0b-430e-bdb2-9a4579ca69cc", "value": 39999791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755669224, "uuid": "96b1b442-3830-4823-904c-e199d09d25c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755669224, "uuid": "c1b6a791-33c4-4411-99c3-171fcb75ccba", "value": "ChromeData.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd42166-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721552, "uuid": "00f42fbb-bd3b-48d5-9f61-e5f308e1a53c", "comment": "Malware payload (Mirai)", "value": "7be1fe2af1a85d3c9d84c02fc104b3a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721552, "uuid": "ff36d7c7-d350-4254-b280-0dec6c670413", "comment": "Malware payload (Mirai)", "value": "decd3b610fe3660d17f609507f8d2ae566686311ccb79707cfb1282ceb1c9fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721552, "uuid": "42cc26fc-a894-43f7-a3b8-1f7b67095e91", "comment": "Malware payload (Mirai)", "value": "7e7b039e8624162d143f592c8461e2d71216832e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721552, "uuid": "0acb1b65-4938-4a02-9046-2bb0e5ac0d28", "comment": "Malware payload (Mirai)", "value": "6401012d705d47e47b5812d1cf709dbf09af4fbe62673260ca65de39d959e711479b7cf5cbae984eecca0638f2afb6a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721552, "uuid": "06334feb-0ea2-4cdb-8a58-810182b02f52", "value": "T18BA2D01821CDEA32D1B0843BE13CC347EADB83B652FE317A1E18079DE49191AD3BE945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721552, "uuid": "f7a28ff6-6c3b-4ac6-a075-18ac492f55ab", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbr+hymdGUop5hXo:YDgoh/DxCvhdR4IjWVFbS3+s3UozJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721552, "uuid": "0812906e-8341-400a-a7f4-8f0aa9a7f9ce", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721552, "uuid": "1e6fff48-0002-464f-9c1c-fae469ae6500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721552, "uuid": "4e201879-5e73-4d3a-a0af-b0cb1fc7ebf7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac12703-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700743, "uuid": "dd063606-8a44-45b3-810c-da19f336b218", "comment": "Malware payload", "value": "186d431f5644ca3e18f6a9fa8079e92d", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700743, "uuid": "cd9aa611-865a-4237-90bd-ee07b9dc989e", "comment": "Malware payload", "value": "dee444eb2ec669cd75e0758056ce6815a4b0b579ad2cb1fd3a313da3b7e3790a", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700743, "uuid": "6b8ce098-d6a2-46f3-9d19-be49a565347d", "comment": "Malware payload", "value": "e31e28a6b2c9464387983f83ef5742079da1145e", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700743, "uuid": "5c2b9018-ab89-401b-9473-27f6938aa020", "comment": "Malware payload", "value": "91d3079ae08a9a398a0b8a3346536274bae1ca0e429f6fce115db5811835f61b65e801198a8b0be3218c177fd5137633", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700743, "uuid": "e0398bfc-2a87-4083-9d9b-257474bff849", "value": "T178E59D06FE5EC2A1D6D6407A11BE5F3A4E368924C328F5D3CB913869BB635C0963E35C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700743, "uuid": "0f4ea41f-21da-4cb6-b449-e4260a8be607", "value": "7825ee458b18bd59b5d805e41ab6e96c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700743, "uuid": "81cced74-a036-42a4-9a24-281b7d22c27c", "value": "49152:ILrxD4IMIn5ER8yXcFr10D5qZp0PoayTz03H93HOF6VKBHanRJJi:ILrTDAIoITay0393WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700743, "uuid": "757afa63-d348-4137-af59-5798f1503a9c", "value": 3190024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700743, "uuid": "85e44cf8-c7b0-460a-8548-52a13719f029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700743, "uuid": "13a304a3-d2e0-469a-a5fa-c8499efd73ff", "value": "dee444eb2ec669cd75e0758056ce6815a4b0b579ad2cb1fd3a313da3b7e3790a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed96402-7d5a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755648700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648700, "uuid": "a70fd7af-f2dd-4ab5-8692-7b09bce0f1ce", "comment": "Malware payload (Amadey)", "value": "a6a5ba8f632d44f412d67853a06d0e91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648700, "uuid": "efa08f59-f8f9-496a-85af-ad04e2bcf546", "comment": "Malware payload (Amadey)", "value": "df70100bf3ccb387480e90587a270e09313cc75f0c0cc6f19831b25f7451d5d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648700, "uuid": "dfc0046e-5fd1-46c0-a381-ef8107547654", "comment": "Malware payload (Amadey)", "value": "3cb99483bd7869ff0872142cb9e980632819b2c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755648700, "uuid": "9c243e04-a5c0-4464-9d20-acd62f17ccfd", "comment": "Malware payload (Amadey)", "value": "aa5496e2e4a72602890d2926b1d9fdfed62d0a460d93d969f7692eb6d56638c8aabcfc6f9c343399bf72c4772c167bb8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cnr-software-ru", "colour": "#85B569", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648700, "uuid": "62839a3b-22b0-4bef-9e1d-d6522f40a588", "value": "T15C85230C5FED3219E6EC06B688E0A75865C6CA58F525F73F0DA074789489FD83B09E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648700, "uuid": "58570c36-6428-4a17-a196-92fb4e5919f0", "value": "24576:QiOQjk9OiwrbwDzrgIH3vizsI1i78zsDohP3sMLQCJskssibR/cjcrqNKdl:Nk9O/wDgIPI03omXuHsTbROjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755648700, "uuid": "37cfbe33-b7c0-4599-b9c6-19e6e4eb89aa", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755648700, "uuid": "d3a71c58-d10c-4fe6-8cc5-6029f41a7979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755648700, "uuid": "ccd8f97b-1e3d-4fde-8b83-2c48d707b77a", "value": "df70100bf3ccb387480e90587a270e09313cc75f0c0cc6f19831b25f7451d5d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90eecee-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755697411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697411, "uuid": "f76959ec-ff93-40dc-9c24-c591e1c0d546", "comment": "Malware payload (LummaStealer)", "value": "813e52682ac6e09357cd7f684febb4cf", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697411, "uuid": "bc385e85-924b-4b2a-a099-9c28e618816a", "comment": "Malware payload (LummaStealer)", "value": "df8a790d84cff513666c6d01fadaf2bc23e029150f3d26cd9798c003328f8fd6", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697411, "uuid": "27979572-2212-4092-8878-a66b5466486e", "comment": "Malware payload (LummaStealer)", "value": "d5ea279df64250a4611e26afc4c74b2c2d168a15", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697411, "uuid": "ee376259-4b0d-4cd5-a086-9226dd61d2fe", "comment": "Malware payload (LummaStealer)", "value": "14629dc2a2e1d3767e7971abc7651a358670e5ee6fcef752c049523a4cd63faa6ed4b5d1e958ea31d6c8cdc48982bc7e", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697411, "uuid": "c5955b49-6f18-4a6a-b87a-8287e3b68c72", "value": "T17A2734E08B44B2666F871852229261DDC0FA449A3612172EB736EDBC534C199F7D33EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697411, "uuid": "f69c4e58-5c49-4096-ad53-2d721908b3c3", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697411, "uuid": "04491173-5ee2-405a-bc7f-3be408c16ee3", "value": "24576:jVDvU1lAYQ3+OcArbV1Q1c2yQpE7Kzu8qdzHMk1erpdlpcx7x:jGldU+OcAQ2x7Iu7MTapx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697411, "uuid": "db138ba7-0d90-4795-8152-9d3cf8951f1c", "value": 20971506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697411, "uuid": "b0f28bcb-2c5d-46bd-a03e-a64cd549e3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697411, "uuid": "a059dbb2-596c-4d65-97fe-79f5089e317a", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1ba71d-7d9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755677314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677314, "uuid": "9d50965f-885c-44e2-8f57-702194741363", "comment": "Malware payload", "value": "324f208d2780c76419ea853eb5aed88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677314, "uuid": "8c19f465-f13e-401c-aa71-eb32380514e5", "comment": "Malware payload", "value": "dfc7ea246a14e77ff04a324f67544cf6b81ac71d21a20015018c33cb5663aac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677314, "uuid": "01eb0ab0-e8c2-4e0b-bd5f-8f9bc989cb6f", "comment": "Malware payload", "value": "0404efc3189aad17e013a6a650944316c4b3a243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677314, "uuid": "1cd0926c-7806-4eac-bca5-bd276ed8f681", "comment": "Malware payload", "value": "828c75945ac386bd0221a82f54c8f904a382b42700900d7503a6a77c9b3f5fd6d8749ff0a18bf3887f7421e96fb982d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677314, "uuid": "f791ec9a-5e07-426f-8922-350415941d6c", "value": "T1FD087C4263E609D5E9FB9A348AE65213D673BC067F3086DF324C172A1F736E08976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677314, "uuid": "335e4ef9-820b-4c8f-a526-82cea2b15d51", "value": "cce1b27dcdd3bb731f7ca33eedec725b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677314, "uuid": "e737bb93-766d-4315-8056-a165363cfc29", "value": "393216:vn4GveXJiVlkkCx7mRynvVnYo+A3HZC5r8dgVRsfQOKGwkRfCPe9rLtIg9bhPhxZ:vYOhqiqfnJJF2gLPkoMWutgPdBsiYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677314, "uuid": "5b87e493-2c07-4afd-9a53-8341a0962712", "value": 83799875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677314, "uuid": "30db12e6-3e47-4c0c-bddf-8d7fd23729c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677314, "uuid": "434929df-0fcd-42e4-8889-3cad5cb333cf", "value": "Crystal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa568c0b-7d9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755677656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677656, "uuid": "2fa7e6b8-1ec2-41ab-a26a-6cdecdf3898c", "comment": "Malware payload (Rhadamanthys)", "value": "d4b231315a2d874846fd93311a37d88f", "object_relation": "md5", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677656, "uuid": "f2d858e3-e2b2-49d4-910e-0aa7c50dc2f4", "comment": "Malware payload (Rhadamanthys)", "value": "dfefecdf2c569ef791a177e51d1927067b763b92780750e990455f7518ae8ab7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677656, "uuid": "e98a3208-6b03-4434-813e-fbbb5d5c3613", "comment": "Malware payload (Rhadamanthys)", "value": "c2dba78abffb7f55c66d2599d6ea2ae26421b7a6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755677656, "uuid": "47fd16e3-c08d-4bcf-aab9-fb3b8fe003a6", "comment": "Malware payload (Rhadamanthys)", "value": "1f4bb7e70eb361952a21151e20aa646232a16b5eab2ecd1e8199c074018468b8aa906f4c444e584bb8da61c95580b160", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix-Stealer", "colour": "#4663E9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677656, "uuid": "7a1becd2-b57d-4837-b2d3-82058e607847", "value": "T128C63314A5E9CF14E7973A3FE7337F58C93F0C422B81421639DD7CA869B969C0E1912A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677656, "uuid": "fe4b9d06-44ee-48ff-bff7-8636fde3f5ba", "value": "196608:n22ik1oEkFBFp7zJe5oa4L+A1aHWCw+cwK1EHNZAlSAvqKVLcYU4RWmM:n2291OBX/JkodLRaHWCJctkZAlSs/11h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755677656, "uuid": "6b5d17f8-cf15-41e8-a844-f33566e2b9e1", "value": 12357632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755677656, "uuid": "8666b017-da61-46dc-91d0-f80731a21c1c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755677656, "uuid": "c1f85070-c519-431b-b9fe-98d7b7ad3d66", "value": "dfefecdf2c569ef791a177e51d1927067b763b92780750e990455f7518ae8ab7.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d9896f-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1755703367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703367, "uuid": "43bf0c46-6ab4-44d4-bae1-5b5a20a28e58", "comment": "Malware payload (RedLineStealer)", "value": "5f85b9eca6c9f0ddea551d99fa9dbc8d", "object_relation": "md5", "Tag": [ { "name": "5-188-166-78", "colour": "#8315F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703367, "uuid": "21630cf0-814f-4400-8074-2457b2ebe951", "comment": "Malware payload (RedLineStealer)", "value": "e12ee7f81b36119f286b0aef02de51905a17c14433a37439f089e07baf3044ce", "object_relation": "sha256", "Tag": [ { "name": "5-188-166-78", "colour": "#8315F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703367, "uuid": "023efe47-94f9-4e8c-a84d-0b4663bb10ca", "comment": "Malware payload (RedLineStealer)", "value": "68ab64797e2fefd564b145c24fab5b2561eaa352", "object_relation": "sha1", "Tag": [ { "name": "5-188-166-78", "colour": "#8315F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703367, "uuid": "f43f9da6-913a-46ae-bb76-3b6f1f93f42e", "comment": "Malware payload (RedLineStealer)", "value": "a548b2764384b277fc2adeafd3cf169e4449e14b96f5aca6ec8aedd095d337cad10168b7816611563a081a7450e1d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "5-188-166-78", "colour": "#8315F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703367, "uuid": "4f42e6ce-3016-4cac-b8cb-2670d595c562", "value": "T148645A5833E8C910DA7F4775D861D67093B0BCA3A552E70B4FC4ACAB3D32740EA51AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703367, "uuid": "36306232-6f1a-4f49-a955-992d1dd523fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703367, "uuid": "b0b62010-9792-43c4-9ba1-f3842da94af8", "value": "3072:WcZqf7D345p/0+mAokyOppAQUg2ZB1fA0PuTVAtkxzg3RIeqiOL2bBOA:WcZqf7DIbnHrz6B1fA0GTV8k2IL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703367, "uuid": "ed6949d1-ebfa-435c-97f3-667c0acf88be", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703367, "uuid": "cf0f3c05-f699-47c4-b9ee-ca8d82250098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703367, "uuid": "3f41052c-9350-4ad8-a85e-d2851eace390", "value": "jh8ta1W.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d1e21c-7d99-11f0-91c6-42010a9c0006", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1755675669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675669, "uuid": "2d24a3d4-6579-41ff-9180-285af61abb69", "comment": "Malware payload (RedTigerStealer)", "value": "22c0811c4fcece3096345fcdb79bf7cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675669, "uuid": "5d991759-c377-4ec4-a042-341bd5b0eb2f", "comment": "Malware payload (RedTigerStealer)", "value": "e1375fb2dd443b53e4f255c045a9d2ced72f1251d9ac02c704e6cc335e700999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675669, "uuid": "912ef506-2a6e-469b-9a0b-c0e972bc1217", "comment": "Malware payload (RedTigerStealer)", "value": "a6e63b85e0690c5fb78ff27df95b13f15acfc489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755675669, "uuid": "4191e7a9-f561-4285-8d15-54263c640372", "comment": "Malware payload (RedTigerStealer)", "value": "d1decf0d248f8bfead4a2874540717fc7184561f4b2ce010342bd93bfb63d7ea7c8bd041808571bcfb8691215145fe6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675669, "uuid": "6016b5d9-c7ad-4781-811d-b62ea2a65648", "value": "T18108330EF7D02D58D9C343760616ABC6AB18BE080759490A93F4FD2779B369B4CBD9C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675669, "uuid": "3b40cf33-d61a-4b59-9115-f642e99c8325", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675669, "uuid": "4c849d0d-a5d5-49d2-9fcf-f438fbf994ce", "value": "1572864:LPas/X2heCgEWBUke+Ub9jETHPQmMpnx9luHY7otnq/29cSoeSqjHo8F9COdDy:zPCgEWBujcvPOn364PeSqjHxCOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755675669, "uuid": "a8e035fd-6a26-41e9-b4e5-0e3fbacd383b", "value": 78837237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755675669, "uuid": "7c35c303-0225-4a24-bfa3-03cccbc774fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755675669, "uuid": "8fba6955-3320-4083-85e4-26f2431aabdf", "value": "Susano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f524a056-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755703552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703552, "uuid": "6efd7950-fd8c-483b-8d22-52058eb0f7da", "comment": "Malware payload (LummaStealer)", "value": "f2642117458898700b711c42223cbf1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703552, "uuid": "723d2b97-b3d7-4335-8a64-4fb07bb297e0", "comment": "Malware payload (LummaStealer)", "value": "e15886e3c6af9edae546b18f8cce879de2773538cebd598748af924db890da40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703552, "uuid": "c6f9e85c-9c30-47cc-8fd2-7debd46cac0d", "comment": "Malware payload (LummaStealer)", "value": "a21f48affc8d0c9e4bb028bce03a35cb5987e5d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703552, "uuid": "f20bead2-90c8-44ab-9b09-c87015392be0", "comment": "Malware payload (LummaStealer)", "value": "1b218036be95bec6818f2ff32f068e42656e494668aeb860bc57749921d3fb933e1abe7b07854b1c445dbe9832e9964b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LabInstalls", "colour": "#0BBCEE", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703552, "uuid": "253866cb-50d6-4581-9ba7-a6616f782641", "value": "T13C950249D753A174FA8749F8929EE1FB1B311A26C338CDCBDB94EF105A93BE21034589", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703552, "uuid": "b9562b5e-87b8-4c07-b3fd-c0330cf6cc18", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703552, "uuid": "26c5c21b-8cbe-4342-be6d-0004f321b91b", "value": "49152:R1k6wuv42KCf5SdjezGk4Zer7lbs5QQkss:8uv4ZCf5SdKWerp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703552, "uuid": "40e3c753-947e-4825-acd7-3e9b4c103155", "value": 2036736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703552, "uuid": "e78501ac-007e-4156-9517-d9014b015f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703552, "uuid": "2df8796b-25f8-46e0-8bcd-1e312ea7ee82", "value": "yhxBBcU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a761ad95-7e06-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755722749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722749, "uuid": "481a4179-b049-4c92-a3ea-eac8e69209a9", "comment": "Malware