{ "Event": { "published": true, "date": "2026-05-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-08", "timestamp": 1778284982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e4213add-52cd-4ad2-8e7c-37ce5a8af1ce", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3151738-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778242678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242678, "uuid": "cbbf0dd5-ea2c-4b34-9985-cd1c95d3a4c1", "comment": "Malware payload (VIPKeylogger)", "value": "dd671ba4eed25df26106aeceeadd3fb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242678, "uuid": "bb006d8f-09c1-410a-9e50-3c37fe9d59c5", "comment": "Malware payload (VIPKeylogger)", "value": "004ce76ec3b82be182e1b3da568124bb10ab733044f3c8e840e129ca6a92dc0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242678, "uuid": "306f40eb-adf0-461e-ab69-3922187848a3", "comment": "Malware payload (VIPKeylogger)", "value": "b3aa0c380179ee8fb9fdeef54b5a816a950a2d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242678, "uuid": "fff5a0f8-d17b-4978-be44-e6713a1f5c08", "comment": "Malware payload (VIPKeylogger)", "value": "05833d41336e3ff0300b0162573c158a5004c23d065b766ecfac05c7953c82291cb0ae951a095d0a042de535bc3e95fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242678, "uuid": "c7bc5d85-6068-47ad-be06-175b7e8359c6", "value": "T11E358D0E3381B023FF56BD324A56E3114678691601E3AD1F1A782B7DB9713F30A3E666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242678, "uuid": "2c6daad2-6db0-4013-af80-ccd1c7b88413", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242678, "uuid": "f8f66a5f-7470-403c-80f7-93791451bee3", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdairsYTBWLWR:FPVt/LZeJbInQRaMHtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242678, "uuid": "09466606-8b1e-4707-b458-9c062e0a5f7f", "value": 1159680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242678, "uuid": "f0532369-54e8-4d81-b45f-42db78a85c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242678, "uuid": "05a7bfac-cf03-4dd1-bb0c-5444dc78437a", "value": "004ce76ec3b82be182e1b3da568124bb10ab733044f3c8e840e129ca6a92dc0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e496063-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242535, "uuid": "118393e8-9e4f-4217-89ab-74ac169e9328", "comment": "Malware payload (Formbook)", "value": "e05db9f6a6f5867675c27c9ed2fa529c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242535, "uuid": "a9209273-e5a1-4aa5-81d2-2babb38d4966", "comment": "Malware payload (Formbook)", "value": "004f4b8d4377498e52de6b9d4bccec0c6af4fe513b2beaf28e518db633978d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242535, "uuid": "d7961c87-557b-4b03-a7cc-60ff45ace587", "comment": "Malware payload (Formbook)", "value": "d2561ec173a3f1b2d0a4d269f9fd55ba5c75362f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242535, "uuid": "aeffaf85-cd2d-4d5f-9ce9-54f31d743296", "comment": "Malware payload (Formbook)", "value": "833c47d1af1f2f7245af66bc1667401f54ecb0dda187cbb50ebde10fba87d18dd297aa88ce5765c73234d706c4caa7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242535, "uuid": "e534275f-4ea1-4fd7-8ea5-eead9ad4f170", "value": "T11D350289125ADE01C9961BF80C70F3B553B85D9CB020D3878EFABDEFB86E7112556293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242535, "uuid": "5aa021ad-e8bd-4854-997c-b37098f8bf89", "value": "24576:g7/gmt8Mzorr7Vm/gHLefgwi2woRGyzz3QhJn6BJrfZ67V7b437:g7/gM8MEVmoHLef42TRvzOUfEV7A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242535, "uuid": "87597211-acbb-4beb-8155-e8228dbe8a1b", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242535, "uuid": "f5e12660-b47a-4639-b378-1d209d8ab795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242535, "uuid": "7cf3174e-4aa3-4a85-8064-ae43dfd14e9e", "value": "004f4b8d4377498e52de6b9d4bccec0c6af4fe513b2beaf28e518db633978d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3932d6-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243287, "uuid": "c8400fd4-a27f-409b-ad2f-fa9d9c441b52", "comment": "Malware payload (PhantomStealer)", "value": "1e75c3b94ada9d29a2862f38f46620bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243287, "uuid": "9506d113-bdb3-48a1-afe9-4f336995ac91", "comment": "Malware payload (PhantomStealer)", "value": "005bf4aa6ca9290c590b1f72f013b0666f2fc23bf6d68e206f76885c478c6c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243287, "uuid": "80be8466-04f0-4f63-b81f-cbd7efc2255a", "comment": "Malware payload (PhantomStealer)", "value": "3ff45bd63d65bad7e53b731c6de7554d934d3bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243287, "uuid": "5ed7feb2-30b8-4c07-82d7-a73cb2e97459", "comment": "Malware payload (PhantomStealer)", "value": "fe9fff13a1692ea31f24e20935928f164f7e0b77ad02b29ac6ce5160d9f4b18b8557ac4ff150bbd87ae96bd86f761b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243287, "uuid": "b04fb4b3-f8f0-4086-9365-a9e5b2a47fc9", "value": "T19595CF16D9A28686C016C573C1E8D57002E96F69602DC202CBF17DA77BB778E2E4FF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243287, "uuid": "246674c8-4572-4547-9bd1-eabe4527dbf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243287, "uuid": "fb9a19d2-d27c-4ff3-9829-0c755e407740", "value": "49152:dqUwwoYwGrweecB0VV1SgXYGqzFH/WyJ58Dh:drw1rGjei0VDoGINWyXGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243287, "uuid": "07ce61d7-0655-4e4b-975c-1fbbc8a3b848", "value": 1908224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243287, "uuid": "4fd6a7e2-4a34-4868-94b6-c6c52cf4f6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243287, "uuid": "56593101-ac49-47d1-8cae-fb7c6b6f149b", "value": "005bf4aa6ca9290c590b1f72f013b0666f2fc23bf6d68e206f76885c478c6c37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8e69f7-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246663, "uuid": "b332c48b-d2c5-48fa-8413-5839531dfd63", "comment": "Malware payload", "value": "5ac585850874ede4e16d48ccf791b936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246663, "uuid": "d51e4285-b9ee-4176-88c5-233a25dae2c4", "comment": "Malware payload", "value": "00b31ab3950de5d0582462c4dfb1c63ad6e3d61d6203aff73e5069d998b3e5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246663, "uuid": "28332c74-9b6d-4a23-a1a1-06c818de9451", "comment": "Malware payload", "value": "ef8f6f2c939e05ff12d6ae991943073d81e6497b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246663, "uuid": "0bb9f0ff-f054-4ddc-8b79-87b71b146d6e", "comment": "Malware payload", "value": "0dd01506fa679deab8d39a90d2a32826a35013fa9d397d28c49b32170e20f23598dbe1fb6f222c5e98b3e3e8f43799a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246663, "uuid": "8ff6f49d-0c3c-4892-ae8a-d51b8a8ba677", "value": "T15705CFC55E575A89C33E2BB8C0524881B3F0C943C79BD7ABAEDC15EA6A53BD8CE03541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246663, "uuid": "67d66012-d62b-4753-ac50-98c9a6aa5b99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246663, "uuid": "d1f3a98e-e109-4d01-8848-554482553795", "value": "12288:zG8vjf4rfCvQYFFlCXKwscS6LghoGFq4H/VYUa7KH+Gzxl:zG8bfUCIYFF+66LghoGFq4H/+Ua7KX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246663, "uuid": "ced46b87-29e3-41e4-be4f-f997ed7bdc34", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246663, "uuid": "390b65c9-7173-403d-88d9-7cb1cf80ed08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246663, "uuid": "39ba0972-d23c-4646-bf67-3aa8d11a1dc5", "value": "00b31ab3950de5d0582462c4dfb1c63ad6e3d61d6203aff73e5069d998b3e5aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62ca8c3-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778246011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246011, "uuid": "ed88f4fd-9a88-4235-876a-8f2998d06a62", "comment": "Malware payload (AsyncRAT)", "value": "993e266d819b2134c48f99e0eba0ec3e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246011, "uuid": "f47b5ff4-cfa2-4cce-aec1-18e77a34303b", "comment": "Malware payload (AsyncRAT)", "value": "00ba60e32d969137df6b8efdd6551c29106486a7fea4ac36c15bf0b074f26302", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246011, "uuid": "560a9351-eda7-450e-8164-cdfb42260cf2", "comment": "Malware payload (AsyncRAT)", "value": "741fe468b3fd6e534c37f3384e414b61363c2dc2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246011, "uuid": "3eed7ce1-4240-4ba6-96e3-78eafaabdea3", "comment": "Malware payload (AsyncRAT)", "value": "1acd383f5e87478b06e2338ba3cab25b06139986ce2032d113842d8331ff49ca5bb8bff635ac3f59162a6bec134d71fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246011, "uuid": "88a498cb-2ff3-4eca-bb84-79d7784ecfe5", "value": "T1F5F23B08F7904255CAEEAFF169B361190235E50BD923EB5E0CE485DB2F27AC0CD527E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246011, "uuid": "afed05a1-7c05-4eef-9f73-4997a9192b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246011, "uuid": "9dbf84dc-6175-4caf-a2fc-6a124c3ab498", "value": "768:eCg7KuEci9XB0U7gnV9Fp9jHOjhc/KHd:ed7KXJD2zFp9jHOjuyHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246011, "uuid": "01701663-ff8d-478e-a272-26782657dcbc", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246011, "uuid": "5be34438-e7bc-4432-a588-f9596fcb4654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246011, "uuid": "c90cb6c1-6920-4e1d-91ef-8c98c461356e", "value": "00ba60e32d969137df6b8efdd6551c29106486a7fea4ac36c15bf0b074f26302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741c3026-4b19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778270811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778270811, "uuid": "c3111a11-a1ea-4881-b900-6bd458ebd0f4", "comment": "Malware payload", "value": "90c42669d04e40cfcf145a1deb097a8e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778270811, "uuid": "dd4f83bd-6e9c-434f-963a-a485460a18fa", "comment": "Malware payload", "value": "01914660a0d11ef40e0d4bb43dad84716a9ac859097d73bfd15d66bab8f33b7d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778270811, "uuid": "7d242a50-d866-4946-989d-4b41e22ca84e", "comment": "Malware payload", "value": "e7780ff0b280758aea994a2bc9db22907e1b1b16", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778270811, "uuid": "73073848-a93c-4612-8e2a-574a0328fea2", "comment": "Malware payload", "value": "917fd8d713ddc6251f56bd732d314783b86f25420e19a3c300c2de2be98d783b1cefc53ec264fee7b16be955b25ca8de", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778270811, "uuid": "0ad2a927-e878-468a-a788-5addd65dc7d7", "value": "T19C669FBCB5C82DD65A5E12ABF9655CD803A71612C58BA4CF80D87AC3196F37DEF32804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778270811, "uuid": "b527302a-90f2-4b65-9af6-310446c43c39", "value": "24576:DHF8cWcEpdOSpbWwj6EttgHPZBXYxEhq0HR/N9KnyKB2oAC/5KsQoOahLR+FIWfO:I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778270811, "uuid": "44a27b56-c099-4456-8a97-997fc1a6f956", "value": 6861497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778270811, "uuid": "d66c5802-aee8-436b-86f9-17e9cb664c71", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778270811, "uuid": "8d4443b7-e16b-4f36-b424-7964e79962f5", "value": "winlogon_init.