payload", "value": "e9adf5f6b77e5783ac180944ca9dba0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722749, "uuid": "d82e877c-28cc-4727-9efa-cb79569beb25", "comment": "Malware payload", "value": "e18161272c9a6b7fe6edbd5a713b9887ee6c35077e85a8ea0bcde31ef1244344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722749, "uuid": "1c2acee1-5792-4c1e-ae38-91fe83ef2529", "comment": "Malware payload", "value": "ccbc473f98c930b16b6a02a6f1d7a30a3601a83b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722749, "uuid": "bf48a1b0-df3e-4635-90e3-2a1c1c0ee1c7", "comment": "Malware payload", "value": "40ed6a56c3300a702ea4651615417f0a51aa1a463ca09c98ba028eb226aee690398463609b4a22cc0e0b825838a02b70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722749, "uuid": "8799be86-0709-4b3c-bd16-efcdf48e6a72", "value": "T1FB931886BC409B16C6D066BBFE1E528D33131FB8E2EE32039D156F2567DB95A0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722749, "uuid": "059bdebc-5a70-41e4-bfdb-26e1e2356129", "value": "1536:J7nFevOZkE1uLtrTHGvsuZcopwfb3n/XHyQYNENgFWocOrsfET+YgYRV/x+c07t+:revhcuLtrTisuZcopwfb3n/3NliwfETd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755722749, "uuid": "d84e9eb8-52c5-40e8-8751-f9eb4d97841b", "value": 97060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755722749, "uuid": "3ebb0bb1-5389-4aff-834b-b4092f19c471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722749, "uuid": "e8a49434-b120-4839-a13e-8b6ddb1a8cfb", "value": "larm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edaa3e5-7dcb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755697367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697367, "uuid": "02af7044-9d55-421c-b001-453c6f08d2e6", "comment": "Malware payload (Mirai)", "value": "7de88a55dc8c2eaac5c787819aa773c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697367, "uuid": "a027f20c-d7dd-4c40-ac45-2e195154ed34", "comment": "Malware payload (Mirai)", "value": "e1b722e86444044bbb522285f78bef4024c8cbd4aa5bfc48df9bd148e14f640e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697367, "uuid": "99ceff0f-c218-4e1e-a634-ff033ec48420", "comment": "Malware payload (Mirai)", "value": "ac48c46f1c581085c66ba748463e8729244a05e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755697367, "uuid": "6c0f3cf9-193f-495a-9ef9-47e0dc1bc590", "comment": "Malware payload (Mirai)", "value": "d8fe5c88ffd60a7d16984e603a77e6733e67ed4aaac8b061b6982841b8e22ee66fd599d1a972b55a458fc8b1050e5c8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697367, "uuid": "4ab7ad2d-7946-405d-b6ba-ac5e39fe157d", "value": "T193049D63F20B1091C86305F817CBBB9D2D3311826F6B96D37D6A32392A7A4CE1915FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697367, "uuid": "c77e64fb-f42e-48ed-b348-9fb415436c8c", "value": "3072:6Hsu27PMMoaW3+gYdk2czM+vS5CmuFoLXrMV8Wj+zgzC/4wEIpub01MTq:m27kTF3dhFa51uuLrMKQ+CC/4w4Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755697367, "uuid": "f20e23f3-4abd-437a-a4d9-2c8dc1da32d0", "value": 174512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755697367, "uuid": "d06dd637-91ed-423f-a6d7-6f440da44692", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755697367, "uuid": "733d7420-3869-4bb8-be8c-4299e28170df", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef7b57a-7df2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755714171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714171, "uuid": "d77c3dad-fa40-4bb7-9a3b-1fad41667d69", "comment": "Malware payload (Mirai)", "value": "8cd4b62d10989f81425d711988de367a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714171, "uuid": "02269e7a-38c1-4bf3-a790-5b708c792104", "comment": "Malware payload (Mirai)", "value": "e205d74629973041cf1dc777f15c6fcb481fd30cbe6ce4ba1c9f549c4cd38b86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714171, "uuid": "17445173-912f-49ac-9687-c5d1982e4ae8", "comment": "Malware payload (Mirai)", "value": "46168bba0e1f27b434f52bad87efc6ea9076a644", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755714171, "uuid": "16ddb164-8452-444c-966f-e0ec954973cd", "comment": "Malware payload (Mirai)", "value": "278847b306083e28e2eb3f2b85fe0da727c7e04ea475a631e09d5dfd57ef85c33ed80050ea4d2750a2b3876b559b77d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714171, "uuid": "aeacba3e-442e-4da9-9eb5-5debaaea6362", "value": "T17EF2E178839800BEED73D67362D99FD455758E609397D80AB620CAC62BA30E84CD7DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714171, "uuid": "12ff90a4-4765-4464-a76d-3adae46956eb", "value": "768:c+jP2vk00dHBv5jf0vaINbUBAmVqjuzl6Ou8SOm/fLLdKOjJgGlzDpUYs2:cGpHBvJIHNUBAZuR7u8UfLoOZVqYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755714171, "uuid": "a2fabc4a-f1fe-4b04-b862-07e45f34745e", "value": 35220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755714171, "uuid": "34a21617-6200-45e7-9bd5-b802f10177f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755714171, "uuid": "3502ce4a-1234-4b81-b99f-2a5407a76a0a", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe09c2a-7dcf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755698953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698953, "uuid": "9e276748-eeb6-4ef8-b895-49ffa150f2ba", "comment": "Malware payload", "value": "160a80a754fd14679e5a7b5fc4aed672", "object_relation": "md5", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698953, "uuid": "39c13f0d-4e25-4bec-92d5-7517f4e32314", "comment": "Malware payload", "value": "e26efc253a47bf311abff125f53f860c0cabaa58592b3407de1380a6d3170265", "object_relation": "sha256", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698953, "uuid": "38f3a280-0a58-4e10-832b-03e212052bf6", "comment": "Malware payload", "value": "1611bd37a9726a2ecff17de499f6f2b2af16a988", "object_relation": "sha1", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755698953, "uuid": "ea2524f1-a6e4-411a-a761-5d1d8cc8eb18", "comment": "Malware payload", "value": "16c7c2d88562c7f2c75250345cf4e421ed4769f767ac2c1068b31138639f4ae0abc48c62efcc666157e8f1c4749efd93", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-46-174", "colour": "#117984", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698953, "uuid": "58e49ec9-b762-47b5-a53c-e0cd71c3b518", "value": "T10BD59D06FB4280B2D887E0394DA7577A4E3E49168325C5E39BD12DBD88225D2D63F39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698953, "uuid": "9ccfcc1a-05b2-4e62-ab66-e9cea184484d", "value": "ee5ea868d8233000216e7b29bc8cb4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698953, "uuid": "dccb85a5-5c78-4abe-8aad-7ce1c7888945", "value": "49152:uDr9FtzWK5brAK6qn+0QuKnIqjZuD+CPS1xzMHtFKUKB3KH8e5T:uDrVN+03k0+L1KHQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755698953, "uuid": "bf03dffe-4fda-45f1-a433-e7177d38c848", "value": 2888464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755698953, "uuid": "b8e964b3-30fa-4e32-bc9c-6ec20f877e22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755698953, "uuid": "2773036b-9d13-4f7d-bac3-b0a43083015f", "value": "e26efc253a47bf311abff125f53f860c0cabaa58592b3407de1380a6d3170265(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cac578e-7dab-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755683405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683405, "uuid": "be3ab9e0-fdc5-4534-9e7f-966aee962430", "comment": "Malware payload", "value": "97bf7300d19d7806b10a24cd6dc8f92b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683405, "uuid": "837e55c4-aa45-47e1-8def-7c5dc7bc963d", "comment": "Malware payload", "value": "e293a6f0420ac52ec8a37da75d173cc7c567efa3d18f14e9532cac5adb26c744", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683405, "uuid": "c4670a6f-2069-473d-b1f0-b9c72eca76c7", "comment": "Malware payload", "value": "4456cd5a918a93293a2651f3eac6bd591839ec59", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755683405, "uuid": "d54fcfff-7777-47b1-8b6b-7381e10b3c00", "comment": "Malware payload", "value": "a94b8802dc3b7d43eb43ec194e16c4615209ee3a7d0833e2564de3de4c906189ab3337df3b36a9b09a39e55162d24f54", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683405, "uuid": "04c56016-fdc1-46ee-b166-909e2dce3bc7", "value": "T1F0D3E022ACC9D096C4391CFF63E69B5C6E452D820D539A8ADE5C7D05392F0F35EEAE04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683405, "uuid": "aa7e1c37-f9ea-4ae9-9c3d-0838a9ac4976", "value": "3072:u1D0qTCXVoYjQkhRj83GZpeHP6V9qJdPouAZSiAwWgtB:upWl3QkE34g09LImB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755683405, "uuid": "4a375171-1a51-400d-b25b-61bdd19365ec", "value": 140637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755683405, "uuid": "18e8a39a-31ac-421a-8f98-10bfc8736aa6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755683405, "uuid": "749e1abc-8c19-4cd5-9109-6d9dda03fee3", "value": "aaaaaaaa.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6c4f3f-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755699648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699648, "uuid": "4d4b921c-44aa-4c7e-beaa-e894f2ef4a58", "comment": "Malware payload (CoinMiner)", "value": "fcb7009ab298bb4b59a28bc958b30a6d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699648, "uuid": "ae12ed12-fdaa-4685-b1a7-4f97923a5b0f", "comment": "Malware payload (CoinMiner)", "value": "e2c3e6311d29dfe4295934c27fcda900fefc80e8e0d211f95f879771c22f6c04", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699648, "uuid": "9256f34e-24f8-4779-a72e-f4f1287a7301", "comment": "Malware payload (CoinMiner)", "value": "8e37a8d5d2744df00d8aed6cc925df8334145292", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699648, "uuid": "5b3c19ef-4423-41eb-bd63-520bd831857d", "comment": "Malware payload (CoinMiner)", "value": "4f65688172a0b7d9a9cd59e2385a4337bc91039d61e994ada0b7b1dbee3dfc9ea8d53ce9608ebf75768200947f88e7fa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699648, "uuid": "c1556d9d-3ec8-4d04-bea2-fabab8ee13e1", "value": "T10EA5335C7D1B678AD9CF82F87645FCA1F74CC03222AAD2FC56BC7362894DA156A07603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699648, "uuid": "8d0f031e-3b7a-4da5-a983-6288ed661791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699648, "uuid": "c47ad305-76f9-4371-a141-a9ec1a36d05c", "value": "49152:43NlTmtg4pdBGohs4QDgce+w+5gcyWiZfOcVaI:49l+g4Z6447/yWTZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699648, "uuid": "dca062f4-563e-4b1b-a6af-e64f151fe1be", "value": 2146304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699648, "uuid": "7e1316b2-bf45-418e-b04b-167fc4080eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699648, "uuid": "be2a3696-8872-41c6-b6d8-98e043a58f49", "value": "FCB7009AB298BB4B59A28BC958B30A6D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58a5199-7ddb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755704331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704331, "uuid": "22dd184f-e4c0-417c-a845-1af0c80438db", "comment": "Malware payload (Mirai)", "value": "3e6148e9e9a980c218b9fe39d8f9854c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704331, "uuid": "7b0fc274-65c9-49c7-88c1-904be4e9948e", "comment": "Malware payload (Mirai)", "value": "e2cca6b4d87721b609281c1c49d02c36af049211fd72f013ccf775997c8cd2a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704331, "uuid": "fa12e32e-0cb3-4ad9-a0ec-01368d718cd8", "comment": "Malware payload (Mirai)", "value": "f1fb824631ec973589e1bfaa376861a399cf6ec9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755704331, "uuid": "57797686-1cb9-405a-b18f-f6961c7372c7", "comment": "Malware payload (Mirai)", "value": "4cc438f481e6b44bb0f42af008dc50a0aff30c79355d2104b438b197fffce295f3a362db051609a5b5053d25e95ebd33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704331, "uuid": "9251fcae-0c4e-44d6-803d-fa5597e4db5e", "value": "T196E32A45FC509B26C6D7227BFF4E428D772A17A8D3EE320399255F20378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704331, "uuid": "f6d36b69-5f3b-4e5c-a665-9117d0d63a9d", "value": "1536:SeYhrjyUOuCLrnwSl5+zrFIH1bEFN+IPRIeNADsgmT+UEAAfhOwcUYtylUQTlZss:SvjGuG7MNzPNA3m7EL1My2onD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755704331, "uuid": "33a98968-7fe1-40b8-bf01-274daae8f530", "value": 150176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755704331, "uuid": "91983a70-f314-46bd-a4c4-fc9984a2ea59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755704331, "uuid": "9cf99f33-c81b-4b60-a54c-16f163284328", "value": "garm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bdee615-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701926, "uuid": "87b82175-782c-48bc-aa02-138ffab81d24", "comment": "Malware payload (Mirai)", "value": "8d2666d8ead83d3883f360a18deb2b42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701926, "uuid": "86578080-c845-4ff6-8cca-4eb6347c9e0c", "comment": "Malware payload (Mirai)", "value": "e3155750e28e3b1f55f0d94edc1add56227af71d2b989693b2aef43df81b9450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701926, "uuid": "f7506aca-46de-4476-9955-6c90efa65d4c", "comment": "Malware payload (Mirai)", "value": "30023b633f73b73b652d207b98781e8f821ab954", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701926, "uuid": "e158cf63-210d-4149-a8ff-02e21c91b85f", "comment": "Malware payload (Mirai)", "value": "776ac0d62a5179c5ad84939a05604375d9180faadcc8dbcece8381a1fd9cabe3f5b638f64d9742f0789b1bd2ee95bdf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701926, "uuid": "fa21dde0-4a6e-4b67-bbc6-58dff6fc879f", "value": "T140E32A45FC914F17C6D522BBFB5E428D372A17A8D2EE72039D216F20378A95B0E37642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701926, "uuid": "c24b6378-9380-44af-bab8-f35ac4824287", "value": "3072:P986OvQRhgodN62oHo1S/NQQW4NTmXaOFzJNbluHLj6:PWQo2YoYlVW4tmXaSdNbsHn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701926, "uuid": "36d0ff68-3bb2-4ed2-9a54-f619098c49de", "value": 151520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701926, "uuid": "a27b63b2-329e-436e-a969-637e00ac0b92", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701926, "uuid": "30ef3346-3077-47ce-a280-75c592eeb206", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8cc3af-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667302, "uuid": "979f2f07-b324-4f74-a577-d4eb8abb8f48", "comment": "Malware payload (Mirai)", "value": "dc3b14d378366f1cf2b2466a867122ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667302, "uuid": "a3c159bd-3cb3-484d-9ccd-26d213fbc1a1", "comment": "Malware payload (Mirai)", "value": "e31675c33187dee5c91a2dc12f4d210d6b542ee6f0e16aa4fde24d2b0cd0d174", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667302, "uuid": "0cd60aa6-c636-4d58-8ec1-19772e1b7c87", "comment": "Malware payload (Mirai)", "value": "91b610483e6863cc6531b7cdf16b7957f96fa4ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667302, "uuid": "57f9789a-1d69-4f09-83db-080efba339cc", "comment": "Malware payload (Mirai)", "value": "f403e6e9f302d98092de94d05d12efcabec4a62bd28a80e52ee72093e40075afabca817c62aaca6080fc8687daa22ff3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667302, "uuid": "32042e39-22f3-419e-a07a-7ef9a2fac95c", "value": "T1CF1137EDB3111845D7244FCC31791520ABDE82D8BAAA4F54E4BC057B569C748FA78F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667302, "uuid": "db12cee9-57de-41bb-ae05-e6174dd7f7c4", "value": "12:4l+NsV+1NIOOA+mNK4H+4E+Q+XTpw+N/YsH+IKA+zvH+JcA+hHAUn:4kNIYK+Tpb7MGcxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667302, "uuid": "38be4fb1-a440-407d-b4a7-89db9ab4e026", "value": 981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667302, "uuid": "fa9546e8-18ae-4a53-a95e-1c9e938bb770", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667302, "uuid": "6ac1e583-66b6-4e9f-868a-03b666236f87", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355e537b-7dfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755717833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717833, "uuid": "5b4881bf-ff7f-46b1-9b99-fcb0a6c5c9bd", "comment": "Malware payload (Mirai)", "value": "d505dabeaf6edffb42c8f28d7daa434b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717833, "uuid": "2b6826a9-a147-4f54-a660-69b59304e5c3", "comment": "Malware payload (Mirai)", "value": "e4861902fc17cc141dba7b8a4e8480b4a5473d144c4a5756fc1d86a43c2bc886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717833, "uuid": "e856be57-8548-436a-912e-d151c660d432", "comment": "Malware payload (Mirai)", "value": "52ad8c20865529f201a92ffb028707e9158bb028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717833, "uuid": "cc049d2d-bc5e-4ff3-aaea-58071285a84f", "comment": "Malware payload (Mirai)", "value": "bbf2e73b888adadd79e85e9ccc1ffe701ec514ffdb3b87dc821fc63dbd74d78ac67b7166e25c74c6d530ad43f768da5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717833, "uuid": "b6f0e3f2-1890-4a18-86cc-4937b295d974", "value": "T12C631A45BCD29A1AC6D023BAFA6E11DD3321B3E8D1DE3107CD105B28778A61F5E37A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717833, "uuid": "f5730ce0-c313-48b7-a9c3-1ec6858137eb", "value": "1536:mmRwxgD1brrXrlnfqn5yCwYtNJ41Lyk7znp6OecM:mmRwxgJtchNJKO8znp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717833, "uuid": "51487452-0508-497f-bded-aee208009c0e", "value": 72104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717833, "uuid": "0d202257-c9d8-4168-a2ef-3ee79b80312c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717833, "uuid": "a77cb829-1a75-4bd7-855e-39c264e49dfa", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256e776b-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755692895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692895, "uuid": "e7dda738-b5e0-4c29-a18d-ee881dc80466", "comment": "Malware payload (Rhadamanthys)", "value": "2f1bd37e470f8e06efaf54909c914828", "object_relation": "md5", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692895, "uuid": "20e0cc79-0a0a-4bdd-9bcc-87f6c340f684", "comment": "Malware payload (Rhadamanthys)", "value": "e49862174e4d6393136a8315c6050b364bc6a73aac881b543c539d61d0426fe5", "object_relation": "sha256", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692895, "uuid": "0cad2ec4-cbc7-4bc0-9fbf-a708eee788cb", "comment": "Malware payload (Rhadamanthys)", "value": "f5a2f9e0e1b9aa89789a4d1d48421053664cd73c", "object_relation": "sha1", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692895, "uuid": "f8ff0d1f-e875-418d-bb6d-ce8166ae53c9", "comment": "Malware payload (Rhadamanthys)", "value": "2db2ae3b2b35b3436e04a730fd3997f2cbf3f0df89ae2ea5870cb1579a89126dbc23921821b0fc5a4bc6cd91e0005c6a", "object_relation": "sha3-384", "Tag": [ { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "ShadowLadder", "colour": "#30089B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692895, "uuid": "b4ff2cdf-f9a3-4183-982e-e46b4c06da75", "value": "T18956336DB26B491DC36ABC308EDAA24EEF4C5D6F17C7E963D88D77042A39DB04274448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692895, "uuid": "184b4f78-5898-432a-bb7d-c640bc37d070", "value": "98304:5rDA7rGZPd0elzriU2NUXD23pnXalg0Z02i1XSgfjVNefBl6/E0RYo:RDA7rO0B+ihCGCgbVEfBl6/E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692895, "uuid": "1ce8e710-ce81-42e4-8214-8e506e7f269d", "value": 6184960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692895, "uuid": "24ccc5a8-6c0e-4f13-9816-4b5cb7651422", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692895, "uuid": "80631c6a-5c05-48e9-8139-e95fe0a8e06b", "value": "KmsSetup_v1.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b40b000-7e0b-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1755724634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724634, "uuid": "622c4673-0ad0-47ab-b0f2-80aa519659b2", "comment": "Malware payload (GCleaner)", "value": "47797d0d44b5f74c098e73681eae2199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724634, "uuid": "a5320041-32bb-45fc-8a2f-be0a16a49d1e", "comment": "Malware payload (GCleaner)", "value": "e4ac1d6f7663f39195e33c4f8da181129b549bfb4b979b7b5990d387ceab128f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724634, "uuid": "abfd563b-a146-4f8c-8635-dc02098efc41", "comment": "Malware payload (GCleaner)", "value": "90ee82dbda9032d4fad71eacbad0e38976273971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755724634, "uuid": "ff973186-21b9-4507-be9f-067dd28d506d", "comment": "Malware payload (GCleaner)", "value": "16101dfc7951bffa454e399adab35d4765c6e3c87053b947bbcebaf8149ffe011962dffc214b5b44f25061784863eae4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724634, "uuid": "4dc52ae8-7791-4650-acc6-5cc6e2648470", "value": "T18F06E1BD62A4F033C0299DF5CD9595EB81F82B66DCE71C185EE01F24663832D3B1A47A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724634, "uuid": "3784cb20-f209-4ab0-90ee-693f6b3aed5a", "value": "426c703e3fd97399764ca95cae6c78e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724634, "uuid": "7d69c75e-309a-48ee-95cd-14f0ebe2f95a", "value": "98304:LMUXDBcrxvEZS0M26Ct44WuOSfyVhxTL+xLvLTIx82btQsGJFRIOd/LgGC:L7ysfMFU44pyL0B/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755724634, "uuid": "5108d328-7263-45dc-ac3a-307647f22e84", "value": 3660576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755724634, "uuid": "570122b1-1f97-4175-997e-d9de3a3fcaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755724634, "uuid": "770619d8-9e4f-4350-9d29-c028d1412622", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.42175.29241.25603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74665c2f-7dc1-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1755693028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693028, "uuid": "e9efd2ba-2e15-40bb-9dca-a309e3dd2d23", "comment": "Malware payload (ACRStealer)", "value": "b61cd636e0214a3ec68bb2795df88323", "object_relation": "md5", "Tag": [ { "name": "80-253-251-138", "colour": "#F3D0E2", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693028, "uuid": "ab92f527-dc1f-4954-a037-b675965d8215", "comment": "Malware payload (ACRStealer)", "value": "e5dec6987e580bc443c2edf2e44efc56962c919b7ccfcaa1fce5fbdb14e39375", "object_relation": "sha256", "Tag": [ { "name": "80-253-251-138", "colour": "#F3D0E2", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693028, "uuid": "63de2f24-5e49-41ad-8357-0c14dd7f8f81", "comment": "Malware payload (ACRStealer)", "value": "641c9af19ee6df99bd42acb1630a194cea8b1411", "object_relation": "sha1", "Tag": [ { "name": "80-253-251-138", "colour": "#F3D0E2", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755693028, "uuid": "7d500b3a-ffd2-402b-8caf-76cde5fbba6b", "comment": "Malware payload (ACRStealer)", "value": "575e8c4e4572172705cc469ad9c1ef62a7933fe061586fccaa5af851f1e9c03e65a2957110aa1630621e0ec487781aae", "object_relation": "sha3-384", "Tag": [ { "name": "80-253-251-138", "colour": "#F3D0E2", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693028, "uuid": "5e939e39-e93c-4a21-8521-a648dd8774d3", "value": "T1B7F63394F41646D66DB3A33CAEB5E9BE99F240A7C807506BFE4CC541BFF60D29E18402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693028, "uuid": "66455514-bce8-4144-8597-11d2ea4d6263", "value": "393216:3x2qQ72yh7Hi7YRmR3VYAvhvzbqi+CheoM471aAvxL8QBMTBB/jQPRuZia:3EqQ7/h7wf+Uhe1IvlkepAia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755693028, "uuid": "813b7245-a8f3-42ef-9cbd-5a8821d7cbf6", "value": 16588636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755693028, "uuid": "fa5001c5-f397-4fa2-96f3-0c5652c9a0fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755693028, "uuid": "a0777a9f-e8d3-4567-8369-376e8ca6f5cd", "value": "!SAt#Up-Fr#EE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cdcc78a-7e05-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755722275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722275, "uuid": "c0dba605-3fac-49f1-8c39-806370c07578", "comment": "Malware payload", "value": "542e600239d6e4e552fec3129697a9ef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722275, "uuid": "199049e3-7096-4d75-b0f5-86ba1695ebc1", "comment": "Malware payload", "value": "e62ab4b92943ca82c0a8956f59b75cd613fdc8cdd570ad9358eff03c3f9c9d94", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722275, "uuid": "59de3f8f-69dd-414b-bcbd-53d2a02e5e94", "comment": "Malware payload", "value": "b09897129698c56ba79ab92ac9d925f2851e83ca", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722275, "uuid": "29243a3d-b37a-4121-b6d3-2bf897263670", "comment": "Malware payload", "value": "1989901ad7de0fe61a3177cf0b4872d2a25a941cbde0aa2deedb59d214761cce7bbb72e58851c81952f3de6c859c9ac5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722275, "uuid": "a81275a6-4a84-4014-8e73-e4cbafc2fecb", "value": "T1BDD12EF2B486627CDD9FCD3A615069BD108ABA8B26874D6887BE20757C89FDC1C41DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722275, "uuid": "1682d255-10b8-41d4-9608-1e018e3511ac", "value": "192:kR3mBzkOBqA/p835YC12MOk7siqgnAGpPOZ7pPOZ7SofI+DNwDV8Gpio+Ur8Snx+:kR3mBzkOBqA/p835YC12MOk7siqgnAG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755722275, "uuid": "7b58a944-7ddc-40c7-84ae-74769862fb41", "value": 6359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755722275, "uuid": "0cd2f508-7bd7-4ffa-8389-e3a4320c1577", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722275, "uuid": "36f4eab2-dba7-41f1-af3c-3628e6401d74", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632dd26a-7df6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755715762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755715762, "uuid": "f9d3af67-0835-43dc-81c0-a9606c4b129f", "comment": "Malware payload", "value": "cc2740a4d21d5456a6206a21b14d91cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755715762, "uuid": "cbc85e9e-a566-4074-8c66-889e907f846e", "comment": "Malware payload", "value": "e724f7ec302b8cddd5e0dcf3f3a53df5f465b3b938f1e84effb4fa781eb7abe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755715762, "uuid": "d928e769-d8da-439e-9fa0-7350917a886d", "comment": "Malware payload", "value": "3d7dac6e17aa3397e640c11d2e7d99028d4fb718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755715762, "uuid": "a2a98645-a5e9-4105-8063-30edb7111912", "comment": "Malware payload", "value": "7c5a7c6c691f4522d01f31da1e70d8e2f58f1b4822fe24e50c8af764b42123aacdaaf81a4c957a7e958ec2261ab74b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755715762, "uuid": "cbef96a5-bd67-49a2-bdbc-5dede694097e", "value": "T19EF4E0993500F18FC493DA358964EEB4E6656CAA9207D303A5E32EEBBD0D587DF041F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755715762, "uuid": "630219af-ee97-45e2-afea-13a9e699e7ff", "value": "12288:pIU5a+izVzERzEfrfqdZDW+LBJikf4hlKbRRYgf5qnzt8GDCuhan2+xKE3An6Ww:pIUodzVzMzEfOdZ5LBJioelsG8IzCGDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755715762, "uuid": "4efdc7e7-0fdf-49f1-b2dc-1615b5362844", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755715762, "uuid": "9e3c162e-ec86-4a5e-b4b3-910ef4666252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755715762, "uuid": "73f44a21-dbda-4d2b-8b24-8b5db6d905f2", "value": "Quote--FL202306200039 SWP Inquiry no. 2023-1981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7a8f66-7d69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755655355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655355, "uuid": "145d7a6e-74c5-423f-bf1e-4f6bac659a00", "comment": "Malware payload (Mirai)", "value": "4cdd8554fcf6a896826e1e50263bb461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655355, "uuid": "c016637c-7487-4a67-aec9-d655b7c1400a", "comment": "Malware payload (Mirai)", "value": "e72836abb33eb7f3e747e90b62a2cdfaf453977dc44c861b6c5c62221a3c5627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655355, "uuid": "8a0ab3f1-3bb4-4033-89c7-27ece6e3b524", "comment": "Malware payload (Mirai)", "value": "f308eb393abdd2153322132a6e7e0bfca8846fe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755655355, "uuid": "d427eecc-f3a6-48e1-96a8-3e04f550183a", "comment": "Malware payload (Mirai)", "value": "9547b704a375d41f1288e44ebbc37b324d985436686e3e6a285f0dea9e7253a3f4bbf498eba0969d3cbc4f63c4e6c86d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655355, "uuid": "b529d951-a8d7-4243-bb48-b4e90cf8ac23", "value": "T184839D63C82B1D24D04848F0B0A48F3A9B63E115CA5B2EF7959AC679D087EDCF6467F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655355, "uuid": "8701587c-72f7-40eb-bd72-7f4a1dcc7703", "value": "1536:KJ+dxKPT0YDgpf2+jKDbCCGrSq6CHi/PzD/29Oa:Kkdx8Dgpf9GDqrSq61/PPeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755655355, "uuid": "87eeee18-d0c3-435f-8bc1-6908ea218e4e", "value": 81028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755655355, "uuid": "d49cc632-d064-41ef-8e7a-2fb8e45d57f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755655355, "uuid": "6c6ca68a-d740-4e18-8039-892420a8e461", "value": "nwfaiehg4ewijfgriehgirehaughrarg.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5181e4ca-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702418, "uuid": "015f45dc-d669-42e0-b8fd-448141913fd9", "comment": "Malware payload (Mirai)", "value": "ccf604b0947698bd3e311ccfd7836caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702418, "uuid": "3f03d74f-7e6f-4f5f-98d9-b9004b2f671d", "comment": "Malware payload (Mirai)", "value": "e776a6c5f756a1c3d2a3ec155987c9f7a1b408576b115ee62a42112116dc7409", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702418, "uuid": "9f1451ff-a0eb-4b67-a045-32f0619da411", "comment": "Malware payload (Mirai)", "value": "26f12dfb726d92ebbba1958394df6c7e545bcf83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702418, "uuid": "826afd0c-d581-4bfe-b983-e823eaaa66d1", "comment": "Malware payload (Mirai)", "value": "e5003853cc4a0e6b1489c4be606766a921db93d733c4844d3854720f57428116f70eb69d00dcdde3b8e390af68b52b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702418, "uuid": "f3b417ba-8fa4-486c-93ee-1f536dc19b3a", "value": "T10DA3212DFD125B7DF6D7823052FE9E126E2423D527D1D442E2BC86602DB124B780BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702418, "uuid": "1febe383-3a08-430d-ade0-2e6ab3ef135c", "value": "1536:3Mjs4Yy0ajrUK5zjS2wik9hCmY/cxeVHCSqs0+:30fYjSXjRwC/ckJa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702418, "uuid": "d4112c7a-0f92-4cda-badc-cb73f33d0a46", "value": 100928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702418, "uuid": "81610a00-3b24-407b-9b75-b7c59b39fbc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702418, "uuid": "8e72f843-ad3d-427b-a459-97531bd7286f", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05ddbd-7e06-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1755722864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722864, "uuid": "50d38a3f-0c38-4559-aca2-e51a26fb1943", "comment": "Malware payload (Gafgyt)", "value": "72b81b70676e749d27f24bf15a734152", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722864, "uuid": "8a7176bc-86d3-4e4f-9768-a1d2a1faedc8", "comment": "Malware payload (Gafgyt)", "value": "e8123db0602d04b291d3d38954a14b4898d38facc37e6547483241eea2481a31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722864, "uuid": "df02a13d-e994-4a58-8a63-97674e66d077", "comment": "Malware payload (Gafgyt)", "value": "472c9c9a6d2311d98fa10054ceedf07b3b800a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755722864, "uuid": "6bd2994b-d138-4643-9407-f1ea3c78444d", "comment": "Malware payload (Gafgyt)", "value": "bb6c329ec43a800b83aed2b8c00dae58e3468c96506de8618c39dd2e27c9bd7096aad8f26bab1801470eead43f29ffe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722864, "uuid": "9ade2026-562e-42ba-93e1-e39481c4db47", "value": "T18B83950E6E618FBDF66CC73187B74E21A75933D622E1C685D29CD6011E7034E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722864, "uuid": "9d5c19f4-5d18-41a6-9c68-2c80e0298c02", "value": "1536:D7+Tw9hD7AXNAmNdXpSCzkLwBLc5w2tUEohaqfq+P:P+RAmNdXseNx2Rq7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755722864, "uuid": "6b72fa9a-96f9-405c-9bd0-fc6fcf0ef1b4", "value": 84900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755722864, "uuid": "281ec841-1151-44d8-a84a-17d371d7aac0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755722864, "uuid": "c8992081-7e54-44d4-8c93-15e190e0440b", "value": "lmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a41e1a6-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652584, "uuid": "697faf26-db54-4b75-b85d-978778908719", "comment": "Malware payload (Mirai)", "value": "7626ee5a19f773d2c3e36aea528a5975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652584, "uuid": "c5e3e337-889d-4f1d-bc98-15b2e4bacd8f", "comment": "Malware payload (Mirai)", "value": "e8a9ec11dde5e3af13b62bc826514cde87a6ffbf9d7c1275d377defd529f685c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652584, "uuid": "e861ee02-efa5-48c8-a256-11959b85012b", "comment": "Malware payload (Mirai)", "value": "a5fea76e23ecc54eb20fabc38a2ad3674c2d2467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652584, "uuid": "af3c0899-284a-406c-93da-f62568baa017", "comment": "Malware payload (Mirai)", "value": "d6301c8b04f0bf8f5615243bda694d03139433f8df16e1547083d6fe3861fbab8fb64afa252234675f5185c891c8cc86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652584, "uuid": "58307758-d4f6-46c1-ba93-343dae2efbd8", "value": "T11833F11EC8AF53CAC17E43B925C9BC9A98318A0EF4A94541BFC930BE1D86E5F3515C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652584, "uuid": "5bd60cbc-f422-49b9-b5fa-11912d8bc777", "value": "768:XVg1kH64WS8T0db1SD9Yboka19v/MQyjOvLyl5ezM6oSub4kZrPmiD99oLnbcuy8:Im4S8TYUKbW3yPsBuZJ7Wnouy8oy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652584, "uuid": "c1f53ce6-0090-4bb6-a43d-1bfc988c9a5d", "value": 51448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652584, "uuid": "77edadc7-13b1-4bcf-bac3-912566dc3f80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652584, "uuid": "145419ac-4937-4daa-aa3f-beb056395ea4", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd7e245-7d8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1755671435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671435, "uuid": "156701ef-3b04-4226-9c22-10c9c1207a4f", "comment": "Malware payload (CoinMiner)", "value": "837ed5320f37f3c8a28c4918d0f11078", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671435, "uuid": "04e52d8c-a8e6-4888-a2fd-f1ba27b42da9", "comment": "Malware payload (CoinMiner)", "value": "e91b70d31856ba2cec417f27a4192b2c15de540520d411b00968ca8598fcb6e8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671435, "uuid": "7bca9f5c-4c30-4d94-9c60-c663d66e9e21", "comment": "Malware payload (CoinMiner)", "value": "03204dd9f12832e89771b6e614eeebf8d81c6a4d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755671435, "uuid": "443bc7ef-efb3-4de5-89d6-d00fdb9ee519", "comment": "Malware payload (CoinMiner)", "value": "e6a0366d5f457756f65a9d7d92526501d0a33af7541ebf0a2225fa20e67749ddc611d07ecbe9baf6ae36cda1f0879809", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671435, "uuid": "c89ca312-a57a-4c94-9cf7-ff1f7bdace2a", "value": "T15E663304067CDECFEBDAFB72351C6697944E7C00C521AF9E69A3506A909FE9FC618D20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671435, "uuid": "654b77b4-d32c-4ac0-95c9-4aa9003aac95", "value": "8207c83c4af45770be604e6c6e3ee7d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671435, "uuid": "ad208b56-22a9-4d3d-ba75-5e6f7c7e5759", "value": "196608:zf4MB8H92rKHq+usC4/MARJMlFFHrJXJdR7Iv:z9S1vkARJOFxFX+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755671435, "uuid": "a081a182-554f-4e79-a699-b7ea3f5a6332", "value": 6770704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755671435, "uuid": "be9978f0-c2b8-4f1d-9815-f75b2d53dd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755671435, "uuid": "29700f78-594a-41e2-a80c-628112d460b7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.24561678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a0a484-7dd1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755699798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "4d2b3443-e363-47c6-9d17-38966ea855cd", "comment": "Malware payload", "value": "3ee7ae119e753e91b6eb1649d78e5141", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "98d916ac-3be3-449b-ad4f-21d33a8f772f", "comment": "Malware payload", "value": "eaa25a4010452bc4d09055c4349885f2a1b4e30bd823f5039c1a4e99e4d902e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "5b76dea9-8288-4c26-9d8c-7a0af689827a", "comment": "Malware payload", "value": "65e51b0e01d42a6c30c2733f69aec118b8b1dff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699798, "uuid": "5f1991d9-3e10-40ad-8637-bc16399feee6", "comment": "Malware payload", "value": "f882cbabcc63c73a1f719a6319f2e3d352756ad91ce33e77999cd3c3a63a2c4abb74f5c16eb11b6008c03faba4a956f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "d491a4f8-f732-4379-bc54-69ad6ee3e86c", "value": "T1B275E118A86990DAFCE340716F759111F833BD7B8F345A9B00E89B601657EFD0A3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "fc97026c-393f-4355-b81d-ff986b5372b9", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "702b9684-2c9c-4a81-aa4c-81fc49dd0941", "value": "24576:gAgGqsICddG7l/zd8UoA1deThPvKJ8qskVLr45FM2X1mHRlILE2qMylJ2NCpo:P7qpCddClkG+KJ8U45F/XaafqMoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699798, "uuid": "225bc948-65d9-470f-9b5a-6407fd048b22", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699798, "uuid": "b9d03b6f-edfc-4970-bc34-c1c7e560b51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699798, "uuid": "689395ed-723a-413e-b5b2-cd4a69c35072", "value": "SecuriteInfo.com.Variant.Lazy.693797.32297.3964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c205aa-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703491, "uuid": "28a79ac3-a9fd-49b7-94d7-8fc30aee0d6f", "comment": "Malware payload (Mirai)", "value": "00381a7fb27bfd95a55825a56213183d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703491, "uuid": "9b59cdc4-dd45-4666-ba97-517882ea17d9", "comment": "Malware payload (Mirai)", "value": "eb06e8742ca8dabc8f6fae4f6521804be306e917405809aeab2d160f1885791d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703491, "uuid": "7ed37712-6b5c-4c4e-bc4d-669ad317e578", "comment": "Malware payload (Mirai)", "value": "a65a0da9eac7730c1310fc0aa4b55b5d6e22c1d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703491, "uuid": "b21d2845-efda-4458-ac07-5564302ceb6e", "comment": "Malware payload (Mirai)", "value": "5916a91343b0b3c4e4afbae8523cbe475c4b29b4ef1b8cc9ead65b66d5f61c298718c7122ce90181b41de7b63dfc0c0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703491, "uuid": "37efb852-8dcb-45c6-b6cc-64bc83feaedd", "value": "T165516B8603164E741D636A73F6F6C7783489E0650DE9EB85E9CCB5E9034EC9837407A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703491, "uuid": "d5902dee-c885-4927-9861-07f611b50cc5", "value": "48:v07V7N7h0q6G0gyzP0aKW0goU07g7o7U0fH3b0l9R08cg0JpV0ySO0W+C0XfT0/i:v07V7N7h0q6G0gyzP0aKW0goU07g7o74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703491, "uuid": "0aa53ebf-d9cb-43a3-818f-6a13390bcba6", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703491, "uuid": "e3d394c2-24ce-4bbe-bfd4-e1fddbd98b95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703491, "uuid": "0331688c-4948-4271-b4ab-b1dbc6d49639", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5555cf9-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721564, "uuid": "32e45e7b-f14c-4007-ba92-27e88708986e", "comment": "Malware payload (Mirai)", "value": "1709ef7a1be5e2d1b9a36541a099bc8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721564, "uuid": "42065f48-6fd7-43c5-9ce9-f3971d6a6c99", "comment": "Malware payload (Mirai)", "value": "eb71cbc38acbfbf67f5a3a419eed65dc6e8b244a69caef46f4e5acdc9d9f6e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721564, "uuid": "33f2bbb9-9f14-4541-a26b-3f9e6ec38db9", "comment": "Malware payload (Mirai)", "value": "90c9a8d8d2c494f1c069b6163436f27b3a7018da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721564, "uuid": "d0dfae50-8c90-46c9-825b-197494dad83e", "comment": "Malware payload (Mirai)", "value": "f4b5bdffa02de7b3590eae6a2f26a5f4d3f022cfacbae3c0939a08a495ac7c6d1315fc7fab1c46136b951f9080474774", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721564, "uuid": "11a8897b-c369-497b-ad7e-276ba1a9d22e", "value": "T18C2302432097BA03E03458FA8462CCCDB55AA77DB1BF77AB25480E154C35DA2ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721564, "uuid": "9e4cc655-c004-4f21-875d-9d0a9f84392e", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFiZ9q3UELWt/iw+kvBGg6+fYtrBHY:E12O1LCNguovDPH7TcrJLWhiw+kvBGgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721564, "uuid": "f15959eb-4ed9-483d-ace3-f46547112fde", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721564, "uuid": "83856a8d-b83b-49b6-881d-c9ff2d6bdf74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721564, "uuid": "c5fef7ca-8c64-4c53-963c-1adc4f6c6131", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8e01fa-7e03-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755721605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721605, "uuid": "a14ca796-8f91-4ab3-b82e-10dadd9cae97", "comment": "Malware payload (Mirai)", "value": "9067eb19f9305620269f1d2972b96f16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721605, "uuid": "9fa5bdbe-45f6-4fc4-93b2-f77e2db139e0", "comment": "Malware payload (Mirai)", "value": "ebc054125851204f9aa44d0415106ad168967a91910b286e185cc0661c696c7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721605, "uuid": "bcf68bd8-13a1-441f-a9e1-1c5c7600b3b1", "comment": "Malware payload (Mirai)", "value": "42b94db7ad40edca946e1a076af1b481fb19d6c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721605, "uuid": "3c5bd691-0c6d-4695-ba4f-f10c9a3301b9", "comment": "Malware payload (Mirai)", "value": "02330d18fcc45bf666d8619766bc8e7aa3ee5fb9e63c9d0ab95deba78144b4695ee95fb06d71cbcfa14bbda0f326fcee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721605, "uuid": "445cda14-642f-4b2d-b45b-574f669f238c", "value": "T15563C71E3E218FBDF7ACC23847B78A21965837CA36F1D1C4D15CE9016E7024E645BBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721605, "uuid": "aa6e0362-0a38-42c1-a2dc-2983d44fb711", "value": "1536:WkvDSnAd6mYoPdd8QVs1o0vB1tA0iLuYw2+O/8H:WkLSA3vbko0pTAmYw2+OEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721605, "uuid": "410d1279-ac35-46b1-aae0-39c693336033", "value": 71764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721605, "uuid": "23c2bfea-f6bd-42e5-9593-f01464dd23ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721605, "uuid": "82949129-b1c1-4e52-b6c3-a1730bfa8631", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fda2da7-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Worm.Dorkbot)", "timestamp": 1755706361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706361, "uuid": "97c00dd6-94a9-4e9a-a5d8-6b8e46f2b74d", "comment": "Malware payload (Worm.Dorkbot)", "value": "d3d0c69ad4c5af4fa97a3629127c2ef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706361, "uuid": "2b0c9507-09ac-438a-b648-126a753f258f", "comment": "Malware payload (Worm.Dorkbot)", "value": "ebc532634ba06f77070040db13f2e1ba612c5623c6d01f280edac4a757767f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706361, "uuid": "df08ac5e-80b2-4fc7-8e36-f2b99a74edeb", "comment": "Malware payload (Worm.Dorkbot)", "value": "ce2acbfa0da0244aa9a2ea1a2eaa124cc80ac7c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706361, "uuid": "70d63b5d-77d4-43f8-b73b-03154b46ea4f", "comment": "Malware payload (Worm.Dorkbot)", "value": "c53286a369bbf160d93a2fbae62a3901aa000a0dead12946a26712e1dcf97e058565a9c833f9f5598e3afbc84ff65287", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Dorkbot", "colour": "#4A154F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706361, "uuid": "8efd688d-1fef-4fbd-bc67-a23b0346870a", "value": "T1EA935C53FD40D031E6F2583FAA786BB6843DD935072BE9D363A069D50A744D3A93E30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706361, "uuid": "f07e7100-cb13-43eb-98f5-80a0e91dc820", "value": "001f79fcd3f02e15b6ce3a0f62930c1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706361, "uuid": "3cc0a79a-5bfb-410b-9e48-fff7327a179e", "value": "1536:Zv6QFiwYlh1o0PSqbe3j7d0Yl7TyC9R6z8W3J7PVsuiZae/Zx2N4Yj:DFi3h1zaqi3uO7hQJ7PyHZ9/dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706361, "uuid": "ac21b388-7821-42bc-89ba-cbb2b6bc0aef", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706361, "uuid": "193e1fa9-159d-4daa-af71-39e65822e99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706361, "uuid": "7901aa2f-9be9-4a1d-884b-35181977d8da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3d77bb-7da2-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1755679619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679619, "uuid": "fd1096b9-4bc3-40c9-b570-0e64f4ede196", "comment": "Malware payload (DonutLoader)", "value": "8a095c7314eab64e8dc77815bb0d49f9", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679619, "uuid": "e026def8-c5d1-4534-96d1-a5d287f07f45", "comment": "Malware payload (DonutLoader)", "value": "ebcefc1840d1a87a0054a00de0ca9812f63d75c03a8e971099aae28f8485efc7", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679619, "uuid": "33179e47-b9cd-4061-b300-a07d020e1cc4", "comment": "Malware payload (DonutLoader)", "value": "e23620a291a9caf653641d04f07dd69931dde1d9", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679619, "uuid": "81ff21d0-18f9-408e-b3dc-e0b84088a53d", "comment": "Malware payload (DonutLoader)", "value": "5541b9d9ac07c9cfbc320154ddd5904cdcdd6d1728ff500a270aa61c8734a7d10c7f285ef7da61b40c111d5ddfa044fd", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679619, "uuid": "de2f9036-2bbb-46eb-8a64-86245fbc0b46", "value": "T14975017BBB4A5AD3D48DCE3515EE63A1FB6DC09C5A480317B3848212EDA61CDACCC5C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679619, "uuid": "48fa8dcd-d670-468b-903b-86dab80ed69d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679619, "uuid": "f53198fe-b754-464f-a604-b7ae78cf9248", "value": "24576:2r1EnT2E/PT5QVy4TFBksRQphZGojytAxmhktPda8UOvp9WW2CJcf3f4:AETZPt94zU8PyrLxWWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679619, "uuid": "2bf0be08-7b69-4346-9806-9f3eb024997a", "value": 1674240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679619, "uuid": "3dc4ce85-ed54-4ea8-9b67-fb2203de8522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679619, "uuid": "14dd7b6e-1554-45cb-ae34-a0f3b5ad262d", "value": "ebcefc1840d1a87a0054a00de0ca9812f63d75c03a8e971099aae28f8485efc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0ab8ef-7dd0-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1755699379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699379, "uuid": "8e4c48a1-f70a-4601-9aea-065bf1e66864", "comment": "Malware payload (AsyncRAT)", "value": "961188d6903866496c954f03ecff2a72", "object_relation": "md5", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "wuwu6-cfd", "colour": "#091D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699379, "uuid": "8077e8b0-52bf-4f9b-a2cf-7a1af1faf1c1", "comment": "Malware payload (AsyncRAT)", "value": "ed1dfd2e913e1c53d9f9ab5b418f84e0f401abfdf8e3349e1fcfc98663dcb23f", "object_relation": "sha256", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "wuwu6-cfd", "colour": "#091D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699379, "uuid": "729314e5-75e4-4d5f-83f3-e202fdd07cbb", "comment": "Malware payload (AsyncRAT)", "value": "484dc5ae5493465b3f90f74b0b0f612f2f8cdbfe", "object_relation": "sha1", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "wuwu6-cfd", "colour": "#091D5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755699379, "uuid": "c2079506-bd18-41d1-9bd4-593cd4f6cf84", "comment": "Malware payload (AsyncRAT)", "value": "cc361833193e9246572b53419c15258473ad8061787b6d207ac96c24270989d8b1960edbaba20550a780d533319616d8", "object_relation": "sha3-384", "Tag": [ { "name": "156-241-134-49", "colour": "#88E5CD", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "wuwu6-cfd", "colour": "#091D5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699379, "uuid": "81bbfa47-1305-466b-8314-6b145cec5324", "value": "T146F4D040B980D5A5E45E15310114EE670D3DB9B06FAFF9EB27444B2E0B377C09BB8B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699379, "uuid": "b295ee48-5bf9-4adf-8396-b973ad75e25e", "value": "26acef7e3c44d9d008d43029412ddb11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699379, "uuid": "29b413f1-b504-4e5c-9101-3a2f622a1a8a", "value": "12288:iisBFQtLPcQVGKMO1ReRFNjXvskcfXmaThoXUGrnUHC2gRmWAND9eDB:iJBqhPcQMKM/R7XvfcfXmaThoEGrnUHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755699379, "uuid": "6859d9a4-f01f-47bc-965a-2d41c822ca5d", "value": 737216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755699379, "uuid": "9e20404b-ddaa-47ec-8f76-b394a148cd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755699379, "uuid": "ad4a34df-59d0-440e-8d02-ca041de24cec", "value": "ed1dfd2e913e1c53d9f9ab5b418f84e0f401abfdf8e3349e1fcfc98663dcb23f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a9d0bf-7d84-11f0-91c6-42010a9c0006", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1755666988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666988, "uuid": "4d69d4b1-c2f3-4259-9d55-0fcf386a6a90", "comment": "Malware payload (VIPKeylogger)", "value": "7d087ed8ee01697586d3001aa932f2d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666988, "uuid": "87f220e3-1b8b-4919-8b7b-26721267b52d", "comment": "Malware payload (VIPKeylogger)", "value": "ed67e313856d24ddff3ab5d32f7c008091dba877cc81c20f231915ddc47aa495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666988, "uuid": "b6094c02-f43e-49b0-b938-7ddd4647ab50", "comment": "Malware payload (VIPKeylogger)", "value": "0ee0faebb154177cf6675345281ccaf89a575361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755666988, "uuid": "48f1303e-028b-49b4-b6f3-f1c1b24d4aa3", "comment": "Malware payload (VIPKeylogger)", "value": "8fdf7e039dc78b994b307bddbc9504b4d7bb0fc9463d476a689daa2c0f228450ee55249e69c55314a40b0ee85b05a57c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666988, "uuid": "bf7b011b-fbd8-4603-96a9-432fb652d78e", "value": "T107F412542696EA12C5F637F41960E3B883FA7EAE7412D3025FD9BDEB3821B405C90793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666988, "uuid": "f84b79e2-8c9b-40d2-8c3e-f570a60ab141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666988, "uuid": "a097149c-ea73-4c7e-aba9-9ff5342f62bd", "value": "12288:a7JQvACAG65hCkN+AuPNFpxPIzpoJoAUd4y6ryiGQw4awo3PMO0E5hhan2:IJQICo+PFVQ9omFdiG7QXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755666988, "uuid": "3269ccf5-59b8-4f05-a8e5-2e020e950829", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755666988, "uuid": "61ee8bbe-bc56-42f1-a806-78f3ba97c984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755666988, "uuid": "8974d472-c6f9-4219-8a7c-dddc1603143b", "value": "SecuriteInfo.com.Trojan.PackedNET.3393.23258.20719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972e8341-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (SSHdKit)", "timestamp": 1755652714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652714, "uuid": "bba13bce-c7f7-46a0-b545-840212ba0957", "comment": "Malware payload (SSHdKit)", "value": "b16529fe0016496baea3d2ecd76955d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652714, "uuid": "34e15de3-2b53-401b-9a5c-86b37be23c11", "comment": "Malware payload (SSHdKit)", "value": "edd2fae79a80ca12cc2bf2e4d5ccb1bfd168e6b4c3053de2dd3ae214f72b16dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652714, "uuid": "ec3d921a-3984-4c51-ad4b-b4341d2ecede", "comment": "Malware payload (SSHdKit)", "value": "ecaca9e11828f1250556f4bde5295c56ffda78f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652714, "uuid": "f79f9829-cd9a-47b9-a6bf-95a5aeb1ff09", "comment": "Malware payload (SSHdKit)", "value": "a80db0838e6fa9213ac539c00f1f09e06b8e8b07b043a7ca80129b1e704aed519c3d87e9fe7ea467171ac572135a6ca8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652714, "uuid": "f8abc8d8-64c1-40e3-b65f-17d23f9185a0", "value": "T1F805E1C4F5E01E67D487813F9B8286720166ED5FB34AC317578866BBB4BEA34EB15380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652714, "uuid": "06185047-13de-4e26-b01f-862cb29cc448", "value": "12288:lZpdDbfRWxSYOkwVcqcMFT5G1z6EtYOyDIGOnd7w4bLvVc:lHlb/KwiqcMFUzYP8GU7PvVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652714, "uuid": "bc514255-dd9b-4003-8b97-208567f2905c", "value": 