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774fbd68-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1778243759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243759, "uuid": "407f856f-87d0-4ed5-82e1-ab22337a6306", "comment": "Malware payload (DonutLoader)", "value": "c261639d4c0cc7b084e0ee0428400d2f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243759, "uuid": "926fce68-7db2-49e1-89f2-8e92ff828af3", "comment": "Malware payload (DonutLoader)", "value": "01add391a8f6c476e98971d480e7feb775072849e8c18f6151872f5cc88d1f02", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243759, "uuid": "bd701b50-700f-4126-ad58-ab61f1c19204", "comment": "Malware payload (DonutLoader)", "value": "41c656f1913a8432f4d54809d57714514814e078", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243759, "uuid": "137873a5-cde3-41eb-80cc-3f939df7af9d", "comment": "Malware payload (DonutLoader)", "value": "e8ce71d2ff70dfdd19b0b79de3fa5a50a920aed7fe7da93e08c0114297f7824a349e217b084246e1455c02dd651889ef", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243759, "uuid": "d8bf9e84-b89c-4036-aaac-d5a3edf71c7e", "value": "T15D04E042FA4768EDC130CB3CD7A76532EE3DBAE816101F2F897086363B61E611599DC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243759, "uuid": "4454b9aa-26c0-43f1-960d-6748d7b8b42e", "value": "b2f1b7e13754924954c53ce1be6ab6af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243759, "uuid": "807a5008-dfac-45a5-a98d-7ca1268a3ff3", "value": "3072:3Arwq60IYToYEddv7hpazq8eWo4CKyPedTfpidwwOL1+Kv95cwR:3Arwq60lTCXDhhR8CKy2pYdDhWik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243759, "uuid": "e271d9b4-09cb-4bbc-9c3c-bf0dca309dcb", "value": 185409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243759, "uuid": "378a45fd-eda2-4127-a591-aa9eca5e008b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243759, "uuid": "75f44a9d-65c1-4a6f-81cc-dedb5a657b7f", "value": "list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507ea79e-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1778246270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246270, "uuid": "3abe1a34-5b6f-4edf-ab9d-54a41f4a6f6a", "comment": "Malware payload (Stealc)", "value": "b1ed5ba271ab4cbb5a0c5121dfce2405", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246270, "uuid": "fdb259ff-feff-43ba-96a4-84c0e3815984", "comment": "Malware payload (Stealc)", "value": "0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246270, "uuid": "d219e94d-8e68-4566-b00b-18f636d3d0ba", "comment": "Malware payload (Stealc)", "value": "553d38ad0f09e10d20e42d38a71d787f40b415c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246270, "uuid": "a497136d-add1-436c-a574-5b82b417c55d", "comment": "Malware payload (Stealc)", "value": "999a8163408ee1f510701da08f01d81959757d88a7cae33b8090720560c5715912985fac0d1607ff233665a0d03bb993", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246270, "uuid": "356ef9fb-d49e-41a6-abab-9dfb39cf019d", "value": "T17FF48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246270, "uuid": "96bf87de-b6e2-4a8b-8d2c-425b6ef9add5", "value": "c5a49d74dbeba2b4cb56b327e236efe3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246270, "uuid": "48296e84-30aa-466a-8adb-3df1786afe49", "value": "12288:TrHqQr5XgvVozsROaYzPIP17vMKrNhYyxBlDetAqxSv:nPgvVqsI0d70eXYyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246270, "uuid": "24739436-4de7-49f7-beb9-3bd6c38a1e07", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246270, "uuid": "97393007-ddf2-4a34-800a-fc63ac181053", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246270, "uuid": "2b755f88-fe3b-452a-9c80-a8a7d501096b", "value": "0215f734867bd71c57ff5c524d8cc670be5b4f1861b2c390cf46d18784a53624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e15d83-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232780, "uuid": "a281fa0b-77ff-4cbe-b3fe-5d27e54cbe8f", "comment": "Malware payload", "value": "de8f28ac593e8a52e97f2e7d7fa29e21", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "E-Challan", "colour": "#506D91", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232780, "uuid": "bcdc0fd4-ecea-4a95-a53b-e39d0406208e", "comment": "Malware payload", "value": "0289bba171be701869f821fb0d1c9c9a69299a855555cb1f6281e404b997ade3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "E-Challan", "colour": "#506D91", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232780, "uuid": "c1a85673-1ece-4af1-8485-83e99265d4fd", "comment": "Malware payload", "value": "68de21524a4f71d85b6e9c08e346d4becad73a9f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "E-Challan", "colour": "#506D91", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232780, "uuid": "06e06009-9064-4d94-bd9c-ed1538119d2d", "comment": "Malware payload", "value": "100c07cdf7f6b70d603485b0c98388dd2054d11710a0181836dd39c23c3736d9b9fcf1e37c23e0f5c8bf2f6bed2f20bd", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "E-Challan", "colour": "#506D91", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232780, "uuid": "cf4c356d-b3af-4058-a56f-5ad27f01e9b8", "value": "T1B6F6BD23F5156996CDD6A131F5E313A536341E980393A239271FF026FDF25CECA62AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232780, "uuid": "09e07336-8089-4a46-a027-a4cb2e77da2d", "value": "393216:FQkFAvhR6xAwqZOQN4/CQSDjBmOY/ojTmpb:6jwqZo/V8BmOYAnmpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232780, "uuid": "140ac9b4-ac0a-4241-936a-ad81452ea211", "value": 16184926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232780, "uuid": "6e7b2d55-9074-4411-be1e-204c40d85e24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232780, "uuid": "9e7697d9-13f6-4b46-9eab-26a7da2de41e", "value": "1768058355_\u0415-\u0421h\u0430\u217c\u217c\u0430\u0578.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b304baa7-4a77-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778201339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778201339, "uuid": "116700f4-abbb-4712-bf90-baab163488ce", "comment": "Malware payload", "value": "0d603b4e2962a18a31ead60e29d587a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778201339, "uuid": "99c48b02-703b-4777-a67a-1ead25c537fa", "comment": "Malware payload", "value": "02bbeb547beab534085a90b13fe2fa66ef97d3a4e04c4a74166c106015db3e93", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778201339, "uuid": "926a7a46-bce4-4d68-8f5a-f13d3690b04a", "comment": "Malware payload", "value": "398710cee9a3fe7a3dc4cfa90912d3f00c9acec3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778201339, "uuid": "84b6b8ce-ca51-4293-8a15-7b482ef5d721", "comment": "Malware payload", "value": "7ef8c6a89529c8e15ade05f03231d7eb76a1de168cae455e047813110c6d517b8bb99ffddf8c135694a1f76367173fe4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778201339, "uuid": "5ab92a8d-4cb4-45bc-aa2f-10c0166e9fdc", "value": "T1FB137D6956817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49A9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778201339, "uuid": "5f2523e1-433a-4552-be49-635a5964a904", "value": "768:ba+B9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:ba+qco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778201339, "uuid": "6ba9d3ee-3e60-46c1-9002-4dc78a23407e", "value": 45424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778201339, "uuid": "9fda7e51-abbb-4f72-9c9d-500bf0a8ee4a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778201339, "uuid": "e13a8fe0-e0b8-46e2-8419-927b218f327c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70dd5b6d-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246754, "uuid": "ace25003-5c95-4bdb-8b09-51a8782125cf", "comment": "Malware payload (RemcosRAT)", "value": "86185afb97a0db1f38e69dda22d0daae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246754, "uuid": "9a8d98db-de25-41bb-8163-98c6b4352570", "comment": "Malware payload (RemcosRAT)", "value": "0376617195eb48e9b32ec89e7a58ed1b8867c9bb1f6bd346b22b1f9f377d772c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246754, "uuid": "891e5947-28e2-431f-8f91-1226e9b22339", "comment": "Malware payload (RemcosRAT)", "value": "7c6c9a602d16b45902a22a185d069b77ad7fc928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246754, "uuid": "bcf72da1-0ded-465e-b5ab-d3e03fc128ce", "comment": "Malware payload (RemcosRAT)", "value": "03373a7695d3b5f1665ee28a64a82cb033b6a5e26ba3bdcbd3476abccfb9502a1c3b812cb8f497273545f202d6b23af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246754, "uuid": "b5570cbc-63a5-4699-8e33-078602dfdd0c", "value": "T1575522887268DF02E8656BFD4879F1751BB80ECE6411D30A8FEABDFBB476B144854243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246754, "uuid": "5193c320-2f4d-4bfe-b6e8-54df54153ddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246754, "uuid": "e4c9217b-b5a0-4304-845c-b2cc5ce579e7", "value": "24576:cwe/2f2O5TCiSq00vKV09Og6rihHSBiROY+pe6hqRYR:RaPOpCiXLqKOjriNnOY+pr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246754, "uuid": "3c89628e-8ebb-4ee3-8edb-57af9af9b96b", "value": 1311232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246754, "uuid": "75b8e8be-e4c6-4e3b-a375-efca935fb646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246754, "uuid": "3664eb6e-0ab8-441d-be46-e90edd3c6d5a", "value": "0376617195eb48e9b32ec89e7a58ed1b8867c9bb1f6bd346b22b1f9f377d772c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a626a-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242829, "uuid": "d73d5995-148c-4157-9d13-24cb839403b7", "comment": "Malware payload (Formbook)", "value": "b420754cd47c9369717bd8ad013becb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242829, "uuid": "c37c2a3a-e6da-4995-bd4e-be245e885c82", "comment": "Malware payload (Formbook)", "value": "03be40d7431b3183f26a5cc7dfd083dd06c7c9240e35b01dfc8bdf6c18bb33bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242829, "uuid": "a6ae64e0-fcaa-4335-9512-1b08383fc7b0", "comment": "Malware payload (Formbook)", "value": "124f82617d43bf20426012207d4b48ac8874ea1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242829, "uuid": "9d351530-62b5-4f90-9312-fb01a4beae0d", "comment": "Malware payload (Formbook)", "value": "ab489f7bd3dc6bf254dff7e9de4d430c081c80212be8d4833311d3209ccaf96d0259cdbaf3f3cefb533fb723276b7a3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242829, "uuid": "e23ea8f7-0a0c-42e6-ba31-7b315cfdcb15", "value": "T1465423418B5EF950EABFA6F32CD761CF2465BA38117F2D0B97139CD0622A1D3485AA03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242829, "uuid": "7e3328c1-ab66-4113-bb2a-8f27aec609c2", "value": "6144:6XyeBiHmyaTFJbnVdTSMoetZIEXpk2mXtRcKxzLY/dUiqotWVt1TxNBgH:oPBiHmZBJbnfDFtZlX6sRU+4PB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242829, "uuid": "5b3ae322-3a05-4c2c-9670-7db3da356786", "value": 285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242829, "uuid": "76d59e86-0511-4d07-a8cf-f1a0da651689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242829, "uuid": "3dd31772-827e-444f-ac18-6f21b96f269b", "value": "03be40d7431b3183f26a5cc7dfd083dd06c7c9240e35b01dfc8bdf6c18bb33bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb823510-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243953, "uuid": "b42870f4-4a99-43de-bd8b-3deca533c47b", "comment": "Malware payload", "value": "64929c582647524029c0bd9cb10adef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243953, "uuid": "17b08652-a5a7-4f15-85a2-ce02c32e5933", "comment": "Malware payload", "value": "0428b8b5212d95d891fd4eda7d9b1adfcdc9ab616654a260e14ca6c16cbbaa83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243953, "uuid": "63836b64-d034-4ee0-892d-ddcbffea2472", "comment": "Malware payload", "value": "043cde941bbf3486e52bb393e9662438a0c3e465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243953, "uuid": "9f11618c-7ff7-4a13-88e4-d75f55c0c99f", "comment": "Malware payload", "value": "8034189167223d5298c89c4e411a79da72924db84dbf26b33d92848c0f7444120730af5456ce07667536f71b31e84507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243953, "uuid": "392861f5-9350-416f-868e-ccb31f8aae62", "value": "T11285F06527D54B58F07E9779EB732A1047F0F803EE72EB8EAE49219E4A32B51C911313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243953, "uuid": "e09877d9-e74c-4c36-9362-50967bee2f02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243953, "uuid": "c615d536-061f-4ef9-8ac8-a9acc527568c", "value": "24576:i0oFRj0Ud/NKB4kv5sEU0+0/eS9BrVXqI+TRfKBq:ibvjXSZH/pVaIWxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243953, "uuid": "c1a2f33d-ae01-4982-9d71-618bd014d4d9", "value": 1766400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243953, "uuid": "ecc6e0e9-9eb8-44f1-ab24-6fee3d2cb187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243953, "uuid": "bc890324-86a2-4885-a691-509fa7231136", "value": "0428b8b5212d95d891fd4eda7d9b1adfcdc9ab616654a260e14ca6c16cbbaa83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9b7a29-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243096, "uuid": "02354053-11f7-457c-acc4-00138cd9eef5", "comment": "Malware payload (GuLoader)", "value": "b9897b6475a8047e3f3581c3ff3953a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243096, "uuid": "2ed3efa4-4adc-40fb-a494-999481e721cf", "comment": "Malware payload (GuLoader)", "value": "044e045a439091b9af74217fb82a0493bf0f2e23b3a287172a6ac22a0d9541b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243096, "uuid": "84c58a20-acf2-4050-a8ea-026c62accd6d", "comment": "Malware payload (GuLoader)", "value": "9318b0f4d203b3288af38fab85cd318ba223404c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243096, "uuid": "915d1a22-0d1c-4bfc-b929-6e7bea847526", "comment": "Malware payload (GuLoader)", "value": "3f7acb6ac4a4e37c8416d454f57c0d9cbb4a1d5165e962b97686bb8f487017d6b2ccfe753bde606628f165ba8aeafca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243096, "uuid": "2da3c119-19c0-4256-9b20-d13178686ade", "value": "T1C264124BA330D07BD2391AB04D3E97E28FC6DB041095A78F73949BDEB822665C70E756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243096, "uuid": "ad8dac98-0d77-4100-bbba-3d0213ab2aab", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243096, "uuid": "9e9697c3-3ea2-4679-9c69-d1065d2c35b7", "value": "6144:rqjIcRfK1VTBpAfa5InoeRVTME74l6Y7pGluTUOctZrI2SsOBBEWNRyj:2VRcSC5oRqY4LIkcblFPwRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243096, "uuid": "23190dc4-c1d5-4f99-aa28-b3160615cbac", "value": 