839373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652714, "uuid": "d72dc80e-d178-4a66-aaa1-d41df38dbf5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652714, "uuid": "ee3c52c7-ae98-4a90-ace7-ca6c4d2b0003", "value": "SecuriteInfo.com.ELF.SSHDoor-JR.51422732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e957f9-7d8e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Hailbot)", "timestamp": 1755670987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670987, "uuid": "568e093d-2622-4586-a853-e38d1dee479a", "comment": "Malware payload (Hailbot)", "value": "b22a4b50a55e3866e4c9a85a182f83b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670987, "uuid": "ed4741b2-8d9f-4ac4-8445-122270754ed8", "comment": "Malware payload (Hailbot)", "value": "ee14e4dfb3d49efd81f9459061ab49aa1f7f537cb2bc5f6c4ab81ca8f77fd6cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670987, "uuid": "9d27132c-68cc-498d-97cf-a050fd28b6a4", "comment": "Malware payload (Hailbot)", "value": "dfdaad3d11db878ab9bce600965d58621e01be1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755670987, "uuid": "efbc015d-810b-4152-b086-a326c6b6906c", "comment": "Malware payload (Hailbot)", "value": "c13c4bb87bde2099309b9813dcdc35b0eeefc834aac7d1d5bc094fecc5ae0535af44ab052c03234b6d26e1175549496f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hailbot", "colour": "#63271A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670987, "uuid": "1d13ce6d-cf38-4b14-8083-31b642d87367", "value": "T16EE33A06731C0947D1672EF43A3F27E093EFEA8121E4F640651FAB4A9272E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670987, "uuid": "a2830624-11a1-4157-a8e1-60f787ce5d2b", "value": "1536:/9VCzV8tp11RTBUrGFxTRNgFaxbOCk9NVr/xGualFg7P4qzv36YvAeuKTc7u8XZH:uhSTFbxyCwVp6gL4A6teDbC7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755670987, "uuid": "2355fdc6-35c0-4403-9aa8-63444a05d7c4", "value": 155888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755670987, "uuid": "c50460c3-cac6-4682-a2b2-7bf008c22d42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755670987, "uuid": "d3b282cd-5423-49be-868f-4737d15f927f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf1b0b-7dd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701868, "uuid": "99758186-9096-46c5-8734-3dfb258d2a80", "comment": "Malware payload (Mirai)", "value": "8a43336f80d5f5abe46085f9e4aa5bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701868, "uuid": "759bf63f-2448-4bc2-897a-645a8ac94feb", "comment": "Malware payload (Mirai)", "value": "ee19d9649384b1cad9b2fee9eef48125ead05d476fa751f4f74d93db4107cc11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701868, "uuid": "2dc22efb-b36a-45a7-b967-a950b6a023c3", "comment": "Malware payload (Mirai)", "value": "f501ef42c55aa3876201730cd6158fc54664c436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701868, "uuid": "442c9aac-cde3-4440-b80f-d68c674b1207", "comment": "Malware payload (Mirai)", "value": "7f8a8b9c96979a913b9ef3b7d70a1c0be4ff0baa9a8ee61a7360df64681c04fbb16672c4b15b99360a64835517a0106e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701868, "uuid": "61421597-f952-4553-b6e1-6f4f00bc9f0c", "value": "T1CE63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701868, "uuid": "995b34b0-20ff-46f3-aa46-ff4d3f52fd90", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAM:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzfL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701868, "uuid": "f57a6626-3e30-44bd-95ab-57734ee49570", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701868, "uuid": "83c6c4d6-61a3-4f1e-b107-7a468501e8bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701868, "uuid": "a4f33972-6bca-4505-adfa-34260834ca72", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f351d990-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679497, "uuid": "630a3834-5e1b-469b-aa15-99949be583fa", "comment": "Malware payload", "value": "67266f6af4df5ba94ba7752e5625412e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679497, "uuid": "773df5dd-2124-4de1-bb5f-11f5b81ee5ad", "comment": "Malware payload", "value": "ee1f9832f2f47432092d26b3fca76996617dbbe82b4245ffe40ed40ba6af8da5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679497, "uuid": "e5b2d435-b86f-4fa7-bfa9-6c5914f37755", "comment": "Malware payload", "value": "3aefe79921d4df4c3c9544ac522550b1eb7a4d57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679497, "uuid": "fe14f36e-c1cc-4226-ae60-ad7996438a94", "comment": "Malware payload", "value": "e5a54a74647e66efc5bd1f18d79e8c84811620776db3308023ff6995c497309c3595a5a72c81b04080055168d1148a99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679497, "uuid": "090b00ea-9e4b-47b5-8814-cd315085073e", "value": "T142C1B75BCBAE8572E4EB073979F307126770C0504BA3DB1F1CD1412AAE567E84A627A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679497, "uuid": "912d0655-dac7-4ae1-b805-d0184cc562f4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679497, "uuid": "34b80658-c44a-4cb0-b3ac-1c108c523ed1", "value": "48:64w+4ihkMY4/bE//wB75qt+sdvv68M0m4cmZwuDb1gKWDnnMGJ2GVUjB6Xeh31uZ:giiezqnB9bLwn4ueho+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679497, "uuid": "0ad3f989-226b-4dd1-bbe3-c474def07c4e", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679497, "uuid": "d49cdd0e-9c3a-4388-9d02-886dbfe97f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679497, "uuid": "e3a2bad8-91d9-41d7-a8e4-b7efb4de6f04", "value": "ee1f9832f2f47432092d26b3fca76996617dbbe82b4245ffe40ed40ba6af8da5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e800b240-7da1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755679478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679478, "uuid": "2282ba32-e5ae-41ad-a4f2-7fa4a3d5dab8", "comment": "Malware payload", "value": "f4ac49481097c3caa6dd5214bc50ace8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679478, "uuid": "7bf71081-9183-4ea6-8203-701feb871634", "comment": "Malware payload", "value": "ef1bbb9e2daccdf2ec1ca19a6589b0afdaa6203fca57e265ce5bd291e36047bf", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679478, "uuid": "15db2f08-98fa-4a01-8892-af1884c5b685", "comment": "Malware payload", "value": "7d60251c34ea406ad695389ea3ac67b300332b55", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755679478, "uuid": "f636f712-e2f1-42d2-a735-4310385673b0", "comment": "Malware payload", "value": "beac072aaa24bd873262a53eab89469f989b2c9647530771dbcdec60432c163b4f2e2413dbbad632d037d6740b5138f2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "voice-golf", "colour": "#23417C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679478, "uuid": "2d6767ce-bfc4-4151-8685-4f4be3549c8e", "value": "T17AA002A9698768445881A6FECA8756376A34C194C65754F6C247E58564074904327911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679478, "uuid": "0b242744-8623-4433-9490-966ecaa151b7", "value": "3:TVXLCwKEkHIHeER5AkkSD6IdMmFn:5X2M+oR5bnfd9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755679478, "uuid": "8e3badfa-ef36-48f3-a8d3-eae9e3dec392", "value": 62, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755679478, "uuid": "1e89dc5e-158f-4997-96d0-885a65a2bef8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755679478, "uuid": "e39c4c48-d14e-492e-8d52-6016f7bbc8b9", "value": "ef1bbb9e2daccdf2ec1ca19a6589b0afdaa6203fca57e265ce5bd291e36047bf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c288ae1a-7e07-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723224, "uuid": "545067ba-c696-4252-8a1d-c664dc79de63", "comment": "Malware payload", "value": "c61707affed78ea0e558b85334c41ca1", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723224, "uuid": "b5f7c3a3-69a0-442e-984a-9ab7d2efddad", "comment": "Malware payload", "value": "ef742b09b7db9e9819c10f6ccddfe1d27607cdbe03a16d6dcad036f0ab5cc48f", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723224, "uuid": "fbcffe8a-03b1-4192-86d0-7c9e80d45be6", "comment": "Malware payload", "value": "f52f5378ca0a24954a4baa6dc9425d147dd8fa7d", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723224, "uuid": "e7764384-9a08-4cb1-8122-c0b43c16cbdc", "comment": "Malware payload", "value": "8009deebd63f102c001188d3b9eccaaa9f7615a0437d768562747d8d85e3943a7f56ee3d9368cd62848a598290394857", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gdi", "colour": "#6A0770", "exportable": true, "hide_tag": false }, { "name": "Skidware", "colour": "#787EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723224, "uuid": "606f22e3-9e12-45d3-8c86-147271d90990", "value": "T1B024071576D3E8B1DC72047008A0E6DD5925AC356A16DCB737E63E8ECDBC2807A63B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723224, "uuid": "adf354ce-7cdf-43f7-87d6-c9657eaeaab2", "value": "dbec1d2eff809a27adfe33aa1bf3cb3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723224, "uuid": "52d3f886-2b71-4d78-a200-9c47fe51c306", "value": "3072:HmytK99p3tLcljShEJpAgGjaqxXUGJBNuXThAg0FuAQk9SV:H6ZxcljzJ+gwkGoThAOZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723224, "uuid": "68a2d06a-5743-485d-8982-2ddd2f290536", "value": 210432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723224, "uuid": "49cec1da-49f7-4121-9079-61529c3ea280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723224, "uuid": "ebbd9217-12dd-4981-ab60-972404f9e1a6", "value": "Zenaxide-safety.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b58e5db-7db1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755686114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686114, "uuid": "582aee8f-6ac5-47c6-b10b-4925139f35c7", "comment": "Malware payload", "value": "1c9048b96c39c3dc572ecfe8b76befb5", "object_relation": "md5", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686114, "uuid": "1e3d3bd1-16fb-4b06-9266-2102e9c31084", "comment": "Malware payload", "value": "ef873f60392cbfb1cc13c005a308cdd28eb7f8cb12deb0a534054e28c963f1dc", "object_relation": "sha256", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686114, "uuid": "1cd17aaf-60f0-45a9-84b3-e4b3f0776cb3", "comment": "Malware payload", "value": "a0c73a66cfc0014debe4f2db4a2dc841cff62a9d", "object_relation": "sha1", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755686114, "uuid": "c5127e94-cbea-4d53-8111-261fd2f611cf", "comment": "Malware payload", "value": "68eebc66ac71a8a9e6a184f0d2b892700e2a9e293cc9d0d66888206ce621cab9a19f208806a59aa26eaa89778b2ada27", "object_relation": "sha3-384", "Tag": [ { "name": "ConvertedFile", "colour": "#B1E625", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "saftycar-com", "colour": "#006356", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686114, "uuid": "24491ec4-a466-459c-98ea-116546557427", "value": "T160E4AFF65395AC9B4E1C09A5F4080B4A1C6C44DBE6B8D2F87F82B4F886561A44EFCDF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686114, "uuid": "cd515e56-d380-4d95-a936-71810311f879", "value": "12288:sr8qVULPw+KFNX3iNPYcgajVyh39fCtxzIcCUByIZ67c:s4w/NiNPYctEh39fezIMByIZ6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755686114, "uuid": "856f563c-0711-4501-814c-ace679e80270", "value": 674479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755686114, "uuid": "94302cfc-6d5f-4f9d-b27c-fdbd38294fd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755686114, "uuid": "249d785f-bec1-46c7-90d9-63e3afdf8052", "value": "ConvertedFile.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bcd387-7d68-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755654622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654622, "uuid": "0ac6fc86-5d6c-46fd-9b2b-59bfef2adf34", "comment": "Malware payload (Mirai)", "value": "f72f95226c72a289b76c5766787a7061", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654622, "uuid": "2b8c5b43-22d3-43fe-9223-1fa8a4f8e404", "comment": "Malware payload (Mirai)", "value": "f00a12a77946cd4adc50bbe45aa958ece8c962f337cfcf080b5a77d896f77030", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654622, "uuid": "640bd778-57de-4219-a1ab-881adfc92601", "comment": "Malware payload (Mirai)", "value": "d290ea0d95931cf5e4a4294b721e21b7f797d3da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755654622, "uuid": "0520a872-ea54-471e-a5d7-01d8c4d39aec", "comment": "Malware payload (Mirai)", "value": "43580c7c8d48e1527e8d4e2ed1d1c754dd6c952526a8185b83f0c92ca9b3c0973b5c69ee2b7f057cedd7447fd6a76fa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654622, "uuid": "d7921b8d-2928-47d1-ab38-d4d2b91a4d9f", "value": "T1DFC3AE87FB8B10A0C8120AF017C71F9D6B57A211CE5FE8E3BC1E663B5A7A4DB1516781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654622, "uuid": "4f2752b1-6cf2-467e-87dd-81fa786f734a", "value": "1536:it+2mPrGbK8XzSi5bn6iCGrf52T+biLdT6XqlI/uCAYUxP/QgEvEW/LW8:itQryKYzS86iCGL5c4WR6Xq9CAYVgeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755654622, "uuid": "de3202a4-cdae-4e05-a946-e59607ed865e", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755654622, "uuid": "f13d96d1-cae7-432b-b0cb-4420dad6bd14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755654622, "uuid": "cab5ad1f-516b-49a0-87ef-ea274088ca70", "value": "nwfaiehg4ewijfgriehgirehaughrarg.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd24ef6e-7db9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1755689768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689768, "uuid": "cacf4d43-253f-4fc1-9bfe-573c3cb4490b", "comment": "Malware payload (Sliver)", "value": "b68b3e8939937046a7d65f5608b36eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689768, "uuid": "819d5c93-a923-4b27-be9f-d22797fde772", "comment": "Malware payload (Sliver)", "value": "f00bb1eb2a703e4f3501c8f4d2399e2edec74fb652f8b995bbaacbbf92fb55ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689768, "uuid": "8f73fb69-3d4b-48a1-ae7a-990d63fdea3e", "comment": "Malware payload (Sliver)", "value": "ab49a5e73d01e49c1e3949b346597978730a1ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755689768, "uuid": "5ae28a0d-cbb6-4be1-91b6-c084ac741ba8", "comment": "Malware payload (Sliver)", "value": "5c7d929fefa9b4e588881e3fad3f5cbd8fd762b3d489ea069300bb46701b8e1887c21ef2409a951d33272bdb4451671e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689768, "uuid": "e1469c2c-5965-4ae7-8912-b8882f66f81c", "value": "T167F62A03E8D61095C4EAD1B489258232F970785C0B7973DB2BA1F7B42B727F05EBA791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689768, "uuid": "fb7ef72f-e153-4df1-9a38-dc23d072327b", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689768, "uuid": "0ec534a8-f35b-4048-a3cd-9e2e399f5789", "value": "98304:3H3F/N5miKaWs+Q/3hRXsBplWOqWWVEt+/afX:nLbZ+QPhR8BplWOGmg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755689768, "uuid": "6b3504b4-1cd5-46d6-810d-138b402a6efd", "value": 15815168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755689768, "uuid": "c37fd86c-2969-452c-994e-e41be4a947eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755689768, "uuid": "c702ea9f-0fb9-4169-901c-1007dcd2840b", "value": "win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63f9944-7e02-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755721136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721136, "uuid": "7422d1d1-af2c-4844-a381-8880cb8dcc4b", "comment": "Malware payload", "value": "fb3d3719eb34b657a992c6466307c33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721136, "uuid": "f4dad404-6f86-4084-a6d4-17cc04e4f9b1", "comment": "Malware payload", "value": "f01167ffe0ed03b8f935765578c861bfd2cca6b1b801b0612cece601187e3876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721136, "uuid": "a98f76e1-02ce-414f-b281-2973aa22aa29", "comment": "Malware payload", "value": "25fb2331359d72c9c4daa4005082c6609f8469c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721136, "uuid": "571b8a8a-727c-478e-b06d-ab43819b0fbe", "comment": "Malware payload", "value": "811a2691e2c76cd64d3dec07617c5062b8f9735bf3e3940225b3c37b3ad70d8082935690efe4e8c8c1e906d5704a2d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721136, "uuid": "72ba9796-4a42-4528-a686-2291bcdfbe86", "value": "T1C865E018A87990DAFCD340716F359151F433BD7B8F346AEB40E89B601656EED0A3E227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721136, "uuid": "41755340-6e1c-4c6e-b4a6-5368ba1d9fa5", "value": "391b1666581ecd58a9cd20d52713cf4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721136, "uuid": "8aa4650e-4c41-4bca-82c9-058cf009775d", "value": "24576:WAgGqsICddG7l/zd8UoA1deThPy37IBaixEH3xIuTAhv8M:97qpCddClkG97IAoEXxFAhEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721136, "uuid": "6a246eb1-1fe3-41fe-a2ca-fa4a4b843159", "value": 1516032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721136, "uuid": "bcdcdd21-dd64-413e-9323-1f25b2eaaaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721136, "uuid": "99c27c43-c9fc-41d1-a509-0c585cf82fc4", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84472111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001e02ad-7dd7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755702282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702282, "uuid": "65ededb4-27e6-405c-bfcc-25b60b108ae7", "comment": "Malware payload (Mirai)", "value": "086818522c3ddc5c2db85e88a478bd79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702282, "uuid": "98f115e0-d4e9-41e3-90e6-8b01c1c01275", "comment": "Malware payload (Mirai)", "value": "f1910af4d5e7d2b07a01de0b9793cb2d9248f3fb58a2360d2cb0e341be2a90c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702282, "uuid": "14ba7fab-b714-4cdd-b2be-04e7e5d09ffe", "comment": "Malware payload (Mirai)", "value": "b2741b6d7d6d246721f178a646399e6846b4faf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755702282, "uuid": "ef5111fa-06af-401f-ab55-ca3da5a0dd97", "comment": "Malware payload (Mirai)", "value": "cf4dbf51ea925c518b815997d20d1505932aca1c37f5c77ccec2a3538542b6511276be3245f14e1433f0478d5d76340d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702282, "uuid": "1b6bfe4b-a03f-4f63-8e8b-8b48ea0f14ae", "value": "T1FBB3C4AAF1470262C49305F026CFAF9A3D2313C16F96E4D33EB516B568B61CB6905FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702282, "uuid": "3b47344d-739f-463b-a7ef-05fb0e1b66ac", "value": "1536:zhRVsJmId0q9w2f4k7ykl0ik16gUA/LWd:zBmSmt48l0ik16gUAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755702282, "uuid": "efafd6f1-a9be-45fe-81f3-1397b8898763", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755702282, "uuid": "bbfcb604-3e57-447d-ae0b-fd4d24890397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755702282, "uuid": "d4a7be84-27d0-4b41-89bd-6cba778c7593", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d22d61-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload (IRCbot)", "timestamp": 1755706271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706271, "uuid": "38f6bef4-bc1b-45a6-92ce-3b5746197b4e", "comment": "Malware payload (IRCbot)", "value": "3e36c3b01063b2ffec2848e318147cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706271, "uuid": "c2ba1ffb-ae98-4374-a79f-807a0d54ced2", "comment": "Malware payload (IRCbot)", "value": "f1b2b4f0baaff87c114e2be8de5d72d195b57262edd3d192ed1f9e924ea5534d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706271, "uuid": "2a09bb97-318b-4e61-8103-40c8de9dd374", "comment": "Malware payload (IRCbot)", "value": "8931d67a7b24076a7354590c9f72d922d7db22ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706271, "uuid": "a162123c-46d0-4027-a96c-77541c74d3a7", "comment": "Malware payload (IRCbot)", "value": "83020f49d92da5e3c13e6d9a0da6dbc8815a118176e308c1a64c2f2d7bb26f365e35286537915219a08c0ed6fa44b9b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IRCbot", "colour": "#70B70C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706271, "uuid": "c22a14dd-a02d-46f9-824f-4ff949036787", "value": "T14E737C21FAC15032C496123271C76F635FFFFA320645A80FEBE8454A7DB15E0A629B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706271, "uuid": "e0f83bdf-afd7-410e-a6c5-29938c80c074", "value": "e45ef6938a2a474a43bec1303c127dbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706271, "uuid": "3e3e0567-0670-4aab-a2dd-266ed9b4eecb", "value": "1536:zm4c5DIgI1zg7JGwXC5Dr3Ri8Uw2ZMt3zqx4:64cQ0GwSj7QMt3zqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706271, "uuid": "a2b27570-85c0-4e31-8ecb-650d6fa14d20", "value": 78848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706271, "uuid": "11b8ab25-8017-4dfd-b003-d9598d5d11ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706271, "uuid": "49524707-8cbb-4f3c-929f-66570518dc55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea75d4e-7dc4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Havoc)", "timestamp": 1755694360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694360, "uuid": "5e89a244-5047-4092-b3ad-5d93f924c0f3", "comment": "Malware payload (Havoc)", "value": "e0703500ff017c45a3364a473bce1bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694360, "uuid": "602a1224-1f71-4a7c-9433-43a6f9aaf604", "comment": "Malware payload (Havoc)", "value": "f244c0520231ec5a3fe6eff638cbbc80d778f4b33db88ab278634a7758e5c926", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694360, "uuid": "da49d648-c795-49ff-9c06-2dac305a4964", "comment": "Malware payload (Havoc)", "value": "3ab3a0ed91c407f32689c293df434a0a2368d6e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755694360, "uuid": "47b3a30c-d523-46f6-985a-bc35d90f833b", "comment": "Malware payload (Havoc)", "value": "e5618402525ddf5ca51eeafdf0e9563553952e240a70582bc3f0ce2beaed4e2793faeeead7f789fb76ab6b99aeb93014", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694360, "uuid": "28b6a0ad-4dc5-438c-b450-89a9d0803aa8", "value": "T1C9723B47765189DAC836C13989725A2BD1B273110732A3CFA3E0992D1FBA7C17D36E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694360, "uuid": "3528c78b-4db2-4e48-a313-cd7b92dc3c77", "value": "8f950eb6d91505dbaeb71048f46309d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694360, "uuid": "512d9d69-4540-472e-9de1-de3a84f8cdd0", "value": "192:mVAqgMv2Eq7b2lep1WrRKAGGoD4MUn+Luf85uAE5XfaoB+Y:8XhvXGAK/9LDhUauAc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755694360, "uuid": "8862e2c3-2b8b-48f8-9b1d-1808465fdb56", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755694360, "uuid": "5a04ec0c-adcb-4588-950f-792a20d4d21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755694360, "uuid": "96876f11-395f-40e9-8e71-b3c37fe789f2", "value": "Windows_update_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f21cb6-7dba-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1755690024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690024, "uuid": "dd060f72-2e74-486e-b9f6-dbfa8b298d40", "comment": "Malware payload (XWorm)", "value": "872ac08f094ca2f730dd1c46b17a3a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690024, "uuid": "74a3772e-4e8a-42a9-863a-f40169ab07b1", "comment": "Malware payload (XWorm)", "value": "f411e4a01659cd3b459e3eda48e6dafda6fbd19489218323bb054fa19a2836bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690024, "uuid": "e40f7ad2-1157-4170-a06c-87383a34ea62", "comment": "Malware payload (XWorm)", "value": "26b5f04d7a06e853956d2f8cb693a21a93be7aa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755690024, "uuid": "c5266c7d-6e5f-496d-830d-ceef2d694c88", "comment": "Malware payload (XWorm)", "value": "a63fab9cfe3cf4ba06e1b7fa1c5d71ba74303a08c53ceeb9865807ae77cf00f5314d48b14e8283d91639a871549865a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690024, "uuid": "4a89b8c1-f32f-490d-9211-5d8d60bd27ae", "value": "T114E23B4877E54712DAFEAFF129F261061270D51BE823EF9E0CE485E62B67AC047407E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690024, "uuid": "3fa9478d-719e-4a81-83d5-e314b616c3bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690024, "uuid": "ac64eaef-0574-4c0f-817a-3cc6a8f712ed", "value": "768:KRPD9OQhx/B03Tw49FzVFE9jIZOjhWbt:Kd9OW/03U49HFE9jIZOjUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755690024, "uuid": "725cda58-e662-460a-b1f9-1d427fdcaa3f", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755690024, "uuid": "995a417b-d5a6-43d1-be50-15862c9da872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755690024, "uuid": "160be988-6f23-4450-b348-37d35ec909f7", "value": "35ww35w3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096fd6cc-7e01-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755720336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720336, "uuid": "40a15444-32b3-44ad-af6b-c7e09e275515", "comment": "Malware payload (Mirai)", "value": "a1a2937053bffc8bcefae4c5ae68a4f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720336, "uuid": "da897c7f-06c5-403f-8432-468b20552356", "comment": "Malware payload (Mirai)", "value": "f481fb0b9be5654bd9d965d05fc066223f01a5839559543643e9225718cb22a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720336, "uuid": "1cda18a9-f550-40a4-b3db-7004359b94ab", "comment": "Malware payload (Mirai)", "value": "8ebb76f26d8f1463cc482f86705466f9528e9873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755720336, "uuid": "c4e7c9ff-73b4-4980-9bb8-94365aadd790", "comment": "Malware payload (Mirai)", "value": "f7be6cd69856de9649593c83eac2bc0b98468411a95c92e2e489ccbdf8a958f93f9a37f6e879ee0d49318a37f5a527d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720336, "uuid": "ff11ba2b-a7c7-4e2a-b94d-3239585a9539", "value": "T1F1E2E1816E068077F3585D36F8FED10187BEDEAC6BCAF5F8020288385D974D5A468F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720336, "uuid": "442e1869-d65b-4aa3-a2d3-a159673960ca", "value": "768:7/nz7JuVcyBO6Z5OyetTf5KoluB/PNtX3Un:7vnJuVlBOI5Mf57l0/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755720336, "uuid": "ee22ba23-b086-4766-815b-303b9cc55b69", "value": 33788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755720336, "uuid": "f8c88977-1423-4e7a-bdc3-c644506a0a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755720336, "uuid": "e3862662-fddc-4180-aba3-df73484aed18", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3a2a2b-7d5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755649175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649175, "uuid": "bbd6078f-1830-47dc-86da-11e1bcb1445a", "comment": "Malware payload (Mirai)", "value": "bfeba012bbefe550419a2facce3e5473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649175, "uuid": "df98c5cd-aa45-4226-bbce-a8cb7d6a0f26", "comment": "Malware payload (Mirai)", "value": "f4aff0e81cd7554eade8effb47903983caa0001fd7a12f829cea316826e6670d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649175, "uuid": "96ad3559-b661-4486-afee-4468b722d93d", "comment": "Malware payload (Mirai)", "value": "77db9e96dd106bb06b13111a1d4940ea7bbb5635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755649175, "uuid": "15738c2e-1b27-4bb0-aca8-62d1c3e919b4", "comment": "Malware payload (Mirai)", "value": "f8b944354ecd4942a8fd1155d9358df90417db31f547454ef0ec08fdad3319868751445fe7c12fef76b3c80feb41b0c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649175, "uuid": "2ef9bccd-5b4e-4e55-8bb5-5280f42f73d6", "value": "T12603E127DBCDAD96D03A627554FE3D0C8828A48574E018B64F88751BECCFB593A243F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649175, "uuid": "1707774a-fa16-44be-a819-327650ea4147", "value": "768:WZuGsWcIjop15rAmLv4SpPHyaONY2lgcKLiHQSNmQnbcuyD7UtQRjq:W81ejIABgq3WL2nNlnouy8tyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755649175, "uuid": "8f92bcaa-a444-4aff-bcca-e5749574019e", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755649175, "uuid": "3cba741d-25f3-4ba4-ad49-47635c325c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755649175, "uuid": "6d5c9165-5e2a-4375-93d0-9d4eb7225958", "value": "nwfaiehg4ewijfgriehgirehaughrarg.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27cb992-7dd5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755701802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701802, "uuid": "d4f2dea9-f62e-46d1-9d43-9255a41fd967", "comment": "Malware payload (Mirai)", "value": "66c9c5fedd40a84771c9a1a5bfb392cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701802, "uuid": "1dbbd8df-c5bf-4b47-b0a0-52f3d4d7b5ac", "comment": "Malware payload (Mirai)", "value": "f4d50a494f8ae17cfda47b4d0337a165f7488817eb6e0376a265ed2528cd550b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701802, "uuid": "06a008b5-d665-4804-9fe0-9e8af5c6ac73", "comment": "Malware payload (Mirai)", "value": "8107a71d2c98f0cc9c4ad1eae1c3db7562352093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755701802, "uuid": "05fe7261-70e9-4174-89eb-b31a4e57f121", "comment": "Malware payload (Mirai)", "value": "9c3008f0e9713162ffe9552a18f1083d117aaccd930cce1f0bed5d35180b24a4872a26d225f499e5d9ab01ac597541bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701802, "uuid": "572bc160-05fa-4938-bd84-626116c6b638", "value": "T15CB2D03C1B151B58DE1AC0BD439D0B503CB81B6491429D5B6207FDD7AF968787453AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701802, "uuid": "eb424773-a699-4252-9a5e-1c1f5e3ceab7", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui07mdtJgGlzDpH7uNj1JAb:YeD8ZSWvZHZbs1row697qohQvg907itf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755701802, "uuid": "09699065-376a-4e3f-bb4f-bba77346fff9", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755701802, "uuid": "9791aede-7bd2-41cc-b163-f6fcc161182e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755701802, "uuid": "b7b8dd78-f01b-4367-9252-65a1875a2ca0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f390365c-7d9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755676920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676920, "uuid": "36015a2a-e855-4725-b822-d0fab4bc6acd", "comment": "Malware payload (Mirai)", "value": "b9ef277ece2b41d51487940ffef6a978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676920, "uuid": "f9064fbb-e666-4013-915c-14bcc945f15f", "comment": "Malware payload (Mirai)", "value": "f5f813b752a151fbd8cfaa0f40c419f6f1d01be768cb8a3f06b85dac477fbd87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676920, "uuid": "2cb14bb9-5b73-4291-aed5-5bac225d258b", "comment": "Malware payload (Mirai)", "value": "c259adfdf6eafbfbb0bd92e53a405d43e3cd7708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755676920, "uuid": "290b48f5-6293-4c54-b015-65ba1a7d9457", "comment": "Malware payload (Mirai)", "value": "8668d948908df821485fed58474e4cd0c3a8afa0e274e9ec2e98ebf00db3f175b512d5c7a73a1e8f319f1635dcec7197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676920, "uuid": "bae032ee-a80b-4431-bbad-d0809ea5fb33", "value": "T19D258E1AB2B3F4BCE017C03447DBCAA25535B07926312DBB26C4DA353D6ADE11369B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676920, "uuid": "fbee8134-4bcc-4e78-bbd2-f510f8dab62e", "value": "24576:CJzFU+Fmnlk9RNgITgotoRZ8xRK8BwdCQaQH:8U+JRNgITptoeKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755676920, "uuid": "20e7851c-37b2-42ae-977f-fdd3e3d695fb", "value": 981336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755676920, "uuid": "9dc5cb45-178c-4fb3-80a0-68108612de2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755676920, "uuid": "d4780831-272d-437d-b425-1cbd46d45bdd", "value": "x86_64.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a10b8e-7d65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755653563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653563, "uuid": "0db32526-a648-4557-8ae3-b1b272582f0e", "comment": "Malware payload (Mirai)", "value": "1c07152f91414eeb0e105c9f2cbd200a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653563, "uuid": "adae4e2f-0bf6-43cc-9fef-aea2cdc3bfc6", "comment": "Malware payload (Mirai)", "value": "f611d639625fdfb11bc469efe32a355f08c0a124535cb1c1aacf62bdf6b6ac3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653563, "uuid": "44c2e8c2-432c-4420-85b8-4b942af3f04e", "comment": "Malware payload (Mirai)", "value": "7bf1cd57b4a708b308d3c04ec2d045d966b1f1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755653563, "uuid": "0e3fbf08-953c-4765-8d35-a31b52bb215f", "comment": "Malware payload (Mirai)", "value": "ab21b1793294778e7f2f5eaabc374d9d80e500d9c1f14d09313c62cb08722e631ab610b6bfa8690507a37e0d97d7464f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653563, "uuid": "5f2769da-ba8d-40eb-91d6-96ea162d3157", "value": "T132F37CA7F30B1091C42705F417CBBB9D2E2311821F6786E77D6A363929B61CE2915FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653563, "uuid": "8a941e3c-92c4-4be8-9793-e9b3cfadbff7", "value": "3072:5gmA+lDrr4NFnofhMU3EcXYNYyUXicqUl3CgGC899Soaub01Rjq:5gmA+lDyyMUJXYOmvO3iC899ijq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755653563, "uuid": "9db97b2f-10cf-4490-bbe8-d8249c4484c9", "value": 166280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755653563, "uuid": "424a2975-38d5-4aba-b108-dd42d92f0bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755653563, "uuid": "295411d9-1aa6-452e-b271-86be717465b7", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "447f08ab-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1755692518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692518, "uuid": "34f36e15-0ab1-400b-8c7f-d993effa77cf", "comment": "Malware payload (LummaStealer)", "value": "2af5068f57164b15ab2da10f956f243c", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692518, "uuid": "d328af40-5c0b-45f5-9ba6-6c369e26a4b8", "comment": "Malware payload (LummaStealer)", "value": "f667c428b522dde24c5524da99fdf375e3fed0ca92977f0890eb72e21e2178fb", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692518, "uuid": "57cdf7e6-739f-451d-a306-e0c1a6269de5", "comment": "Malware payload (LummaStealer)", "value": "81a299a54ba003b307d84a220c697907bd960b54", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692518, "uuid": "c6b3d9f5-45bd-4c66-80bb-fa2de1cbff52", "comment": "Malware payload (LummaStealer)", "value": "e4fadf011ae29718f759218282fc34556b855d8c463ba59fc0ec0ad6889304685fa22532dee1967b813613ed28284613", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692518, "uuid": "f9264f50-e3d3-4030-a238-23c32a3a672b", "value": "T16E6533D7B4F1DC7AEC5306F8653992095F9E1010F9FAEF27F6D02D207A629610A2D293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692518, "uuid": "6a51cf89-1c6f-4cf2-8911-7d02ae7a2c84", "value": "b729b61eb1515fcf7b3e511e4e66258b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692518, "uuid": "b5e12a87-a888-42cd-803b-8dc778e57b5a", "value": "24576:RVDATV2yrKLfFBWVMSiZxkHGhSPAFvF9um0rhikQWbkC146dRn3sxVCL2Q:R2luLfTDAGsPdBrEkQWt146Uo2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692518, "uuid": "cb91bb97-fbd7-49e6-adb2-509ba3508f10", "value": 1489807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692518, "uuid": "3ca8e8d9-67da-412c-a5a2-58a4d7cd69bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692518, "uuid": "038b4d43-1ff3-47d7-8b7a-0219a78efba5", "value": "\u22b3\ud83d\udd38 \ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad486a5-7df1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755713869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713869, "uuid": "da0b485e-97e4-412c-a2b9-6c3213eb291c", "comment": "Malware payload", "value": "b110adc95e349648ba874f1e398926d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713869, "uuid": "a47f99a2-6a30-4e07-9d3e-e5431d07e8d3", "comment": "Malware payload", "value": "f6c9aa9670178b7e136024898197befdc032f508ef1d10c55d086748c32a876a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713869, "uuid": "e8ee5729-5339-402c-b19a-76e909f388d5", "comment": "Malware payload", "value": "964de0003a93ba5007d54a48d32047a7c2d60687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755713869, "uuid": "487cba70-71fe-46d2-aa7e-1ff1581a351b", "comment": "Malware payload", "value": "d99f113c9c2aecf56428de907619daeb9353abda9321c4ce70e197016f3b8abe5121f5ac0c6029c1d44165f5231831be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713869, "uuid": "61f87474-d47c-4e19-a7e0-f08818301ae7", "value": "T1FA45C014E839B0DAFCD74071AF765201F8327D7F4F242A9B51D896B01A5AEED093E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713869, "uuid": "20bd8b17-31f1-41ae-bba2-e24d6dbca84f", "value": "47d46ce0699d66fc655f27ce58653f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713869, "uuid": "d30f4792-e2c0-4cbc-9927-c726d91336db", "value": "24576:6qHhP0Hccxas/JLDB5/DsWyR9kUVuG96/v:bHhMHccxrjsRzkEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755713869, "uuid": "7de88143-5ff9-4936-b64a-db8cef4ae8f3", "value": 1255936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755713869, "uuid": "38ba9159-e91c-4afd-b2b5-c40b69bab7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755713869, "uuid": "86e3a25b-6cb6-40b9-aa60-e630ed7f528e", "value": "SecuriteInfo.com.Trojan.Inject5.64765.24273.2757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb83778e-7e0c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755725386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755725386, "uuid": "837be805-429a-465b-abc3-6049a9ee22a2", "comment": "Malware payload", "value": "65a060a4ee3c1c6efd03b75066de287a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755725386, "uuid": "27f5ccbb-a6e5-4177-abb3-6ab353e0cf72", "comment": "Malware payload", "value": "f7554ca9974d2c62ce73068b348c5a0073d9f9cd64341b98f14282a4700e0484", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755725386, "uuid": "515785fd-7e0c-4040-b429-23c9b52ee6e3", "comment": "Malware payload", "value": "243dad1539ff540ad764033de7083154795efff5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755725386, "uuid": "c97c95c3-dc79-4baf-ab9a-d7351fa501b9", "comment": "Malware payload", "value": "5ff2484d396d4fe6b139a67a8c4ec8783a1bb562958b43475920a5ef78a477c660a2fdaddcb8f7c5c2bb20017e54d730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755725386, "uuid": "dcc49173-1e9d-4f43-9d28-b063a31c7568", "value": "T10A930886BC809F16C6D056BAFE1E518D33131FB8E2EE32029D15AF2577DB95A0E3B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755725386, "uuid": "0efece8f-5a97-4bfe-bb20-1f5065087886", "value": "1536:SanDV1stO5nWt+xoD3mXYGMtK73noEaTjYqdUgHKNMOVyfETWBIYRV/xDc07VYI8:vV+UnWt+WmXYGMtK73nlKUPj8fETWiwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755725386, "uuid": "9ab1994e-28d1-4305-8dfe-bca1f9fc8714", "value": 97180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755725386, "uuid": "417ed00d-d1e8-495d-8d97-21913063d71f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755725386, "uuid": "a8786a7d-12b5-43b7-97bc-5f0d2627bff0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f66c8-7dc0-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1755692645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692645, "uuid": "f8e35936-c57f-4532-9e76-b6604b950131", "comment": "Malware payload (ACRStealer)", "value": "a423c36fae5aa42df3d1ab48f1f1b19d", "object_relation": "md5", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692645, "uuid": "28f2d155-4eaf-4a21-a6f3-7e6f0e5db792", "comment": "Malware payload (ACRStealer)", "value": "f78ada81a32fb58509ea13be8631c81a583dda8d02d3b007cfc3d0896d732a8f", "object_relation": "sha256", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692645, "uuid": "21d461c2-3546-453a-9a2c-aa41e1be081c", "comment": "Malware payload (ACRStealer)", "value": "f004c3f8153bf0955c1a4d2e49064ed8827e523f", "object_relation": "sha1", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755692645, "uuid": "324f668b-dd79-4529-9cbe-cabfa87c5045", "comment": "Malware payload (ACRStealer)", "value": "05d66e8d1079ab94045f54845a8c6b26221fa5bdf96c540dd9204f0a3171d5a0813c602bc4827679e250fe2e78ee4400", "object_relation": "sha3-384", "Tag": [ { "name": "185-76-243-5", "colour": "#45272C", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692645, "uuid": "06cf464c-15e7-4ddb-ab80-0af66a245a88", "value": "T1B026BF027EDC40EAD96F12314E69B73C96AFBDA0E531471719743B2BBE72301692D227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692645, "uuid": "83215d53-ae0a-4aee-a970-23d000358352", "value": "7089c0070011547b02d4915723b71c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692645, "uuid": "f0266b98-a33a-40a2-bb71-5e8b3ec39eb3", "value": "98304:6raCQTpsfQ//4/IzLPQ6EOmh0U+0d7YFLOAkGkzdnEVomFHKnPJg+d:6E0j+0mFLOyomFHKnPJg+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755692645, "uuid": "20544a51-9c2d-4e0e-b7cb-8569c9ffa55a", "value": 4456520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755692645, "uuid": "cad2419b-9bb7-480e-b08f-7948f79f34a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755692645, "uuid": "202197f7-e225-4081-a18c-338e9b94bc57", "value": "mfc110u.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9822bd-7d88-11f0-91c6-42010a9c0006", "comment": "Malware payload (StormKitty)", "timestamp": 1755668696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668696, "uuid": "448e9ae2-ef81-4d1d-96de-1c26ce0cf2b0", "comment": "Malware payload (StormKitty)", "value": "98ead999c20b5f3f80c427414fca0bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668696, "uuid": "cffaf4ba-d847-4574-ac75-3702811e6028", "comment": "Malware payload (StormKitty)", "value": "f9223c706d412ba26e8dca179cd60a11b68adb1c894a07d2f10d6a877158a03f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668696, "uuid": "c1960c5b-0f60-4400-8b0b-7f375c8b296e", "comment": "Malware payload (StormKitty)", "value": "774b2a98e1ee024811e1d5a082092d794a7a8ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755668696, "uuid": "4766f4fc-02a1-47d0-b4bc-7db2c09580bd", "comment": "Malware payload (StormKitty)", "value": "b281996768d2cdce4fbf0599682243dd73a1ab665bf6bd7d31f13c0af1b80ec2cd9c52ae6dabb724acf95c3a9113772a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668696, "uuid": "288f1b7e-114b-4c08-9df9-41d454c798d3", "value": "T190B3290433DC5E20E7FF5BB468B261258B72B017A516D65B19EA19BC0FBA790C910FE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668696, "uuid": "43c98c84-38ca-4796-a2a2-bcaa8bfebfb8", "value": "1536:87YfZJRZk79TP3yTigigkD2V37AUIuvQ7sG69bAdI4pxReUbpkpybDQJ:s+RZk7B3yTwQOWQ7sR9bGpxReUbpkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755668696, "uuid": "24e9d288-dbaf-402c-8a8a-81590e14e49f", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755668696, "uuid": "a320a95f-09ed-471b-a2d2-e1014c6c74b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755668696, "uuid": "208876bc-80b3-4833-86f9-d83d63877f84", "value": "Major.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506717d8-7dfb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755717878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717878, "uuid": "05e75391-3270-4a30-83de-ed0b025b8a66", "comment": "Malware payload (Mirai)", "value": "f09316165763d068d50b595af9330685", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717878, "uuid": "7de36d17-e6ae-41fe-8dae-4c5685ade86f", "comment": "Malware payload (Mirai)", "value": "f9d633f50b15cd7d544d2c5b6c780f78231b81b4a6d8385ccee8d0a96c3e93b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717878, "uuid": "cc5e82d5-6726-4c6d-8f16-1cbed1489b26", "comment": "Malware payload (Mirai)", "value": "3fb5c414958db2968160e7efa23ca0a87a8402cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755717878, "uuid": "adccfe5e-678c-4467-aa63-d9ed8cd16e21", "comment": "Malware payload (Mirai)", "value": "9f5ad6e2dc3cd901a7742158ea6dff45aa4393bcca5c50881d85f527b240876957737d3ac6f8f2c385d25375315f26a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717878, "uuid": "9dca0a79-8cea-4c71-861c-a5af0caed234", "value": "T1D6735CD5B8108EBCF95BDAFD81224A09F52163045FA30F2BE667FCA72D331A59D06C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717878, "uuid": "b5ce1876-b84b-4002-8c8a-13c6b3811e67", "value": "1536:tChS02yPqHka7kg6C85mZPNug1v5fWD/zaXPBGMipfa+7i87U/i:t2Ha74C8ETVOEZOaCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755717878, "uuid": "5799d7d6-6aa8-4276-9129-027632bab043", "value": 80368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755717878, "uuid": "0a8fbd21-78e9-44ca-8649-286c4c548dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755717878, "uuid": "839886b0-4f70-43f8-b98f-ed6d88701527", "value": "db0fa4b8db0333367e9bda3ab68b8042.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911c92a7-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667306, "uuid": "f9483e86-9cc3-45f3-801d-536e64d8525d", "comment": "Malware payload (Mirai)", "value": "56b3ea53cffd8d8d5f4b8ed9059cb6b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667306, "uuid": "9318b846-4939-43dd-9281-78d5f5c9a1a2", "comment": "Malware payload (Mirai)", "value": "f9f62a6603e42f52c9f5f68460faf9442ceeea94844b999aa9e420c4215903a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667306, "uuid": "adadac77-382b-4ce1-b865-2539243c0ecf", "comment": "Malware payload (Mirai)", "value": "0a0fa82fc34cbcb2189f4a0f97de0849fbb0c1b7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667306, "uuid": "94eb3b6c-6df4-4754-8bd7-20e84aa4bccc", "comment": "Malware payload (Mirai)", "value": "84935aacab9c768352d60dc813f6159a229378e56f66c6d26020592046b406923f93019d88e23f8d4108bf066dc31dc0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667306, "uuid": "e299e245-c441-452a-bd13-92a7ac6e778d", "value": "T17A115EEDB3155482EB284FCC7079901CBAD981DCBAA64E50F07C4579539C348AA74B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667306, "uuid": "ad8e51cd-d4f3-4b54-86da-4105cecce142", "value": "12:3J3ZlQ7sVQXNIOOAQ8NK4HQ2EQCQdTpwQ7/YsHQmKAQBvHQjcAQvHAUR:3J3ZwNIUKOTp772A6HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667306, "uuid": "bffb48e8-06bf-46cb-a578-2d93cba9bf54", "value": 994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667306, "uuid": "6f7b6d91-f4f6-4b22-a3c5-6a1f47226685", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667306, "uuid": "dbd41f63-5a8b-4e9d-941a-cd186295627e", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9222c85-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755703558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703558, "uuid": "f0583d4f-482d-4f9b-80ab-4f30cd99db4e", "comment": "Malware payload (Mirai)", "value": "be989be75cd140a95fd4997b5d32ee25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703558, "uuid": "f96b0fc8-9308-41fb-b7ee-bce8b1707b24", "comment": "Malware payload (Mirai)", "value": "fa1e3428fd4e9c5952126917c781b41c22665e912cf0cd41236da6e9e4449e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703558, "uuid": "751c475f-bd9d-4e1e-be4f-ef0046cddd46", "comment": "Malware payload (Mirai)", "value": "b9e0e25419c383a323e81919deb97fd0ed0fceaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703558, "uuid": "30a8d704-aea7-4d1a-9c7b-e47045a180bb", "comment": "Malware payload (Mirai)", "value": "6e1e38f152caba2ab5bfbafda3c1de15b96bfcb3f05c4607d10642943c212197652ba5f3518c1a9cf862854a4d94ee79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703558, "uuid": "c8b868e5-4d55-41f7-a992-0c2275d0371c", "value": "T1F5736368F8424B27C1C70275B59DAF8A3E3053D5B3D9B113ABB10BB03AE75172C66D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703558, "uuid": "3d2613c9-092d-4694-adb7-244103767cc4", "value": "1536:1sv52Pkj6UBUNUnzE4JVD9YSFPkgGHgiRZ5zmNF6o6P2x:yv5Bni+nzEYkgG37BWF6o6PS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703558, "uuid": "93668ed2-9f79-4527-86e2-d813e3e40353", "value": 78976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703558, "uuid": "fe31aeeb-4f46-409e-96c6-67ec3b01ff0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703558, "uuid": "adc0470b-4df7-42e0-ab98-730f5c5c09c8", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cc1bcc-7de0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755706314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706314, "uuid": "38be40dd-f70a-4a78-bd8a-15a3e77bca4f", "comment": "Malware payload", "value": "003d24bfd8e8c024540be33fd00ab21f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706314, "uuid": "ef29468f-c800-484f-97ab-1a533284e241", "comment": "Malware payload", "value": "fa74b48382ca0d53d150b5cd006008c1a825782c9909fee7f341f0a0fd15ab63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706314, "uuid": "f3c99f1c-d7f0-4094-9ac3-7211f048489e", "comment": "Malware payload", "value": "63ff96310c42dcaf4f19eaa2d09cd2a62ac55323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755706314, "uuid": "9559e1d2-b522-4e53-848b-4fa51d6729a1", "comment": "Malware payload", "value": "733adef52fd58387b4227cf93165a953783cbe23d836fee41b08247d9a402c2f11165373a4557ba60c7dcefc40dc178f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706314, "uuid": "62cce721-7873-45c7-8d61-01cd6639b526", "value": "T199836D2176C15036C59A013172D7AF775FFBDA750316580FDBB4060ABF742B4EA2229B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706314, "uuid": "58a74bcd-a77e-4e70-aec3-540e88e283e8", "value": "a88d2dcd95d9c2dd51d361a8c66e79dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706314, "uuid": "d4602d5a-d195-4c90-a2c3-556def2a7ca3", "value": "1536:GtcAq1vpN8BXGr4t9LrgA742XtHP+9U2JqwbYJltvu/:Sc2DjLoktvj2JqwbYJlt2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755706314, "uuid": "31df070f-f2b4-4115-abe9-d7d5b7714360", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755706314, "uuid": "dc5e32eb-1596-4811-bfb4-9c6ed2c63978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755706314, "uuid": "0cf00d91-bdc5-44f2-81f9-2ab5ba61d299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c49ad20-7e04-11f0-91c6-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1755721817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721817, "uuid": "335c7b04-2875-4293-aacd-d9706d4f9156", "comment": "Malware payload (Amadey)", "value": "451bbc9808e3e8c62a2382e684e9765d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721817, "uuid": "88bc0fc7-419a-4ce9-b8e1-ae5feb667799", "comment": "Malware payload (Amadey)", "value": "fad2c0e8fe85428933e730f3844b81ecdc8d1ae26737a9dbbb241ae570cee57f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721817, "uuid": "95555639-b865-4928-9e47-10b0b2972efd", "comment": "Malware payload (Amadey)", "value": "b702868344a3ffc0f0a6b1fbbc8d4ee5da74a748", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755721817, "uuid": "d4542a44-a7c1-4976-8122-45728252a4bf", "comment": "Malware payload (Amadey)", "value": "827515dba560fc86dc140b3edb35e1b2d334430be7006f741502c16f7f3b753af0ed0a2142e1ddb0082ee1f41db1671a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721817, "uuid": "9e22b9c4-cd78-4c7d-bfff-c488ddb3b8c9", "value": "T186E40202F6D380B3F96710B11E78D7A9643DFA235F244DDB2294AA69C6706E1533372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721817, "uuid": "9c08bc0c-9bf3-4112-8dc2-6f73e80a46ba", "value": "f271714f36185009225a9b24c078e5b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721817, "uuid": "66512fec-e41c-4439-b5eb-36a0d114288f", "value": "12288:mAppdyo7dMIc/L/V82id9Ms7zfYxmg2G6SBYIgfmgKHnVu4+3O0BYq:Vzq/3kfYxX2GPOHmgKk1Yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755721817, "uuid": "33194e61-d22c-440a-ba2c-84aa7849a52e", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755721817, "uuid": "e87428bc-0f1d-4333-ad41-4c047a45c617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755721817, "uuid": "c2413309-1078-4211-9cef-159ee02164cb", "value": "451bbc9808e3e8c62a2382e684e9765d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7497e42e-7dac-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1755684009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684009, "uuid": "cc62bde6-0f24-4fb5-a577-5a7b4ff711b9", "comment": "Malware payload (AgentTesla)", "value": "a4b88984985d894fbe455497a305ce59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684009, "uuid": "f6a40d39-ebd0-4794-8da0-343521fa6d7c", "comment": "Malware payload (AgentTesla)", "value": "fc1bf43f3da3a3b68bc6712593f167a8ca90fdaf67cc9920322ac92de0a8daaf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684009, "uuid": "3b5725cc-0a36-4fd2-a26a-9f32d55f1731", "comment": "Malware payload (AgentTesla)", "value": "df14c05e2e58b2e05b8917df0fb3f2f17f8ac96a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755684009, "uuid": "1757ffc2-a3c1-4d70-aad1-e4cbf21b8faf", "comment": "Malware payload (AgentTesla)", "value": "a6b1283f87dd00a7f852e844edf3a4919ee96b2f230b9d365e27de2728e578b632878e04c91315d5b20dfd6b38da5f08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684009, "uuid": "fb5c0f80-20e5-450c-92cb-0b095cfd32a3", "value": "T1B1F4335896AC9475EC96BD79CFA4CCFB620B1922FBB8154C3E30323622C62F5CD56607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684009, "uuid": "8ef70c87-0ba5-4212-859d-a501ebf9bf1a", "value": "24576:YrntLM1tVmI8IkEaddk27MzqI32YXjFBOCd:Yz5UV1jbcoqGFTFBO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755684009, "uuid": "8a908a17-7b12-4ef4-ad91-1a1159171821", "value": 788653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755684009, "uuid": "e0f891a6-bad0-444a-9c1c-20e1eb84a961", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755684009, "uuid": "3f835efc-e9db-44d3-9037-d7fa71a2c3b5", "value": "nPO031430.