320864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243096, "uuid": "96925c00-1863-49bd-9b18-6264e1fb16a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243096, "uuid": "b669e0de-b171-42b7-b21c-8c3b6aa88a74", "value": "044e045a439091b9af74217fb82a0493bf0f2e23b3a287172a6ac22a0d9541b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e390e562-4b08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778263697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263697, "uuid": "5cb2b3e0-b781-4882-ba01-c7ce0e2f8023", "comment": "Malware payload", "value": "7fe7e8c3b5ffa8a69ece38196ee3f7d1", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263697, "uuid": "e544d251-70d0-4423-9f91-39bb4969c1a3", "comment": "Malware payload", "value": "0455e4cb8633c16e918aa08e3e602f3d1b441bf4bb1aaa6588446af97783bb78", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263697, "uuid": "53b2cb21-7c7a-463b-b8a7-d14af6f4773e", "comment": "Malware payload", "value": "d298f44293f9b074a379465aae0c5ae01716dcb4", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263697, "uuid": "33234397-9cb7-4db5-bad3-3a530d5b40e4", "comment": "Malware payload", "value": "56c2f20da9899bd0baa31117566a6a9d785b308e17b9fda9c0aaa3e57b43a1f651a48c6c89a1dd2383f3e95d2a992deb", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263697, "uuid": "8560179f-5cd1-428a-9605-fdf709ba6d7c", "value": "T125B423279C32665DE9E18070150FE9FBA49823BE17913136CCCADFA0947C5F8E6FA512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263697, "uuid": "e1558ca9-c3f4-4d7e-9a98-4d6188409ec0", "value": "55395f8f9ce057344afeef3409f7b5c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263697, "uuid": "a93eaf00-63c9-4a19-b383-c9ec5c6f706b", "value": "12288:ewz+uAESTF8gxXO5DxpY3OZ14GnUF0D7Ao9d1xexBuVBFn:ewCuAEmxe5Dw3M4GnxVf7WwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778263697, "uuid": "53ed1d47-e6bc-4bc9-8151-7f5371505a35", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778263697, "uuid": "50a59d5b-a136-4bc5-a206-987f105adb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263697, "uuid": "7e3754e8-19a4-4c5b-b9a5-83c68eeb62e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac22717-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231014, "uuid": "294578eb-4f82-41c4-9578-c84f10c2442e", "comment": "Malware payload", "value": "dec94255e771857982f6ab2a2908e494", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231014, "uuid": "84d572fd-3547-4cac-817e-719b75ca426b", "comment": "Malware payload", "value": "046cd600aa29823f76f89b530b564d99c7277e4b21aa15245b33057e8c118be2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231014, "uuid": "e406c7e3-eb18-484c-b27b-0edf24f8cd6c", "comment": "Malware payload", "value": "e7a2dffad4df3adca5ce4d93bf79463f55f9c4ea", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231014, "uuid": "3bad69ea-fad4-463c-bb15-9f214aebe6f2", "comment": "Malware payload", "value": "96146d8b7568818752410d1e6a15c756ccdfa706e0f6ec83fc63b78081dec1830dfb42b012bd4f18da284032064acb9a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231014, "uuid": "29066a33-8d9f-414f-8ead-6b7e48a6fef9", "value": "T1C3F6220BF308A96BD5F34335B936437A651B0D354F43CA876860B23D6AB76C05A6EBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231014, "uuid": "4bbf3946-813f-4f37-ae4c-000cad8a83f5", "value": "196608:9dOwmtFL3WuE+83N1XKgPhfngp+jUWC7IUfdtkaLwIhunp7GVg3wWtmRepODiXR7:gW1a8hfnS+jUnvTkaLL4npCVgI+Xcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231014, "uuid": "d42226fb-e836-4f33-9506-eae671bdd72c", "value": 16781991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231014, "uuid": "421933dd-a71c-4dae-ab69-41046e97a2ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231014, "uuid": "2041f893-9880-4e5c-a343-f91a299926e6", "value": "IndusMobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986a884f-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233936, "uuid": "b379b5d3-dfca-4364-909c-b1a98b4fd49a", "comment": "Malware payload", "value": "c5ac3fa0f333d3d2a363c3858b79c5a8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Winmate", "colour": "#7006A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233936, "uuid": "f27e0c3c-9d67-484e-a9c0-9a2ed224a145", "comment": "Malware payload", "value": "049db028ac8f2fb4bf12d812df976b2078e753f14dda55f0275141df0c430f1d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Winmate", "colour": "#7006A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233936, "uuid": "38ab53d5-bbc9-4f0a-815b-37e7cc3d0e1c", "comment": "Malware payload", "value": "cc3ada299f590cd123f8ffc439e55bd5d017c2d1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Winmate", "colour": "#7006A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233936, "uuid": "a2b59f43-cb84-4ccb-add9-ce0bb98d6a22", "comment": "Malware payload", "value": "8c31987f96456d770ba17db5376b1d306431021151029d59c538121fc4f196b582e0614594f6d5edc46299345b9373a8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Winmate", "colour": "#7006A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233936, "uuid": "b13a778e-d300-4e1a-808f-e86762605f74", "value": "T138773322A77B446EC4BA647F086826F157AA0E41C526E72F55703235FA33B904F94FF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233936, "uuid": "3f78f9a2-72e9-466a-85d9-9a355fb98db4", "value": "786432:hfuQD+dkRb8EWYnxvp0qgQFicXZko+Htb1c9m1U5xjrMRXWzbX:96d0jWYxh0q5icpkpHR1ymsdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233936, "uuid": "a6527b17-808c-42a9-882b-f651aed2d7bf", "value": 33176686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233936, "uuid": "80594706-17f0-4c44-b3b0-879be73cb91e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233936, "uuid": "9d1070e1-fc53-48d2-8bdb-14de46c2b3c4", "value": "WinMate_VM5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9aba60-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246613, "uuid": "5574b71d-33e8-4cb2-aa98-fee83078d1fc", "comment": "Malware payload (PhantomStealer)", "value": "e783eb927a52fefab00a0f68e25e743c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246613, "uuid": "2e9b2685-ac1d-4d71-baf6-35191c65cd62", "comment": "Malware payload (PhantomStealer)", "value": "0524c4d56f8fa57db4c13fa165df8b04adeda8c9b9026f94915a1b671f3faf52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246613, "uuid": "fbe1999d-173e-4adc-8dc5-6fe0d982ffec", "comment": "Malware payload (PhantomStealer)", "value": "61c93877aa6843ff3fde255e35584bbb04346257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246613, "uuid": "02f5c420-9a10-433e-a1d7-b9a0f40c5a98", "comment": "Malware payload (PhantomStealer)", "value": "9bbd6259eeb2c57fadc126f8329bfde99ab8b7bf169c2e86bba2a5e04e1dd6d0026497c41f124f2de64a83cfdae4f0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246613, "uuid": "8ae0aacf-7467-4bbd-891e-ef397f3fcd6a", "value": "T174C5CE05F3E216BBF6A68730C6954336D671F4C013A9EDEB0255A41DAE3B3D26B36360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246613, "uuid": "74bdfa7d-ae55-4f79-99e3-d12269647031", "value": "b3fe9ff157cd1279a3c0074c55838402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246613, "uuid": "a58c81a2-90f4-4865-b9bf-df2e0a45fb5e", "value": "49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3ZzicC5P0qBj91IQnw2G9VxD7Avxg7:fmIAkJoz391fw2G9nAJg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246613, "uuid": "4ca99ff6-9fa7-44ba-bc7e-35f0e7230c45", "value": 2522778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246613, "uuid": "5cc2ca5c-e6d2-4861-8fdf-17a1bd9fb602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246613, "uuid": "0099b9b2-9ced-48ec-8385-75749d2823b1", "value": "0524c4d56f8fa57db4c13fa165df8b04adeda8c9b9026f94915a1b671f3faf52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6622b94b-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246307, "uuid": "ec47489a-5fe5-43d6-87a7-de43b2505489", "comment": "Malware payload (Formbook)", "value": "31d7b8ee3cff1a51264b08ddda0bb383", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246307, "uuid": "33908b08-2775-4707-9bda-ed7f829ebeb4", "comment": "Malware payload (Formbook)", "value": "05af48bc123af763a91d4c3a3a05d8040115a04bc09bccb8b5e2f184908138cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246307, "uuid": "de308429-44cf-4973-8739-008f43881180", "comment": "Malware payload (Formbook)", "value": "309490f15d161854011063e477c3ca165cb1bfde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246307, "uuid": "d85a4ab7-92df-4ce9-bbcd-e52ccdda0eaa", "comment": "Malware payload (Formbook)", "value": "4ea3f462455a63008ce404072dd6386c86c1ff5edb92203cb9eb63ee0b443fafc4928e3ae736b8b4edafd81da15b6852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246307, "uuid": "2a0e963c-fe3f-4fcd-821e-ba6ff6fa81c8", "value": "T1C53522053268CA03C4166BF85C74E0F22B759DAD9064DB076FC6BDEFB8BAB10165631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246307, "uuid": "e7aec752-e50f-43bf-b32c-627dec729bac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246307, "uuid": "35c345bd-441a-4f8f-bc3d-2e67f5cc3dd5", "value": "24576:SCWit13kVuwEtcWb5I/zD8v6skLy49Zkrf/X:Sizw4cWFILD8v6E4fkj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246307, "uuid": "50d131ad-40d7-4e21-bedb-d110502d0c61", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246307, "uuid": "5cebef4a-aee8-404d-ad8c-768afcdb3b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246307, "uuid": "03961329-72e7-4152-b7b0-1a75be1c74b6", "value": "05af48bc123af763a91d4c3a3a05d8040115a04bc09bccb8b5e2f184908138cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4bf717-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246805, "uuid": "ca9c54fe-b0fe-4574-8506-3299b9f5047f", "comment": "Malware payload (XWorm)", "value": "03d0c193a4e9ac3c343d5e97f7f46f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246805, "uuid": "a17a3d36-a6b4-4258-9752-0c42fff50446", "comment": "Malware payload (XWorm)", "value": "05b9708096e35ae64b39b02bfbd4d3e760fd294a059f783aa106d4c9cce68300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246805, "uuid": "33d3d76c-49dc-4fac-bec4-cca89c294ffe", "comment": "Malware payload (XWorm)", "value": "be4c2a605bd6f28ba46308612ba371a4a9ddb1b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246805, "uuid": "3c9f5172-c3cf-4835-95a2-12d6f37ac124", "comment": "Malware payload (XWorm)", "value": "47bc80bb2b9bf312d21a6b5665b384117f23b7c170d8d9b928e04fdfbb4885dc669afc21ecedd3be52c90bbaa162af52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246805, "uuid": "cba6904b-9a92-4aa9-be47-8279c25241f0", "value": "T1A8858C05F3E216BBF6A78730C6954336D671F4C013A9EDEB0255A41CAE3B7D26A36360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246805, "uuid": "283e3022-1f53-4a11-bd6f-783880a05701", "value": "b3fe9ff157cd1279a3c0074c55838402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246805, "uuid": "a9aa5e7f-3e04-4093-b437-fa33d448a917", "value": "49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3Zzicht:fmIAkJoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246805, "uuid": "3e7f1fbe-e7b2-4e23-ae52-a4c23bd62806", "value": 1805449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246805, "uuid": "df44075b-b86c-411a-b9ed-a9ad474c4033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246805, "uuid": "43988726-8a6b-4951-8b5d-1890416eac1d", "value": "05b9708096e35ae64b39b02bfbd4d3e760fd294a059f783aa106d4c9cce68300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccc8946-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281027, "uuid": "90ec6f0d-aae4-4ae0-9a4c-c16f3e8bb8cd", "comment": "Malware payload (Mirai)", "value": "9d0845dab00afec87f981f449de88656", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281027, "uuid": "6d53c22a-6ebe-4b63-8f37-2b688eb3e3d7", "comment": "Malware payload (Mirai)", "value": "05be2999d86bc63e8baf9211be9b60ff70dce9b1b0960b61dda5b4f7fe98298e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281027, "uuid": "12c4facf-c00d-4070-85ad-1ed91009bb76", "comment": "Malware payload (Mirai)", "value": "d110de5c45b2f8d2458f66b2a50459d0cff0d380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281027, "uuid": "f89c1db2-4649-4830-82dd-c4f3fb677bb7", "comment": "Malware payload (Mirai)", "value": "ddbe8de2de3cf030fe06ac1d8b4dfef22a4dd3910b40a58db968abf971303a88035ec2b695e91ea9503fc7ac21831b03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281027, "uuid": "ea10435d-6519-4951-a783-da7765ae9248", "value": "T12AB31851BC825612C6D612BBFA6E418E375623A8D3EF3213CD255F203BC7A1B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281027, "uuid": "f111abed-7703-4577-9988-b7346f08f9e1", "value": "1536:7jcuL8lzTm/NWSGmQAf3ilNUsdnS3qF4h7Fo1YWOavLKX4zZ5thK1rKcLl6DUta5:7jcKamISANUsdnS3qWJnWFLw4zZlfjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281027, "uuid": "130a7787-1bd0-4883-9024-a150fac52957", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281027, "uuid": "c5e1c453-e000-44ce-b6c0-00f0dc9c3c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281027, "uuid": "52c7f77f-9075-4cf1-95c5-28c787f9745d", "value": "nerv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac32ebe-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281023, "uuid": "8cfc8724-c698-4186-9d7b-75189de1af32", "comment": "Malware payload (Mirai)", "value": "737d357633b1ba008f80855ae8a34fdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281023, "uuid": "fa148c28-890c-43c0-9f2d-e07201928554", "comment": "Malware payload (Mirai)", "value": "06026b313501400b28124afa8bb0718449c630934a4e7a0d2a13a68782d1aca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281023, "uuid": "3f781e70-a8eb-4c00-9120-bcc7e40f35df", "comment": "Malware payload (Mirai)", "value": "b8aea8ff2f22df87c00c3c0b9e802b2f5b740493", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281023, "uuid": "fa2dbc8b-3e12-4349-aad7-0f65acf5592b", "comment": "Malware payload (Mirai)", "value": "0ff8ef46dd26fda7d23972f28c61cf835d52ea678ab485d00f06d5bea5ef95406b17c2c43e4f262e4df1c555d7b1961f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281023, "uuid": "c9bdee9a-7aa3-48aa-aace-04c827c128e2", "value": "T1A4B32986BD826622C5D423BBFA6E418E771623A8D3EF72138D215F2037C692F0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281023, "uuid": "fdd7c728-40f9-427c-8049-3b7a2fe9be82", "value": "1536:fOlvWIlGPodwHHK7CDvDNUsdnYkqlGBPRLUv7agWzT70Vhg41clTWzutuIeH:fOlezoONUsdnYkq4CzvWzHbnWym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281023, "uuid": "c73917ba-58b4-46dd-99bb-02dff2d9629e", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281023, "uuid": "552530cb-d05d-42be-9da8-8b38a4efb993", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281023, "uuid": "ec2ec979-ca3a-4151-9339-0329605bf8f0", "value": "nerv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ef57c3-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244298, "uuid": "6b59a91e-1969-4ed9-bd57-9f3d4dd837f2", "comment": "Malware payload", "value": "cc697ead564e53cc418eb77b27514636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244298, "uuid": "35c88381-6ce0-4166-a806-2af3e9c0cb7e", "comment": "Malware payload", "value": "06c4777276dbdc6f930571e2b1804f15a1b54c8079d6adad49cddf99b28ddb26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244298, "uuid": "3126cc3b-8a45-4665-9422-24feb87cd4cb", "comment": "Malware payload", "value": "d101d1a74fe328062b1bf933431fd9233eb30af4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244298, "uuid": "bff056e5-ea11-4e55-ae75-3702b268f616", "comment": "Malware payload", "value": "914e950d19097725cac93c3ccec0f99084b30bb9f5508abb0a7b552bcb5c08491f8295b245eaa09de657aa9e91f7cfe8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244298, "uuid": "a0713c63-4a80-44d5-be2e-5f4a108ee937", "value": "T12A55222035C0C2F3D8B6127410F6CB9ADE7A71765768D2EBB798173AAD503D1A7382C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244298, "uuid": "a415808e-182a-439d-85f6-8db3337a84fa", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244298, "uuid": "8a4fbdba-708f-44e2-bed2-37eb3b469554", "value": "24576:qk70Trcz952dvgRH0XYUuLvyj2SRMR1+EVmWU/sq8CFgfpTjc1evxZ4jNo5k9s:qkQTAhYv0LqCJYWhCFgq0fKo5k9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244298, "uuid": "df1d2517-f01b-4116-975d-aecbaf34530b", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244298, "uuid": "136bb794-d086-4669-92eb-2f3574a7ae28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244298, "uuid": "174ac076-3477-425c-9ff9-f063e46b37d0", "value": "06c4777276dbdc6f930571e2b1804f15a1b54c8079d6adad49cddf99b28ddb26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a545e3b-4aee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778252354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778252354, "uuid": "4229c09b-1c11-4c72-8d83-389a220fd32e", "comment": "Malware payload", "value": "6f76956603354f2c7585707d6bbb2cde", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778252354, "uuid": "2d072cc9-d5b9-4dc6-8e6a-8a1d606e8923", "comment": "Malware payload", "value": "073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778252354, "uuid": "c078b279-1bc6-4478-b433-969ae0e86feb", "comment": "Malware payload", "value": "e53fb558d9bddf92a0e16083cc6ee223848d5a11", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778252354, "uuid": "955504b1-b9d5-47e3-b5e0-bcbc993f6f5c", "comment": "Malware payload", "value": "98a852273829671b1758331f686e7a8afd8d5c42eae619d3d76a3d5bb41f04686c71e83896df98de73b616984511ed2f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778252354, "uuid": "2c87277f-02c6-438c-935f-311eb294de9d", "value": "T164631F3DDAE1FDC0036F71D09A5E3B46205C5B23F6B16B6CF9C208A61964649DF3A25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778252354, "uuid": "35e11c60-eaa4-408f-ab76-a2027261214b", "value": "1536:4tr/G+aID6KRt+VoHqrEFvZ5zK84WZ/HbaHpA8KtdoWteMR8e:C/GfIEG2k/K9WZ/7y9KiMR8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778252354, "uuid": "3feff23c-7e07-4687-83df-19b01ac1258b", "value": 68805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778252354, "uuid": "f8bdef6d-479c-450e-b16b-a3bb18efe548", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778252354, "uuid": "50062c53-12af-4ea0-9e2f-2bb71a2f9c3f", "value": "agent_debug.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ac5b6a-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233015, "uuid": "f2fd8c51-6b45-402f-9600-1dded38ea928", "comment": "Malware payload", "value": "252fc978dcca644fae7228750ea04c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233015, "uuid": "9616c477-0511-45f2-b7bf-8fda6d818246", "comment": "Malware payload", "value": "07c69931e91ac7a36cb941617066b84e011f5cf96b3feaeb86501f7811c0aefe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233015, "uuid": "488eb0c6-7a3c-4ec2-bb1d-7b5f20e3ba19", "comment": "Malware payload", "value": "e5d96a14932c0aa6dee66da6c38ebf892150c82d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233015, "uuid": "200fa612-7ff2-4a1c-bb4b-95eb268d2a30", "comment": "Malware payload", "value": "1ca0481f2fd9a5b3ea8f1f53522af7298bb4c2c1682fa576351d0a419cd21730f4e19bc721cdf894f28a3572e3dd62c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233015, "uuid": "e326e82d-bb11-434c-97e3-0f66d7070f18", "value": "T151446D55B7A40CFDE97B813CC9524906EBB27C560760EBDF07A04A925F236E09E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233015, "uuid": "bd0de2ee-c257-49f1-85bf-c91fe79a1803", "value": "a17f92348b4c8ca1121cd8073bebbf60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233015, "uuid": "f6131dcd-c495-46e4-b343-d1cad0579057", "value": "6144:XaR7fyDJmjgNhkUwga1IniyzHvvwHlleVwd:XaR7gAjgNhkUwgfXzHXwH2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233015, "uuid": "71e1661c-efdb-4fa6-a2ca-bbe51698a4d2", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233015, "uuid": "17850060-202d-4d0f-9a41-7f0b10a7c9ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233015, "uuid": "4c5b660d-9233-48ad-9995-5644b102164e", "value": "252fc978dcca644fae7228750ea04c0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed9a8b2-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281030, "uuid": "54ed725c-9c53-4507-b6f9-f2ec1786e575", "comment": "Malware payload (Mirai)", "value": "d4f08f1d9b4d9204d6f703d7d68d002c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281030, "uuid": "a77344b1-f2e8-4de4-b817-167e64e6ad86", "comment": "Malware payload (Mirai)", "value": "081ea15c1aca87e4999db87a6d157a116493ca4431a434f79ff8953e68e79c6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281030, "uuid": "17f36006-f2ca-4159-b5e0-097d7ac03f21", "comment": "Malware payload (Mirai)", "value": "dfc45915ba360ba9c1ab4c6df792b312fd2aaba2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281030, "uuid": "8c7924e4-4bf7-406d-a705-8c0858bb687b", "comment": "Malware payload (Mirai)", "value": "f9f103bd9ec0f008f64778fa6a22ce1f563b723c0f105d957830a3d0e22ed39e2e545020f64778eade79d274ea3f2b4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281030, "uuid": "39ca88da-4e44-4d65-a163-5732d513bd5e", "value": "T126B32A86AC814A11C5D613BFF92E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281030, "uuid": "7feebae2-43bb-475c-9bda-8a21629d8c36", "value": "3072:BfxGIfE1qVXbO4bnOfGZKKajrfiIbVva4qWXCfuaM1kfxGg:iIfvlDDOeZKKa/iIbtancCgk5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281030, "uuid": "2a1bc4b7-030e-446f-9eed-00d705b56a93", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281030, "uuid": "50c61441-edc1-40bb-8f68-83233253e4f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281030, "uuid": "f7a4ce9b-4e5b-46a4-a9e1-32f1b7c53c0a", "value": "nerv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0e1797-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244703, "uuid": "b9f36e2e-a87b-463a-b0c6-234799d3c797", "comment": "Malware payload (PhantomStealer)", "value": "e87307cbf64f26bdb0df25f4ff2b7f34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244703, "uuid": "716c28bc-e691-42a4-911e-062b75bf7653", "comment": "Malware payload (PhantomStealer)", "value": "08d1030c614d7bb2ccdcdffcf1a5f034c07ea5c8f5144f8122cf80156388bbb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244703, "uuid": "384e166e-a15a-4150-852d-b03096239135", "comment": "Malware payload (PhantomStealer)", "value": "d5cf994d06a6803e0c15b1cc74ab1241f32797a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244703, "uuid": "ba4e2c73-f2d1-4cdd-be92-e8168bf65f09", "comment": "Malware payload (PhantomStealer)", "value": "43af11be55b3bce27c3227f5a0f40787e79a239f59dbd0376c10729ba2dcfa79c47fccaadbe50b52bcde4f9acc72c36d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244703, "uuid": "75d14b77-ab84-40d8-893d-dc771d88ef10", "value": "T1B6751205627BCE03D1AB4BBA09E1C13007B41E8CE822C687AFC56EDB7536BA54DE5743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244703, "uuid": "858d2882-6d1d-48b1-a871-c65abf450c32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244703, "uuid": "420492ec-2ce1-4256-95c1-9c158671c696", "value": "24576:GodX+QtQRterIjGBKSxE1SFdzRfsPoDnxGeAyAR7rAM3cATKJez3kN3:GWusQRterIjuKICicQxGWArHKJ43kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244703, "uuid": "2ff4388c-ffa6-45f2-a7ec-8964980a535b", "value": 1576448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244703, "uuid": "6aa42d4a-584e-4f87-97d5-ec65f29459f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244703, "uuid": "693fbdce-7768-4e05-8e19-a5208673e500", "value": "08d1030c614d7bb2ccdcdffcf1a5f034c07ea5c8f5144f8122cf80156388bbb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334ab967-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265119, "uuid": "1608712f-0644-469a-acf4-46d48efed519", "comment": "Malware payload (Mirai)", "value": "63bf88bf876ba4afad674412e6c70b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265119, "uuid": "c9864ee5-130e-4673-9a22-4e30c92e5d7f", "comment": "Malware payload (Mirai)", "value": "0a1c0282f5d76fcf0bcd189937f1555ea2c3de1f6045603e1f9fff374baa56dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265119, "uuid": "3c64855f-a7ae-4659-a626-bedd003f2a13", "comment": "Malware payload (Mirai)", "value": "5b27dada11e5aa6334a6673f8f9707d330f1d4f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265119, "uuid": "4349cba8-65a4-4e67-9cdc-4f7e5f66eb4e", "comment": "Malware payload (Mirai)", "value": "2e5d14a3c4d42fd6db3ccb6a0b405a933caee0c7cda418e4aea35b166dd7dad2f1e045a1cb43f54d20d33b2c3c3c092d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265119, "uuid": "6f80925d-07e9-434c-a449-7c3535643616", "value": "T142936CC8F643D4FAEC4305701036EB37AF72E9BA112DDA47C3A89A32EC61651D51AB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265119, "uuid": "eb855a34-7b30-4d48-87e7-7900a975c01e", "value": "1536:PLCqfJnnJFLxG+ar2Yve1oCIvW75inp3rhop824S42V:PL/JnnJFLxGJaYve1oRQip3r2pbltV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265119, "uuid": "f29366d6-2585-484b-a43f-a4f475d69ac7", "value": 92456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265119, "uuid": "e4cd8f1a-ce24-46f8-b7cb-ac1497ee6925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265119, "uuid": "339e2d04-32fc-43a1-a9bf-e828f1fdd6d2", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924d1683-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246381, "uuid": "831ec89b-6566-47a4-a33d-4623d1cf0d21", "comment": "Malware payload", "value": "9cc86f41e44d3e64c9de91fadee93b77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246381, "uuid": "ea0207dc-28e8-4de9-99b7-2c2d3510fe41", "comment": "Malware payload", "value": "0a3f30fa2f8b87dfaec9c9f2fe082cfc1314f297cf45588af029a7f894b40a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246381, "uuid": "aa1f1d83-7429-4132-885a-2d088d6b1e33", "comment": "Malware payload", "value": "64f118c49bd10b35663911f5776e1d632f810912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246381, "uuid": "1421e016-d89b-43d5-a09a-b70d2b4fce36", "comment": "Malware payload", "value": "61000f4bb9babfa733ace40235b3aea1fe0afb17f3426c27a4057e588f3e4054d2358f623df23ae410d0efd15ac2ef92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246381, "uuid": "54a30b24-b4b2-4cf9-b6a9-5120c8ab2b60", "value": "T17045CF1363DD8364C3725273BA26B741BEBB782506B5F96B2FD4093DF820122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246381, "uuid": "f4ac1198-9e9d-4890-9a8d-b3649b25f292", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246381, "uuid": "f7c8d531-cfd1-4246-a271-82ac0499d806", "value": "24576:Ttb20pkaCqT5TBWgNQ7akmVpL44KzSaTbbYOci6A:QVg5tQ7akwpL44KWaMO75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246381, "uuid": "7fdf19be-357c-42ed-98d0-ef9edd0cf5f5", "value": 1182208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246381, "uuid": "be42e796-5ca6-4a80-8fa0-33c85409d772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246381, "uuid": "3488a4f4-c5c9-49d0-9b1b-418057a96173", "value": "0a3f30fa2f8b87dfaec9c9f2fe082cfc1314f297cf45588af029a7f894b40a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82946420-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244207, "uuid": "3b223012-7383-4bd2-a641-1f4a1c9c07c9", "comment": "Malware payload (AsyncRAT)", "value": "a2ec80bd4da144b4ba8a3ab9406483e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244207, "uuid": "2fc25c04-08dc-4299-b43c-abccc11dabcd", "comment": "Malware payload (AsyncRAT)", "value": "0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244207, "uuid": "60261029-0153-4424-ac06-080ef996deb5", "comment": "Malware payload (AsyncRAT)", "value": "deac0e5592c710df4c8d813ca4c42e0227da5a9c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244207, "uuid": "6151a52c-c4e2-40ea-a197-9c7588030adc", "comment": "Malware payload (AsyncRAT)", "value": "9d5f7375e5bdd98ed727f83d14ae0b71036d60b17322197548bcf88f5eb14e56861704eba03a13fccd9e1204b9fa702f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244207, "uuid": "e8f22f12-a274-4c43-8787-194e3786efb6", "value": "T12A0501B4AA2DCA02D8A543F80A61E73413F0AC9DF120D24B9EFDFCEB78B57552419647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244207, "uuid": "3470349c-48f4-4fd3-9bb5-da1365da6d3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244207, "uuid": "1f49f150-3329-49ac-8f16-3eef9e25a026", "value": "24576:HM8+v9OiUr6SpkXcFCINpBlKmGXU5DbNOf:av3UrhpkMo8flKDkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244207, "uuid": "4b483089-6459-4577-a1ab-d981fe3c957f", "value": 803336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244207, "uuid": "3355cb3e-aed3-4083-b081-d2ba9a71411c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244207, "uuid": "5e04ac56-a72e-4d15-a00d-173a9f768614", "value": "0a492b2428bbd096ee4fe5d9011616accfd743f04e83f4b2a8cb95074cd54419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110fa521-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265062, "uuid": "f54803c5-c032-423a-9998-228472f24bb4", "comment": "Malware payload (Mirai)", "value": "109cd3acfbdc7a042a2a02fa2ade2ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265062, "uuid": "521f12d3-0f5e-4829-874a-98211b01f125", "comment": "Malware payload (Mirai)", "value": "0a869a940446289979d50aded97f07b87879154f50feeb186fc79f91a48b903f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265062, "uuid": "d6851b79-4a9a-4b83-ba38-ace428b18957", "comment": "Malware payload (Mirai)", "value": "ab772e66a083ff8ba16bea76a5b1201a00d7a495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265062, "uuid": "915c72d2-4a34-4a1b-9a00-860896ff008f", "comment": "Malware payload (Mirai)", "value": "7168308f53393049660ba6c35aacf15b4aeb8c9ed9e8a3fd255dee70751b4928a5726292d8dac684745dfe48fe997f8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265062, "uuid": "4547017f-16f2-4005-93a7-97bd4d8f43c8", "value": "T1F6032A8173280447C1B62EB0357F1BD0E7ABEB9222A4F389750F9B4AD072D379546D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265062, "uuid": "95aaa26f-9b34-461b-81ac-e164dd89fff6", "value": "768:16KqIf9Yr9GKrlfnitOeH/dOsnKoRIOlb3B87:16736Qef0sn5RImDy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265062, "uuid": "b027828c-b87f-40eb-bd8d-ba84fe525219", "value": 38816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265062, "uuid": "32aa8039-3809-4d8c-9e71-6959854a5717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265062, "uuid": "48ea3c3e-89a3-4587-95c8-ce90164ec18a", "value": "nexus.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605a51bd-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243720, "uuid": "ef5a1197-7440-4cc9-942d-c1ed55210f9a", "comment": "Malware payload (Formbook)", "value": "4733d1a824470710cb5d14bdf8be0df8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243720, "uuid": "241c5b2d-e48b-4d7c-9155-23b3a3339887", "comment": "Malware payload (Formbook)", "value": "0a993640c09796e86f5284f0bd4177a40e50399f43905dbd0947e3ec1fea1c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243720, "uuid": "3963d49b-37b8-4041-a253-96787f223ec1", "comment": "Malware payload (Formbook)", "value": "cdce27faaae19a20399a53fa2dea9486a6009ebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243720, "uuid": "e680049b-fc88-459a-a4a6-27f46d88124a", "comment": "Malware payload (Formbook)", "value": "c8ff068e5c32b6fb601c5db16dce5e87a0e6d5184456453da0ec11075b2679e8d8ce76fa9c0ed68d0e88f12f5bdd8f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243720, "uuid": "9c742d51-4b51-48e1-a9d9-7ac17ccc7a8b", "value": "T1FD45F1512717EC03D5A29BF00CA1D27407F6AD95A422C2538FE67EDBBB35B8669C4383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243720, "uuid": "1ad4c9f4-b924-4afb-84e7-966f0ace27c7", "value": "24576:nyuU9R7fiJRJ700kfiqZLMZd6DO4qs8wKKQG/SJJSHwr:yVNinNSod6dbbqUwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243720, "uuid": "6e5cfd5b-96bb-4025-b1fd-36c4956fb936", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243720, "uuid": "3543a161-80cc-4281-9e93-ed755d51b17d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243720, "uuid": "dd080ae8-5452-4f1a-ba47-21c6f881279d", "value": "0a993640c09796e86f5284f0bd4177a40e50399f43905dbd0947e3ec1fea1c4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105b1cb2-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265061, "uuid": "3b01ea25-e9a7-47c2-9649-847fd6404134", "comment": "Malware payload (Mirai)", "value": "85d377aa93ba804c7a1168dca32632f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265061, "uuid": "d77ff098-f514-45a0-854e-4410c31883bb", "comment": "Malware payload (Mirai)", "value": "0b394b7c38cbb7a84aa691dfb4c710c033826eb2037ca210ec75a79958b85874", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265061, "uuid": "9d7bd62d-48dc-45d0-9ece-ffd88e1f81ff", "comment": "Malware payload (Mirai)", "value": "43fa43b1453cd16d97a02dd02a2cf73f8beead12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265061, "uuid": "8ae66f83-35d0-4e31-9708-9edae7926541", "comment": "Malware payload (Mirai)", "value": "a1b645a0f12dba2957693be2b6dfe7bb7cac6068232a79f68433e09c51473ddab39a001d8ca9f71339699f3c6de41133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265061, "uuid": "e3cf93e5-f3b4-410c-aeb6-2328358c07ad", "value": "T1FD4302E665077737FE0082FA6644C848FE125B7ECCC3F6BB066F349B18952668478310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265061, "uuid": "cddc5ad6-3586-41e1-b03f-5ffa3739082d", "value": "1536:PgzdTLz8DS0d0vDynjLLl10LkWhRA99bu5QjlMWjVELM:PgVAS2njHl103AHbu5Q9ELM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265061, "uuid": "37e2bf8f-5ad4-4f86-add0-667334f86a81", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265061, "uuid": "81607cde-5e68-42f3-a31c-efa5feb8c014", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265061, "uuid": "c70764e5-df48-43c0-8cf5-ace8ddb88b50", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efa248c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "8499f421-bc05-472f-bb33-61f4e3fd7d6b", "comment": "Malware payload", "value": "409dc58146687eb6f47982ebeaba807c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "264343de-39e9-4fb8-8f26-fb3317676910", "comment": "Malware payload", "value": "0b3a7b7935c9412a617eda00d87045bbb7eb93a697421a449aa6b23f554bfcf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "89a251ba-81ab-4153-a63e-a21e36b9eecc", "comment": "Malware payload", "value": "cdb51725e43246bc8e34a9315252236e06e9643a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "bfbced4b-cf28-4f6e-8c05-f875315eb375", "comment": "Malware payload", "value": "7f4d8ebf72360bd42e81e030c732c941972064208ee52cad5017f63416eb425b17db04a06f580e43e2d25e06341bf391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "fc187aa9-d19e-4a40-8692-20c35c03a8ab", "value": "T180735C1AA34368ECD61BC5B486EF6733BA72F8A61630DF3F5754DA301D14E902F2A524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "9323779f-1a17-45dd-a4d7-70d0056af216", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "f949c793-cbae-4c2b-a4a0-6f34f308f59f", "value": "1536:hlcEojXj6X/gk78cVlAqEvNhkiklGghTm4:hlcEoaPFvVe/NhkiklXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244120, "uuid": "dd480671-3275-4582-aaee-4ec9bf962c66", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244120, "uuid": "c739d59c-7414-4cf8-9a8c-00175dc68f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "e79b39f9-675f-4490-90e6-2543569555b8", "value": "dfaa53ef4d7b3428aff5948e254010ecbaa08727b1b70cf75537d82b98cd9eb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ec9cef-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243978, "uuid": "00b9c9de-5b71-4c3c-80c6-ad5b7dcf6cdb", "comment": "Malware payload (AsyncRAT)", "value": "be9adbd3551689632b677f70e0fbf046", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243978, "uuid": "14d77d0c-ce45-4970-9282-00ed3ae4ce68", "comment": "Malware payload (AsyncRAT)", "value": "0b71a04e977e2651eb23dfca42c8cc4226b2cd84755bcb14e3725444b75576cf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243978, "uuid": "67b3c04c-9fb3-4af8-a307-db438f06d853", "comment": "Malware payload (AsyncRAT)", "value": "26ce3300a422b03256cda70520d17dcad7dc7c69", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243978, "uuid": "a8cf6235-193a-4d2f-ad43-f3ec2ed51456", "comment": "Malware payload (AsyncRAT)", "value": "f2909522f02ef44f2aff175061204757a58dd40ec4c0286a44ecea16107df2378c2baca7ade1df812be226646d55f996", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243978, "uuid": "a5a58a43-1a65-4c0d-ad98-115f7171c456", "value": "T199F36C17B3A931F9E17BC674C5924606F73678790B62ABDF03544BB62F122E09D39B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243978, "uuid": "f1b316ca-0e62-49b8-9fb9-51aa2fc0634a", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243978, "uuid": "7738ad1a-acd5-4d98-bce4-9fc76c3ad302", "value": "3072:PGs2uJl2cH33VUhktwWJ75q9nfsv15O7on8kOGSOCtMtlbTci:PGs/P33VU/WJ9q9CONkOGSOCtMt6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243978, "uuid": "6d4b4614-f82d-4de5-8033-0efe644fe1aa", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243978, "uuid": "38598572-45f0-451c-a01d-e24c291b6b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243978, "uuid": "d3d9d508-743c-4d0a-bf51-2c524dfd8bdf", "value": "0b71a04e977e2651eb23dfca42c8cc4226b2cd84755bcb14e3725444b75576cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc32dbc1-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242586, "uuid": "6a11692e-b004-4c7d-bc4d-566ad946b7f8", "comment": "Malware payload (Formbook)", "value": "3fd25884ee79a1c6694500fd4cc22ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242586, "uuid": "7cda614c-a89e-461e-95bb-288c80ee0809", "comment": "Malware payload (Formbook)", "value": "0b8bb3f6e136c3f5a94ac873553a1a7e5e985296481e0c33659ad0b71323fda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242586, "uuid": "52418aa1-9bcf-466b-80cc-b37c3251041c", "comment": "Malware payload (Formbook)", "value": "f0bd57f5393fa05fd31a80b9b1114caee4d1bc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242586, "uuid": "36f67f96-370b-4d89-b264-be43cc1d525c", "comment": "Malware payload (Formbook)", "value": "f73f0c34dd2b43bc44ffee3bf2d2282bf366df435b3fce3ac36141c068f23fb4040dd3be0685dff41ffed27ca702d2a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242586, "uuid": "e5c51fb0-d563-456b-88ae-fb7b97805f5d", "value": "T11C35014877A9DF02E4BA6BF04C71E3B443B46E9D2820E3168EF5BCEB78797519845243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242586, "uuid": "d2d0d71a-6092-419b-bdf9-210b471d83f2", "value": "24576:FrcN2mqN8Q7ASh5u5g5YdARpyKJiKT+/Kk+mod9UC7/gmt:E2P8Q7Ph5u56YxKT+Kk+mkz7/gM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242586, "uuid": "641777e7-1605-4a6d-b781-97392435f900", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242586, "uuid": "9ef6bf87-b358-428b-afc4-0dc0316ec0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242586, "uuid": "53ec5250-c89f-485e-988b-2dbec9f5e26b", "value": "0b8bb3f6e136c3f5a94ac873553a1a7e5e985296481e0c33659ad0b71323fda3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6685a4c-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1778236107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236107, "uuid": "db94f987-f513-43c6-9f06-02721eac4eac", "comment": "Malware payload (PureCrypter)", "value": "f2ba13852b23d9c4fbc91e4ca528310f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236107, "uuid": "cf4a6680-7078-4f84-a2e6-5c04d0ffca30", "comment": "Malware payload (PureCrypter)", "value": "0c03726da1db8d0821887d390b619db49556d3630dc1f93da577f622c0d092bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236107, "uuid": "1e4646c0-5003-4638-83ac-9d348c09a5c1", "comment": "Malware payload (PureCrypter)", "value": "6a8b598a47cc0338595eddf5daf5a0a9bef6493e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236107, "uuid": "1ce6cd57-6373-475b-a4f1-aafd034e0604", "comment": "Malware payload (PureCrypter)", "value": "3b319880643f4618e899ae09e63ce4072a4d7e0fa89fd30d7b0cc99b34d396b7cda22b9dc74f9147af9db2d608b4ce81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236107, "uuid": "91b50dfb-cdb8-48f8-b0fa-76ae7de26033", "value": "T1AB037B16B2DFCA0870B2968906AB17344B5F7AAE1FBF40D9018DEEC94FD35118C577A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236107, "uuid": "73a5e25e-84de-4b7d-909c-9d78853355c7", "value": "384:o7Dn8KRRCUopoY66HnariKr7aqk3W/UUm4Hb5ymmfLu:o7DndiUopvHdBqHcpmmf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236107, "uuid": "28e1c4dd-4f44-4783-83f5-941e63a923be", "value": 41066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236107, "uuid": "9ffe8eef-ed33-4ae2-a857-67b6d8bdeb12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236107, "uuid": "e7146c2b-f945-45b7-a40e-ddaf3c07d50d", "value": "DS00088821110008000-20110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da70cbe-4ab1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778225972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225972, "uuid": "5746bb65-ea8e-4a12-9dc1-23759d704ac5", "comment": "Malware payload (AgentTesla)", "value": "3592308fb23c418e9a0db467cf841bbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225972, "uuid": "12626439-f9f0-4a6b-8142-081023cd4c73", "comment": "Malware payload (AgentTesla)", "value": "0c2e62e767632890e0040948c74cddbaea83dfa21a980fa4789db399dd6c5943", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225972, "uuid": "8d22d7a2-7059-43c5-a1cb-9d23af8f37f8", "comment": "Malware payload (AgentTesla)", "value": "df562d01df249f4ef62739857bd44e480b4c2580", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225972, "uuid": "1943b544-5c0f-4883-b454-8df406c9a7f3", "comment": "Malware payload (AgentTesla)", "value": "6aa73d2c166573da00e5a59933bf113447a981be823d422069b254810936e6568944ada4ff01408054972569b5717a01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225972, "uuid": "98817d39-bf47-4cc6-badb-a118acb2bde0", "value": "T11445338675073D4A0087B2C725ACAD0387E7D9BA2442780A55DA619DCFDDFCE32C93B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225972, "uuid": "152aa983-5620-42c9-a6b7-5ca632ca03c2", "value": "24576:ZpNK8ka9sTvJF26gLtONVIZ9kk5uKyA7GzY1tQF0jOLH:ZpPzrgfA5u8RtQFqOLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225972, "uuid": "58123af8-5f69-408b-8d7a-101eaf187b05", "value": 1182988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225972, "uuid": "aa1b8c59-ecc2-4729-8e54-6bee680a8324", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225972, "uuid": "7b170c89-e0d3-4d62-98fd-64d9c62238ad", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c74805fc-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234014, "uuid": "5531b522-cfb9-45b6-828f-21e888036d09", "comment": "Malware payload", "value": "b6f474534f5a6372a145cc88c0cb49ae", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234014, "uuid": "fb9951b3-1484-4bb9-9652-1c169cc7d689", "comment": "Malware payload", "value": "0c397afa38e182d706ca6b3f80924668510bd219b991bfe52cc0b0da845cf2f5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234014, "uuid": "f3e0f13b-07e3-4db2-8ac1-3a675b490420", "comment": "Malware payload", "value": "0eccf505cd0c06609c61e7ff46eb893e6ad7030e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234014, "uuid": "b216339e-749b-4680-86ea-142550305a62", "comment": "Malware payload", "value": "aad65aa21228d035349834abd0181a51039b320ed0139a170b88b6d6a05bd7d67ded6215cc5a5312ab8994cee73b29e0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234014, "uuid": "7f1f38d8-7d8e-4928-8eb1-b41001f83991", "value": "T1BFF6BD23F5056996D9D6A235F1E7279132301E4403939279271FF02AFDF26CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234014, "uuid": "e9a89eaf-e694-48a1-a866-22e189569ead", "value": "196608:Qmmd6Jg3LtihkxsRv5brIZXWsziZckC7Qo4yayxvsOvKV3eLohqnQ3MJADjDc8wp:Nmd6J+tJ0OZXWzZ5C7JnvPvKo31ADjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234014, "uuid": "27f33e4b-0507-43fd-9800-1899d5023312", "value": 16062020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234014, "uuid": "52b2dba0-80a3-4e9c-867d-2f79ec83ef6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234014, "uuid": "6c967939-ad24-4359-b10c-a4c4a07196c1", "value": "PNB ONE (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333c38a7-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778246651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246651, "uuid": "7e9fdb3f-6b5f-4110-bda3-424b4edbd708", "comment": "Malware payload (GuLoader)", "value": "7f3537d2da17230d6832419848bc192e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246651, "uuid": "b811ead2-3f3c-418d-9ce3-002006c26a0c", "comment": "Malware payload (GuLoader)", "value": "0c9d23f1cb3b17eb43a23a107ef5bfda2fb1e64f57bf98be8e6a1f8fbcaf8739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246651, "uuid": "73935be3-2e6a-4896-835b-5b9a2bf8ab35", "comment": "Malware payload (GuLoader)", "value": "d267c04eb8491b98ce529020ca781e856ba75a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246651, "uuid": "c67c644b-649b-47e9-997a-6cdd419bc2fd", "comment": "Malware payload (GuLoader)", "value": "05ba0c7072b4cbb352db3293181fca98fdf51fe194957b501ed067eeb07b5510a575dfee54cfc4f4d7936ccf197a6fe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246651, "uuid": "7ad9536b-18e0-42ff-9ddb-a4331f2e7335", "value": "T168541201F690FC5BF9E2023414392A796FFBEDB501119B5B6335A919BD23380DA6F6E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246651, "uuid": "251b9bff-24d1-4624-aec7-81e2c573b3a0", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246651, "uuid": "0fc38a1a-1dc7-49f3-ad9f-33f46747972e", "value": "6144:JfY+onfHukWlhpox6K+FAq4iWtFwPG1k+BKeyYsTkk3Wvr2jFzdPQ2:JfYbHdWlsx6fFAq4n11oBN3gr29FR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246651, "uuid": "f48cff6a-96df-4ca7-8246-88e3b9732e58", "value": 302344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246651, "uuid": "c24746b8-a120-4efb-bd23-3e0848c156bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246651, "uuid": "6b629fe7-40bc-4822-8d8d-c9d0b3bf0357", "value": "0c9d23f1cb3b17eb43a23a107ef5bfda2fb1e64f57bf98be8e6a1f8fbcaf8739", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ee4f12-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242548, "uuid": "c636ed71-2994-4b20-86aa-3756302e2daa", "comment": "Malware payload", "value": "1d0a58b5c26d3dd9cf5a7ef3f04d2138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242548, "uuid": "574a704c-5adb-4034-a1fd-5e9c4101e99f", "comment": "Malware payload", "value": "0d7c48d01776128ad8e0592a886211f18cf1ebd838a78baf589bcef814f2e294", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242548, "uuid": "6d13e152-3ba6-4a41-bf48-560948694b4a", "comment": "Malware payload", "value": "4cc5d98cb035f92b7cf52362464f3930139a6988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242548, "uuid": "b946a332-3f0e-47e5-afd4-d869e9de473c", "comment": "Malware payload", "value": "e8c80d701f24a07da4dc59a01e2fecea6bcda391f1adc0bf66d262b25085f296fbb29d5cec5babd510d23a57e19f055c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242548, "uuid": "a964bea6-34ef-42fd-bb1a-8365759211ca", "value": "T150C44216EA61A42FF4538DB079795986BC292D321684EC4BF7801F667074AABF0F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242548, "uuid": "b243fa12-9649-47e9-8df1-6178fa846e8b", "value": "2526755778b2ba897546ae79ffc18699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242548, "uuid": "9c3de1ee-2a48-4d07-a793-27a522fa0c0c", "value": "12288:HKtArQ6nX+Q50ePLOxLQ2RUowAh2+cXnw44WOPbjsCTrJ791:HprLEwjnwPMCnt91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242548, "uuid": "7f2e1528-56a3-43cd-ab86-180af5b0fd6f", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242548, "uuid": "ae75adaa-9719-4183-ba5b-c17ff94b191d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242548, "uuid": "ee3b761a-486e-475b-a940-ec25da34ac29", "value": "0d7c48d01776128ad8e0592a886211f18cf1ebd838a78baf589bcef814f2e294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51c18f4-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload (XTinyLoader)", "timestamp": 1778233152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233152, "uuid": "e3f23fad-3a18-477d-bc0c-be1e119d88d8", "comment": "Malware payload (XTinyLoader)", "value": "11300ae5a0e3b41d5f8fddeab7cc77d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233152, "uuid": "3deb3b96-10c0-4d92-8eba-f179c1ff5e8d", "comment": "Malware payload (XTinyLoader)", "value": "0e12143a4b0dfc48f4bf791c90e5fd64fa6529c9a493755015aa210b13a804d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233152, "uuid": "44e73411-b20a-42ff-be2b-4db45dd72e0d", "comment": "Malware payload (XTinyLoader)", "value": "d71346dc872207727270bb08097f14e07e2dedd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233152, "uuid": "5b672f69-a44e-44f7-8f4f-7a229fc4290c", "comment": "Malware payload (XTinyLoader)", "value": "dd513377622e29b2adbb8fffe5da39a6d1fcf509a7ece5acc65604ae65dca124bca180f90458aebc1abd6af77a4198dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XTinyLoader", "colour": "#4A1D58", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233152, "uuid": "b9aa4492-7399-470b-8a2f-c046f0c7a297", "value": "T1AEF34D0A336460F4E5779278CDA25B46E7B2787A17B1634E437443BA5F332919E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233152, "uuid": "2336ede3-7d82-4109-9414-82007b4612ba", "value": "58e55310d66c611cb140f28166224b10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233152, "uuid": "cf151b1d-497d-43bf-a1c9-73698e31619e", "value": "3072:6VWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+gUFk+ZqK5vYKe:imfnP+S9wT8GrWzH6+4S8+Obw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233152, "uuid": "7579c3ec-a3b6-4510-ad5a-1f6cafca1cf9", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233152, "uuid": "8bb7e860-c51e-4ca7-b7cf-663657e6532e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233152, "uuid": "0472bf70-b5a1-4557-8e09-2b611abf7c25", "value": "11300ae5a0e3b41d5f8fddeab7cc77d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c520e19e-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231434, "uuid": "5821ce3e-9f2b-4b61-882a-47d959e3299a", "comment": "Malware payload", "value": "502d76c6ddd8588f4d300b1396a21b84", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231434, "uuid": "22433700-0dc4-4e2c-a82e-b6ce7ef1bbae", "comment": "Malware payload", "value": "0e4a33c1ce7dfc51e79054c9dc647243a3343d15f6b0f8ab902cca510b85e1bb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231434, "uuid": "94cd5f99-c3b8-4931-9a17-76f8ca3f4ae3", "comment": "Malware payload", "value": "b5dce8582628099bf7b3e10de7216b343472ab3c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231434, "uuid": "18f20c16-1082-4ab0-aee1-e80eba6aa4a7", "comment": "Malware payload", "value": "d12126a22ed52b8df58dca0e0c7e096d68c765b3c8593781fa45e847a1ba9b87d2cb8b07164a89a5558b704c9686057d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231434, "uuid": "cb362ef7-4585-4da1-970e-1d935bad94fa", "value": "T16B07220BF3086C6AC9F75336B936437A651B1D254F43CA876860733C69B76C08A6EBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231434, "uuid": "2de1c5c7-6947-4a0b-b82f-05e30cb57ccf", "value": "393216:+olpJocg+uqOcGBteKNMpinaEObRXekVyekqr:B+OOVt7UXt8qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231434, "uuid": "f8323b6a-ed1a-450f-8b4c-8ece98011527", "value": 17347239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231434, "uuid": "455e8590-57e9-4771-8f0f-feb572ddcc4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231434, "uuid": "b0c76bcf-3141-4206-8890-1076c18987bf", "value": "iMobile Lite (35).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a184a02-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281022, "uuid": "b9c8932c-f02d-4bbd-9cba-9dd91ec67981", "comment": "Malware payload (Mirai)", "value": "63209f9a0999f603ec439b002dc51e8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281022, "uuid": "e4c0baf7-0d3a-4f0c-a0e5-70c79542a77c", "comment": "Malware payload (Mirai)", "value": "0e99ee0b95150730a29ddafb365a60593550e60999c400fbd607af4bda1dd24f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281022, "uuid": "1ef1ca7c-12d4-4929-954f-ab3798423d88", "comment": "Malware payload (Mirai)", "value": "1b2f7519c4ca846ee5c08115f87501eed83f9066", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281022, "uuid": "7a472981-0260-44e6-a017-591acfdfdc06", "comment": "Malware payload (Mirai)", "value": "3b15f652e9c32452310d9e31467c2863a1c124dca5aab5b129282246aaf4c23949aee4422e18bca27b81aec165bbd950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281022, "uuid": "d18ad4aa-5c22-46ff-b4c9-49131099f3e8", "value": "T12CD32A46A9415E12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281022, "uuid": "3fccf7aa-b90b-45da-ad24-8f6cfaa984f2", "value": "3072:7+P2y1xiqVpO4nnHfGxKWER3RsBcaJYC8E8ABgc4f3610uGjjHC:fy1hznHexKWEdRGcaJYC8Ebgc460TnHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281022, "uuid": "f55feb74-cbcc-412f-a642-8c02a5d3b57f", "value": 135532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281022, "uuid": "8d7a6129-9ffe-445b-84f1-57b0a41da908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281022, "uuid": "c34025e9-3edc-43fb-97a4-7d6eedb278e7", "value": "nerv.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c1dd48-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245692, "uuid": "ad80783f-a159-43b3-9eb2-b419ea6ffc93", "comment": "Malware payload (MassLogger)", "value": "372f0279279e6c208761a117612c98e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245692, "uuid": "356ddbd8-91d6-48b4-87c9-650369ff5117", "comment": "Malware payload (MassLogger)", "value": "0f3e7c10e425676a7532cf23a846e739d6abdc2e7f83eb0bb4ac4821d98543b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245692, "uuid": "dfce591c-bf07-4fb8-8bc9-b0205ef3dfa9", "comment": "Malware payload (MassLogger)", "value": "c1784d805afd06294ee200558044106765926460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245692, "uuid": "c0e1f518-0601-4004-8ecf-075b40af0568", "comment": "Malware payload (MassLogger)", "value": "76907972da87a35271d605ed0664d4f465b72db1dfe9c5795cca05d09078789a59cd8cf5fb0062f479a589de4a145e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245692, "uuid": "9c47ee91-bd3b-4434-812f-528e0b8bb4f7", "value": "T17CF40148623CDA02C5762FB80E72E4B413786E99C926D606AFCD3EDFF47A7142914367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245692, "uuid": "47485741-d722-4981-9f8b-0288ffafb3d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245692, "uuid": "d528b07e-864b-4ec7-8454-ede8933e6eca", "value": "12288:dqwhbgAstrqBeCY0OvW4Mr2su6osvAgTRGm3TXE8O0A8Llb0JGFNRqU9PkwzyXsq:dXgtrqBeRVW4MCqN3I70A8GJGMU2PUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245692, "uuid": "e02ae96b-c15f-473c-8ad8-77e26f6e0307", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245692, "uuid": "e57892fb-40ff-465d-bc29-63f3ae794e84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245692, "uuid": "740b1031-a5ae-4997-8f3d-8543cd0cee1b", "value": "0f3e7c10e425676a7532cf23a846e739d6abdc2e7f83eb0bb4ac4821d98543b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d91770e-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246588, "uuid": "08676e93-24fe-41c8-bf04-198c8e98909f", "comment": "Malware payload", "value": "d731d4f6727b28c0db56ccc46d5ae9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246588, "uuid": "9cb41e39-7845-4ae3-866a-413b5d980c8b", "comment": "Malware payload", "value": "0f4cf27234e08c71d2601b4793554110efc767fd327e27925c7772ff0653c846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246588, "uuid": "77f52acb-bb73-4775-a69d-a7660047ac21", "comment": "Malware payload", "value": "06b2bbf1016675ddce688c5aaa79463bff7d97da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246588, "uuid": "cc7339ca-868b-4300-aa43-9c660fa1e30f", "comment": "Malware payload", "value": "0dbddc9815a0eb72d29420b2211ffc5761030268717034b801bf260c35f9f1a1b2347cbba48f6ff2b5247fc091d67231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246588, "uuid": "84be6173-f5d3-485b-85fc-955627728844", "value": "T10455CF150D835F68D56E0B38D1B6049C23F18D5BCE16EFEB2EEC56F4BAA2746D806423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246588, "uuid": "c4fdf914-d418-49f8-8c5c-a31b41b18b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246588, "uuid": "324e2131-4460-4522-9a56-a1d2e60d13f3", "value": "24576:aJcB0IsULgC/AGMaadHkadh5rciChmqq9:uMJj0hG1adEadXoiCk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246588, "uuid": "57d73c3e-b188-46ad-a355-5c61daf2fedd", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246588, "uuid": "2b0408b6-861d-45eb-924e-f8f5a2a9f7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246588, "uuid": "57e1fbef-ca73-4253-9f3d-005ea4467bc9", "value": "0f4cf27234e08c71d2601b4793554110efc767fd327e27925c7772ff0653c846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dd9399-4b07-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778263142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263142, "uuid": "fa8c37fa-5d49-47cd-b987-32689767365e", "comment": "Malware payload (AsyncRAT)", "value": "b669f2d36b0b71f614751ed3c4486c0b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263142, "uuid": "6c2d52b9-44aa-4c33-900b-8eae5e75fb25", "comment": "Malware payload (AsyncRAT)", "value": "103bf7cda93749567f7e16e48cd205fd059fdda7f7396a781c6e4a096a3b47d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263142, "uuid": "a0ce5e35-087e-4194-8c96-e2a9906c6dde", "comment": "Malware payload (AsyncRAT)", "value": "d93d360643cd95ca8b2f2bbcf61b2fec5dc208f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263142, "uuid": "2917bbe4-42f7-4733-860e-b08b45b2372b", "comment": "Malware payload (AsyncRAT)", "value": "1c59af14449b2d462a37730a71cc64cfc8e23e1e1e80cce2b6c2437ba316d9354476c35da2d2b67cea6bd5fd77a76221", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263142, "uuid": "79425bd7-c32d-4900-8454-61e3238bb3ae", "value": "T172B32049E919485DE82D0E7C6CF3A45606D5BF37E508ABC50CDCB8CFAA33A820EC5759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263142, "uuid": "eface26d-e617-42b2-928d-98cbfeb520c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263142, "uuid": "2beda6f4-a7bd-4550-9f34-9dfdbdc3ca98", "value": "1536:Aub+dT5Pk2ukBdUY3bcXSRE8DET/BdImW7DB5NRlmMGCCz:AubyT5Pk2tBGY3bciAbBod+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778263142, "uuid": "59148663-2409-4a5d-a306-b5635ce457f0", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778263142, "uuid": "de2381e3-ef6a-4e55-9cb3-aec59b9d0e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263142, "uuid": "ccf335cf-9f77-4ca9-949e-c4b572d18257", "value": "Telegram (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062ead94-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243569, "uuid": "c5467f6e-94f5-40ff-996b-8cb8db9566ec", "comment": "Malware payload (Formbook)", "value": "af24ceac3e510aa1d2922d77effd3401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243569, "uuid": "490fc6de-ae59-4c99-8428-77749fecee0b", "comment": "Malware payload (Formbook)", "value": "10604816cb1e1e26be33e423bc5488ebad96ec0eaef8c79e7701a1c4531d8da6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243569, "uuid": "13db5107-77e8-4488-b348-8dca2f3fec58", "comment": "Malware payload (Formbook)", "value": "829aa08c24d1c35c42258eca3b05d2abb621737a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243569, "uuid": "994f8d64-ca4e-434d-888a-579ed20b10fb", "comment": "Malware payload (Formbook)", "value": "0cd3db08060fc30d42d5d8addf53b033414258816d95e0b3f941f349adb57ba1488cfd364d7ced3286837fd60df083d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243569, "uuid": "25c29640-53a9-4df9-89ba-d4095179a034", "value": "T1564501403719DE02C5A6DBF01D71E2B10BF66E895411E353CEE37EEBBA38B11A944693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243569, "uuid": "65319901-368e-454a-9d66-32f5b77d582f", "value": "24576:+uJdehYEGzZWl4D2VJTQKIr5Ws3SJJSHwi:+ThYEGEs2VTIrPqUwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243569, "uuid": "68291c16-7cf2-4689-ac84-3b0d884c5fe2", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243569, "uuid": "b04bc451-eda8-41b8-9556-62fef3fc8ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243569, "uuid": "8b023e3c-67ba-4e49-bd2a-b16433aa9e87", "value": "10604816cb1e1e26be33e423bc5488ebad96ec0eaef8c79e7701a1c4531d8da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85dbfcf-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246418, "uuid": "d6ef6444-fab1-46b5-aec1-31ab05988754", "comment": "Malware payload", "value": "f37ccbb3b5b8be0a6275576b9b152990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246418, "uuid": "1d0c60f9-f777-42ca-b625-3db8ae8ddf99", "comment": "Malware payload", "value": "10e1937e8308d10ddac461174dac8e4f5e3634b4532e89b111426e83fa2b51b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246418, "uuid": "22a32277-d830-4138-80d2-9192c8512fd7", "comment": "Malware payload", "value": "d6256dfb312ca02104766159fbebc3c6495c8c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246418, "uuid": "8f216615-5c47-4e6b-a37e-4c90890ade77", "comment": "Malware payload", "value": "9461f2e7a40a345519c161e086bf4eb48ed52d5e28cc1b505fa477a57c9002794368c5aa06690efb08ea3a20820c0081", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246418, "uuid": "dcd20357-cc73-41fd-aa42-1d57f886bea1", "value": "T162C45416EA21A42FF49389B069789546BC2C2D361790EC57F7801FA97070AABF5F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246418, "uuid": "dd7acc1b-22c3-4cb8-94a7-2484595d532e", "value": "be8b1e4513af1490267e92aaa99e2478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246418, "uuid": "10c6df52-e1f1-4619-9829-43d822796f9e", "value": "12288:OSs9O6JohwwtnaO7VHkUY5QHsIUE1LqbEE1X4:Ot211GUEQvqbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246418, "uuid": "58a917b7-de95-4027-b606-19f29e8b9bb5", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246418, "uuid": "8e37b3ce-9503-45ac-8b6e-4b17efed4ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246418, "uuid": "38546720-4c5b-4ef2-b4f0-85b5ca5ded7c", "value": "10e1937e8308d10ddac461174dac8e4f5e3634b4532e89b111426e83fa2b51b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16090cd4-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778236723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236723, "uuid": "ad8e13e7-3555-402b-9e1d-e25b03d1dbf0", "comment": "Malware payload (RemcosRAT)", "value": "5aaf057ffe982d84bbb1596ba3504eab", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236723, "uuid": "b8801b7e-347a-41b7-abcc-f31c1557443e", "comment": "Malware payload (RemcosRAT)", "value": "110cfe6ba39a6a6f0a11a88af8fbf31d7740759e06074649750b063cf370eb37", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236723, "uuid": "334b30a2-4863-4497-865e-d9a29de6306a", "comment": "Malware payload (RemcosRAT)", "value": "760a9a6f253c6b41ce21fa9d3422cac27e7bcaa4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236723, "uuid": "e78938e8-8cb0-402a-9cb5-36991af02c54", "comment": "Malware payload (RemcosRAT)", "value": "7706ef198d7a2ec1621be31bb6521551abbdc31d0501bd051e981042ce4d71fe365c4b3b81d42b058e43a9420f9df153", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236723, "uuid": "43e3997a-05ec-4ed9-a8ae-227854de9323", "value": "T117634B30DE54063B4F4767A9BC6A8761C9BD8206863744B1F6DA070D61064ECF3FEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236723, "uuid": "39a29e2f-ac57-4ec9-9497-323754702822", "value": "1536:d4s5vlCa/PqJKcjtbvZdzCsaY4NYhi4x9SMGLte03:d44lCa/PqYIBvZwrYliQIrLtem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236723, "uuid": "80b9be90-ac83-4cc5-9321-7b503f4233b9", "value": 66768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236723, "uuid": "c32c4478-2f0f-47e4-911c-95680b0b9845", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236723, "uuid": "e21fbd8e-0bd5-4ab1-b0ec-7eeccc329bf0", "value": "ENQUIRY - MOLYKOTE M33 MEDIUM.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f50b192-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243745, "uuid": "4bd770d3-41f6-45e8-9700-4f8d119dc11e", "comment": "Malware payload", "value": "9f6df1a0e4818de49560f06e2f3b21a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243745, "uuid": "ff637fb7-4e97-44c4-a2f7-239111322551", "comment": "Malware payload", "value": "11510ae917d6a00a8fe685f94836b5b8b0dc8e64e1778c63110db9610ef9a147", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243745, "uuid": "1a167136-cf19-45d2-a729-ee59fd48c8e7", "comment": "Malware payload", "value": "ff497a2c1988c435b9227b7cd0278576c0ddc803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243745, "uuid": "96e1b933-b113-4bbc-b6b7-7291b115e6fb", "comment": "Malware payload", "value": "bdd09ccd36188606e0f1b6e0b4561c859aaebbc59798b1d1fe96be310ceab9c0427ed5b6691118575ee55073fc6ee976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243745, "uuid": "4acae722-d1c4-498b-9c91-480224f4eabc", "value": "T16FE302BAEBD40663E4EB8772617E180009B7B6A2EC160B1F2BE3C1CF0973E456DE5551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243745, "uuid": "b566494b-5ec1-448e-ab3c-daa68cabb7ea", "value": "3072:MRqLL8fVg643i0M0mUwkh+QaBPAjjG10oOWxx69ae6mNfJV3w:2qLQfVuaeiOjoZOse53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243745, "uuid": "2d7c799c-625c-456b-ad97-555343dfe3e1", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243745, "uuid": "8b9d727c-9803-43a1-a139-4ca3ac775bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243745, "uuid": "3ad8693f-b260-4d3a-a0e2-c3c003f56be5", "value": "11510ae917d6a00a8fe685f94836b5b8b0dc8e64e1778c63110db9610ef9a147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246f078e-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246626, "uuid": "8527ec32-e2cc-4a97-a156-e27965e54558", "comment": "Malware payload (XWorm)", "value": "e07c651f51ce3d342f004bb8baa38f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246626, "uuid": "dc3f9704-bd49-469f-b74c-3111315f46a1", "comment": "Malware payload (XWorm)", "value": "11be1121f39e38e7ffacad40cb62a7afa3662c91b2db48aee853b34e1ec3fa4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246626, "uuid": "fe826a2e-adcf-43ad-a50a-bc915e847df8", "comment": "Malware payload (XWorm)", "value": "cfb89b7b7f7b24f43d0f7112fddfcd9b673b924a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246626, "uuid": "64a5c6ec-4fc4-4cf3-81a1-e6e1f3217420", "comment": "Malware payload (XWorm)", "value": "54192b721e9ccc0fa4cb3f22bb8a3e4d435b4e005e4db34a602f3a5e710b3d5c39e0b0ef6a56fe80a729d0bac49a570a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246626, "uuid": "b388c02b-bb86-4892-91b5-fb1c1b1d87c1", "value": "T17D858C05F3E216BBF6A78730C6954336D671F4C013A9EDEB0255A41CAE3B7D26A36360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246626, "uuid": "b23dc012-78bb-4018-b64b-b6197de53775", "value": "b3fe9ff157cd1279a3c0074c55838402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246626, "uuid": "063aaa2e-42f3-419b-9e87-4ff79c20db7c", "value": "49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3Zzic8P+:fmIAkJoz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246626, "uuid": "36d9209f-4475-4cf6-9912-dc073dce17be", "value": 1809023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246626, "uuid": "05704d43-3cc1-43aa-bdc7-deb1b77c5905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246626, "uuid": "1b3f9090-3888-4f36-a7da-973f23ef6ed5", "value": "11be1121f39e38e7ffacad40cb62a7afa3662c91b2db48aee853b34e1ec3fa4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d30da6-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778243142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243142, "uuid": "251f6f22-ddd5-48b3-ac08-a82a2265db7a", "comment": "Malware payload (a310Logger)", "value": "9e9f51ef4b5b61955a37c700992e1248", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243142, "uuid": "9ff2d02f-7256-4c0e-ad42-54975b9ade57", "comment": "Malware payload (a310Logger)", "value": "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243142, "uuid": "10f7d903-44d4-43c8-92fa-6ec29463df07", "comment": "Malware payload (a310Logger)", "value": "96e3cbda0307c251c69d275abde53fab3c37017a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243142, "uuid": "c3e4e925-793c-4517-ad15-676a11a8df57", "comment": "Malware payload (a310Logger)", "value": "ab9606a13bae9f9b74da761476248d883d4166bd8dd806fe42184edad0f6860ec347933e453e7162d6f6260dde3a80be", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243142, "uuid": "acd2a282-b502-4ea2-b606-f2bb418a865a", "value": "T1AC55CF027381D062FFAB95334F5AF6115ABC79260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243142, "uuid": "77d909ae-31db-414c-b34b-0ebe58159a0d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243142, "uuid": "971cf1cd-0420-4fcc-aaf2-db5ea5cb2e37", "value": "24576:D5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMr/yaRqGbqGFH3ccwT6TZ1:DPVt/LZeJbInQRaMeaREGFH3cLT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243142, "uuid": "7b40e323-98bd-42ce-a22f-65869eb1bbb9", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243142, "uuid": "becbd94e-8f05-420c-877d-5767073f1119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243142, "uuid": "5ffc22a7-6693-415f-a2d7-0460a3516d98", "value": "11e795305b7fb6432cb491c0b8227410f90eecbe7e5e318d00fe01f036a182a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7537fa3a-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246761, "uuid": "b6c7a2e6-12ce-4c1e-ad31-570cf8804335", "comment": "Malware payload", "value": "fcfe241111c78da5dd6388b654cb15f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246761, "uuid": "e37b402c-0b49-4737-9c0c-58c764572e45", "comment": "Malware payload", "value": "123cf7638ddfd1317a6f92a9ee4c19b9c0c933ae98545f8aea601f3f4701fa57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246761, "uuid": "0721a7b4-d394-4aea-bbb4-efef764d3440", "comment": "Malware payload", "value": "5039576ea10294ab54c8473fdcab38d26fb858bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246761, "uuid": "a56f2635-1305-4490-85c1-01fc380fd761", "comment": "Malware payload", "value": "f6c834860bb22cdb98befdd185020227f076882b3867ac1236dfc3de45756bae2476216eb1648674c4cc61ceccd68b2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246761, "uuid": "48bba549-5297-48b7-afb6-001a35731d8a", "value": "T13815BE31AE062F50D53DCBFC80D20C58D3F98D075241D76BAEE872E96AF7A8AC617845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246761, "uuid": "3bd67c6d-ad29-46f2-8a82-a35129f08d20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246761, "uuid": "81ece15f-9071-4c97-bc42-644f58eb129c", "value": "12288:cKxT8naAw1uAWjL7KcXdn0BFifPcCFoGworu69N95:cKxTeaGnLGcXd0GPcCFoGwoae95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246761, "uuid": "6e54b306-01bc-48bd-86bf-51172d1006e6", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246761, "uuid": "68cafc83-3c65-4659-a173-9dd674d6fe4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246761, "uuid": "f76a3aa9-4b2b-44cf-9a6d-5ed3dd6bc46b", "value": "123cf7638ddfd1317a6f92a9ee4c19b9c0c933ae98545f8aea601f3f4701fa57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a16d38-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243700, "uuid": "72f88614-ac88-4f55-a02c-6962d18101c3", "comment": "Malware payload", "value": "8270849cb70f1102b10a130dd9004eb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243700, "uuid": "e5ca4018-ee50-4f40-a0b1-a44f78f74030", "comment": "Malware payload", "value": "12f6d8dad068f9f4774491631519c64f659f5edc1bb4a6e46ac87017985a7315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243700, "uuid": "626b6dd4-47b2-4892-a6af-d2c5ff61c95b", "comment": "Malware payload", "value": "7f6b2daca318b4ffb148d8f0b46804fbc414aed5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243700, "uuid": "eb35e626-0c7a-4c09-81e2-bd6bb5ba1673", "comment": "Malware payload", "value": "9637e88de272d30b3f2c3da33e067e0f506ef42016be60b45dccdfb7d6698404718dee2051af9f5959122b023d6c4713", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243700, "uuid": "b6fee3a6-8d14-4266-89d8-a8be7d165a39", "value": "T14F8502219E822F96CA3E1B38C0661450B3F0D993E3B7DBDF7EDC50E55E62349CA1A412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243700, "uuid": "a08553ce-d5f2-40a0-89b6-b26cf4575a89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243700, "uuid": "ddaa8bf1-6812-473c-9109-be8385db84b9", "value": "24576:bSPsPAidpbjbRF+E80N50uJ1+0/eS9BrVXqI+TRZ:uEPAupbjbRF750uJ1H/pVaIW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243700, "uuid": "e4c62a20-8a5f-46a1-9439-e684e9b28f49", "value": 1835520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243700, "uuid": "fc75af08-56c6-45a4-a2a1-b926d5e7a79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243700, "uuid": "5757ea42-f1f0-4b95-bc85-59c6b41ae977", "value": "12f6d8dad068f9f4774491631519c64f659f5edc1bb4a6e46ac87017985a7315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad843e35-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244279, "uuid": "87c5aefb-f0df-482d-aff0-74988869d99e", "comment": "Malware payload (AsyncRAT)", "value": "e1cf1e28a618faa8aa6c72b260bd2ddc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244279, "uuid": "3ea7d65e-8e74-4247-82c6-a91c54492a41", "comment": "Malware payload (AsyncRAT)", "value": "130c6dc6832f699ea5a82d1d77ebf288c370402842debf136be1fe084cae1483", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244279, "uuid": "0348fa13-6344-4fe7-9558-d6ac845b3c94", "comment": "Malware payload (AsyncRAT)", "value": "059b09e6dbbfb78124d82203b037dd8b897a774b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244279, "uuid": "aba099ac-e712-4b3d-9f07-3a8b66a7ea32", "comment": "Malware payload (AsyncRAT)", "value": "77f8f848db84abcc34bea4e88618ce599421b58bd4512ba8bfb55df76ed73395e328808228947194239de21d322d651e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244279, "uuid": "f1dee1b1-ef2f-4fc5-a451-03ce3b5f159b", "value": "T1C8F36B07B3A530F8E17BC175C4924A46E772787A4761AB9F07A04A7A2F237D09D3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244279, "uuid": "95bf3260-17fb-4d62-9e1c-ed724647d61c", "value": "eb55951f74d08ec7d4b3760e87582915", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244279, "uuid": "7fa9a78e-9168-475e-a80c-5d0530bc3aad", "value": "3072:bSzF0EOSgOnbhXa3rxt0q0xdXPybPLrK/E8tlDkVt0Nf4GN:bSzFcOnbyrxeqIqPh8t/f4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244279, "uuid": "59bd69b0-5e25-49eb-99a6-f10288afa87b", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244279, "uuid": "e59e582e-be2f-40be-a6c0-3bdc28f3ab87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244279, "uuid": "e6d0b37a-98a7-4577-b462-f1237d129c82", "value": "130c6dc6832f699ea5a82d1d77ebf288c370402842debf136be1fe084cae1483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd51dfcb-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246507, "uuid": "d05a051a-a6c0-43a0-9a71-603d9c1170b0", "comment": "Malware payload", "value": "fb05750a15857fe5ddf4c873f091e7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246507, "uuid": "ebc0c122-4b60-4d25-95e0-681f9a3d5b75", "comment": "Malware payload", "value": "134a04ec6c6774cd2153d659225e250763406f789218cbbea777015cd6cb738c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246507, "uuid": "5945e6b4-5ad6-42ef-aeb1-b1a4b1950aee", "comment": "Malware payload", "value": "5e329a0a5b2baa7c2196af8d759d1c0586f4d486", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246507, "uuid": "091de29f-273d-4ef9-8b2d-41bf60802a61", "comment": "Malware payload", "value": "05f1c0dda88a2534627b079f60116b4cc89c82ad4482e04b4ebd566cccb55b3c601110b0f964d15729c9f50689e5c871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246507, "uuid": "52b6004f-e80d-4049-8093-9a19f2b1ca6b", "value": "T195D4AE159B8ADF51C32E0B74C567046433F9CC0AC662D20F3EDA79E62EB3791AD27642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246507, "uuid": "4d54f1b9-615b-4ce7-9b24-577f6bd82385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246507, "uuid": "225ddacc-7cbb-4cca-9b0b-265fc0935ace", "value": "12288:+3gjaANazqSLT9JL666n5cL6h3Un3w1Z2RZtC6SEAmD:lGGaOSLrKn6L6h3oAEC6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246507, "uuid": "d23a8af0-65a8-4d57-b00e-e11aef7ac8b3", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246507, "uuid": "9614cd1c-9730-40f0-a6c2-fcfc342acdcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246507, "uuid": "5857aea6-84ac-4be6-a7e4-152b2ad06b3d", "value": "134a04ec6c6774cd2153d659225e250763406f789218cbbea777015cd6cb738c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b73a8c2-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244624, "uuid": "94a29945-a9c8-46bf-8003-9b9d93461f26", "comment": "Malware payload", "value": "8c97f30d56d76439517c89845e2e8d13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244624, "uuid": "48515bf1-61f8-4ca9-90a4-1fc64a4b0da4", "comment": "Malware payload", "value": "13aabc253e769e9e89c2365ea97d291a963938e81fb4287fccd5b2e5e20e1f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244624, "uuid": "f07c93d8-80b5-43d2-b5ee-05ac199872dc", "comment": "Malware payload", "value": "5f69a23f5b47c93b105e4df54854b26854d7293b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244624, "uuid": "7ab9c81d-a678-4dce-a5a4-188115214c15", "comment": "Malware payload", "value": "7ded1cd0080014c94d2166946aadce0cb07846705e21dc305fb771a1dc3f3732d4fe325ad3c78ef0d85348e6695b95be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244624, "uuid": "467e86da-cca8-4cd2-afd9-25f93ac3f3d7", "value": "T19B8501101D9DCA81ED7A2E746AA1