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ae860a-7e08-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755723464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723464, "uuid": "71a280a7-2a1e-41ee-aafb-f56855eeafcf", "comment": "Malware payload", "value": "803c52abfa6b3e7de66ffeda108fe3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723464, "uuid": "352fd831-85ca-4c98-94d6-44e7607663b7", "comment": "Malware payload", "value": "fc6e9d08b670d49e3d684b50d1fafb749a1801c1dc3e2105e11a13caaa770ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723464, "uuid": "9d63b0cb-a53b-4b74-bc4f-7387111e68dd", "comment": "Malware payload", "value": "a0aa996113acbcb601f54d00cd91952ca582b188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755723464, "uuid": "d89f1b1f-7b8b-4ad4-aa41-a6f26f46f851", "comment": "Malware payload", "value": "5709ae2a3fd87052d17d73526833cb064d213da79a4ac05f2ace8131a893ffb581028c42787d120cee59e1bb8bbc8011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723464, "uuid": "48f226d2-6a23-4d2f-b43f-93be38acfcb9", "value": "T10CC48F45A2A453E9E0BBD078919AB60BF936384817604ACB77E44DD42FE37D07BBB701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723464, "uuid": "ab6b7813-f3b8-4355-8e1b-fca88c7b9259", "value": "2c1e990f628219f6a4a0dddff9bac4c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723464, "uuid": "6bd77656-f8bf-4ec8-ae9b-f72cf931acf6", "value": "12288:nPads8ygaZJA2VMoWBdx0ZUwaq3db5EHnOAcDhrFH:nPrZW25q0ZUIdtEHnOxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755723464, "uuid": "5148835f-d969-40bb-b861-b5f2553725d5", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755723464, "uuid": "fef11c83-91c0-4980-ab1e-12554c323a5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755723464, "uuid": "9c78cedb-9eae-4f05-b8a6-4dc36fcddc13", "value": "Fractal External.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d04e8e-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700598, "uuid": "6bc04c1f-6390-46c6-885b-8dd331fb2385", "comment": "Malware payload", "value": "78f025e2bf1b7dc57795487e57c0b682", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700598, "uuid": "4f030d22-3a4d-4e01-9d64-cef249ff1191", "comment": "Malware payload", "value": "fc7208da63adeb550dd3629acf9c473665aa559101cc511e1449cd4e2b3e4787", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700598, "uuid": "b15996f7-91f5-4939-8214-17c3c0041680", "comment": "Malware payload", "value": "fab68e6d1f6410ffac9a8f4dd193c7e0d16d0c30", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700598, "uuid": "c2f3e070-e151-43e6-9da7-03f1acd84687", "comment": "Malware payload", "value": "80067aad4c6f6b77adb1bc3aee5313a1daf87abbe4d111f84c140e3a8a3294ae96e0127fd53b4d5f3661eee50be3ca36", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700598, "uuid": "5f185a18-1330-4437-a32b-7bbe20d12bf8", "value": "T1AFC39D41B5D0C0B2D8BE18381874CB729B3E7960DFA49DDB73C415ADAE742C19F35A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700598, "uuid": "6530cb98-23d6-4106-adef-d7dade1ab52e", "value": "5fe03bcd1e6e79da3e835d7d57aafe6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700598, "uuid": "b89acf3b-abcd-48c2-9605-314200d4bba1", "value": "3072:x62j7/wZ5ruLFBk9Oz2XL3EDBr4v9yTzbXKi:02k5ruL/k9ymbpWHXKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700598, "uuid": "cfadbd77-4ebd-44ec-9faa-7159d3e730af", "value": 126224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700598, "uuid": "f96e4595-b05f-4d7c-86dd-33462535af78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700598, "uuid": "f527b17b-5b75-4b7e-841b-2f6c25724223", "value": "fc7208da63adeb550dd3629acf9c473665aa559101cc511e1449cd4e2b3e4787", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d88a9d2-7d63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755652483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652483, "uuid": "5aa948d5-bf09-4ab2-9e4c-16a5a2514c93", "comment": "Malware payload (Mirai)", "value": "9bbf8af3569be4eda3933ef7ec31ff62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652483, "uuid": "a270392a-51d0-4496-8dde-136e7e3f90af", "comment": "Malware payload (Mirai)", "value": "fcba52adbec0c1ffe79be9a3d94f56188b173918432e793a6cc4b530c7f995cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652483, "uuid": "417082c3-abbb-4ba9-b1ec-c3a11f3ae9ca", "comment": "Malware payload (Mirai)", "value": "e4482371b58d547977d1b042969c755240a0228d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755652483, "uuid": "336d431c-7933-4540-aeb2-3c2eb98b1810", "comment": "Malware payload (Mirai)", "value": "015ac769a0fbb8b7523a5b85e5a3626074afbc43b6ee21125ca785281594727a15ec67a2d7171aaf406bf3a57c1387b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652483, "uuid": "868ca4c2-b18d-4b13-bf7d-fc792a48e611", "value": "T1A7F31945F8414F13C5D612BBFB5E528C3B2613E9D3EA72039E215F20379649B0E7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652483, "uuid": "6aa86d4e-6f93-4e62-b26f-bf1eb1f1a5a1", "value": "3072:G8HYITB08TIKBbM4gIJL3UHxAuzNg6hh1nU:G8VK8MK5M4gk3URnNvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755652483, "uuid": "202fa9b2-b9b2-42ae-b918-bce2e641848d", "value": 171488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755652483, "uuid": "5d3e80d2-de7d-4dda-83c8-4d458a809d90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755652483, "uuid": "d763fdf5-c071-4324-b114-94148158a5f2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de383b8-7d85-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755667301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667301, "uuid": "61394b6d-81af-4456-87c0-99e6fe18a7dc", "comment": "Malware payload (Mirai)", "value": "38e707453e1778f807e8c1fca27b7b59", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667301, "uuid": "279af533-a0f2-4381-b947-3132d11f9703", "comment": "Malware payload (Mirai)", "value": "fcc3b7e45fb124e5ae729277dc13b7a469e456ad1af314508bfe5273266f2c8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667301, "uuid": "841e4233-81e7-41ad-8d08-14978540185e", "comment": "Malware payload (Mirai)", "value": "1603b7d89eab96cb4b760d44bb82aa92bae8a80d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755667301, "uuid": "eb8a2a28-6ede-46c0-8b9a-682541c3fe29", "comment": "Malware payload (Mirai)", "value": "b740dd0ac1d9fade453c9ea04b2b8915421ce25201b3c8943a6604cfc3b1e1a40ce50fc61dae74537125bd6b09b0c262", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667301, "uuid": "d5056f07-b81a-4f36-83d8-19a747b8db8a", "value": "T1C1114DEEB31154019B284FCC30755428BADD86E876954F98E4BC44BA639CB1CFB35F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667301, "uuid": "3dc6ecab-8f65-42d4-bef4-e6135b4b82c2", "value": "12:qlUSsVUUNIOOAU1NK4HUFEUbUWTpwUA/YsHULKAUSvHUCcAUAHAUR:qW2UNIf7K97IWTp1A70+lPCgGHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755667301, "uuid": "70443fa0-8946-414e-b70a-b1a3b0061660", "value": 1090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755667301, "uuid": "c748deeb-1e62-4793-8cc8-f302fcd2d26d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755667301, "uuid": "ca6a8553-6462-4f25-b0f8-516d3bb4c1f0", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3510abf-7dc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1755695684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695684, "uuid": "ffa53cea-a03e-42ce-b17c-5ecdfcc6ead5", "comment": "Malware payload (Mirai)", "value": "8dec4234fa1b7ae464a4d4a5e0368342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695684, "uuid": "23e10c8b-e17e-43fa-9f14-b21a34815432", "comment": "Malware payload (Mirai)", "value": "fccfb92f7f7237a09f4571f7ffe40e1e1fdbd2bcdec8c9b2bdc38ee386526f3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695684, "uuid": "b59ce07c-e062-495f-a5e2-c6aa93818842", "comment": "Malware payload (Mirai)", "value": "4bd6dba0782fcdae0e120912cf1335241c1e2f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755695684, "uuid": "662ded9b-5f5b-4636-8f10-7e080b73b194", "comment": "Malware payload (Mirai)", "value": "eadb2c5bf46e280ec4d2e3e429392f4c320fc2916acc02a856d6c489ff6b8e9e64f8f09f6ef70816d2fbdbc96c1ee218", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695684, "uuid": "e439e328-fab5-467b-9723-4f42b4a577b1", "value": "T136E38C23E8259E98C156C074B069AF781F63D1E592431FBA2AF2C2B4448BDCDB505FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695684, "uuid": "156bea06-a338-4c04-85c9-1c0f32737591", "value": "3072:/4kWSffD+mG9sn9cadEHQ5NYkcvPvmWT32gV6hh1kU:/4jQD+cn9Qw5NdMzTGgjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755695684, "uuid": "660bbbc7-ad54-4c81-8370-f7723a7f8a13", "value": 157248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755695684, "uuid": "2bfc1926-525e-4eda-95a5-0b7aa00eb524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755695684, "uuid": "dde9294a-4808-4deb-bcf7-160b67ff2881", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ac1b92-7dec-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755711448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711448, "uuid": "7481d7fd-c1f8-4e8b-a827-7cf5acdc2d77", "comment": "Malware payload", "value": "599327bc8b49a84220db3a9a18cc0c6e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711448, "uuid": "1b611b95-9692-4ff2-a454-3d947c99a393", "comment": "Malware payload", "value": "fd50e3a619a0c26822668f9a09fca4cb6fe6e395239ddcd42e803cb092d4086f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711448, "uuid": "135b91e9-3cee-4c52-9c0f-da0a0b096edc", "comment": "Malware payload", "value": "0e64b744aaed1264a5f79242e8f8ea4a947a82ec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755711448, "uuid": "90a0634b-21a9-43cb-9a99-f2e8be1b20cb", "comment": "Malware payload", "value": "bde8f2fd36abf2017c208a86dc802de6079f0f193d2e7b6b9cacea402d691928fba1499538c2d45ed002b4ea53a3cd34", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711448, "uuid": "b3dcea5d-c17c-4ddb-b2de-ac15361bbe91", "value": "T138762386F729A10EC8F3D3325975133A5162DE128B43E78B655473B8A8BBBE40F417D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711448, "uuid": "e2615a25-5c6e-47d1-85f8-ade78313d19c", "value": "196608:Ls28520ZQvqHH6c9OnOtwWU2VnxcwTwQ/43mr8Zq5TDB253:Ls2U20uvtcOnUxNDUQvrs4V253", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755711448, "uuid": "0a17d7d3-af03-465e-9281-aab401acc924", "value": 7514651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755711448, "uuid": "f7488f02-4f1b-4b24-a8de-0b17b2f4f5fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755711448, "uuid": "233f40ce-7008-4008-b8d8-430dcee8740a", "value": "fd50e3a619a0c26822668f9a09fca4cb6fe6e395239ddcd42e803cb092d4086f_detected_by_motmaenbash.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660604ab-7dd3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700735, "uuid": "cfc32d09-2f03-4b07-971f-b4322a4346c2", "comment": "Malware payload", "value": "ea7025fe2247dd652661ca4a43f83656", "object_relation": "md5", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700735, "uuid": "7aa09885-9876-48b4-b1cf-61d3ef19a00e", "comment": "Malware payload", "value": "fea967eb05273c711896676f82a53e941d169dd7c8bd355a8a61408a835795a1", "object_relation": "sha256", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700735, "uuid": "80048c1a-0d30-49b0-adaa-2c998667b442", "comment": "Malware payload", "value": "f2a6aa7fb54e3a8001c48fa8c6d40cd14b4131b3", "object_relation": "sha1", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700735, "uuid": "fc30a33a-9464-4cc3-977c-336e6a832851", "comment": "Malware payload", "value": "37a9c750d766d66e89bfc784cda7134e7b5c3809c56c364f19d73fc6dc5f47621cc5eaecc19239af44b86f933dc6f1f0", "object_relation": "sha3-384", "Tag": [ { "name": "Chengdu-Yunqi-Technology-Co-Ltd", "colour": "#2FD418", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700735, "uuid": "0ac5004f-a5d4-470b-a7e9-291da9afb5ef", "value": "T1C0E5BE07FF8699A2D8A6403913F753BF8E3999149724C6D3DB9214AD88315D0B73F3A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700735, "uuid": "176d47d6-477d-48b4-92d1-2b559ce7c311", "value": "95bf1e1bdd0a105f5ccd757e3d0d2065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700735, "uuid": "753a1455-18b9-4988-8440-a72a9e90045d", "value": "49152:4brSfBiyI/QyrAnPK6XspQfo6SegPoe/PzsFehFeGeF6VKBHanRJJk:4brUBC6UD3ke/gEhE9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700735, "uuid": "167ddd40-f08e-43eb-9d19-af41214b4acd", "value": 3069192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700735, "uuid": "e6636961-291c-4faa-abb1-d1cdbe121596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700735, "uuid": "38e4a485-d232-4b75-94ae-227fd8ad3a51", "value": "fea967eb05273c711896676f82a53e941d169dd7c8bd355a8a61408a835795a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e79bc-7dd9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1755703177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703177, "uuid": "6aa15fd4-11c9-41cb-98e4-d71e3606c317", "comment": "Malware payload (Rhadamanthys)", "value": "e4b3b0fd69a82cab356cf376dd5664bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703177, "uuid": "97f0a8b4-c467-45c2-b252-4ba3065c1d5e", "comment": "Malware payload (Rhadamanthys)", "value": "ffc68bcc194b6cc3de0564c5e05d01764c3163250348455039779fd342d26d3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703177, "uuid": "8186d20a-f93e-458d-b575-4bed86622d48", "comment": "Malware payload (Rhadamanthys)", "value": "b7a65d8e9a0ef3701893663b9b5b66c97406d62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755703177, "uuid": "3158f4d6-e40e-4165-8610-93b4b54dc487", "comment": "Malware payload (Rhadamanthys)", "value": "c27f95504909899be879298e1422fa773974890b12bb375ed440bbde9db20d2c1465798bac2f17e90df65ec530e8d84d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703177, "uuid": "c460619d-87fc-4bf5-8a06-23c732d22000", "value": "T1E0169EE3752BD1DFC24988B8A6028E435C1697F3E605F617EC193DAF8A72DB253C6604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703177, "uuid": "fa40ecd7-e469-4224-9a01-961e523d8996", "value": "979d4d3c19bd1d7e944b1ba868d6cce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703177, "uuid": "8bdd938f-9dec-439a-bea9-f6069f063e3f", "value": "98304:6E4EJw7WcZylpDdSubnBn7u6XUEASaQgtbcQi51w0flx8OnlA44NISRCJ:cEJwycElpDoubBCIUEucR7w0fr8OQISm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755703177, "uuid": "ca23f2c2-52a4-4b4d-aa00-533b3fb617cf", "value": 4375944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755703177, "uuid": "5723853e-63b9-444a-be44-35230bbe7b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755703177, "uuid": "4da18141-09ed-4dc5-a32c-7d5a676b32d2", "value": "SecuriteInfo.com.Win32.MalwareX-gen.97445616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e884fe60-7dd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1755700524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700524, "uuid": "a6165980-bf9c-4569-b3b4-c988818b80fa", "comment": "Malware payload", "value": "6bd652d961e49a5b3b473542c03364fb", "object_relation": "md5", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700524, "uuid": "327695d3-2c17-40b3-b34e-f70748fdf525", "comment": "Malware payload", "value": "ffc8fb328fae40f126bdc78d5238b23d2d9391778e6382c3ed822fa6bd6453da", "object_relation": "sha256", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700524, "uuid": "99ffc86c-ed7d-4a91-9a91-26348690c029", "comment": "Malware payload", "value": "746126222438dda69b54de1c68d531852d6bbb08", "object_relation": "sha1", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1755700524, "uuid": "269798f3-96a0-4a7d-8493-898da1f71078", "comment": "Malware payload", "value": "fda4b9eadf793fdae130516a6142f64b88ccdbbb73ed25ad7b03c6da89da2aacbfe8877750e5041eb74011e19eb93e21", "object_relation": "sha3-384", "Tag": [ { "name": "Anhui-Star-Wars-Information-Technology-Co-Ltd", "colour": "#97E43F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700524, "uuid": "29cbb8b8-f72f-4994-8431-4bb161360ae4", "value": "T150C5BE0BFF8295A2D8CE417D12B757BF4D3989188724D6D38FA118ADA8316C0673F399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700524, "uuid": "b7c849b6-2f89-4be2-9a7d-3ef56d05b194", "value": "3ed197b1eed7c143f973af5735464411", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700524, "uuid": "952b5615-8f14-42b5-aab6-cfa4e2154b30", "value": "49152:DDroxawVMC1gRFPrDWv5YavP6mTz6+FyVKBHanRJJV:DDrb3FGBY9mRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1755700524, "uuid": "50b33443-3ac3-420f-b106-56005b263303", "value": 2670800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1755700524, "uuid": "0ae5b0a5-07c6-444a-9f8a-7f56132618ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1755700524, "uuid": "b4bef2b6-89eb-442a-a038-68dd4a417673", "value": "ffc8fb328fae40f126bdc78d5238b23d2d9391778e6382c3ed822fa6bd6453da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }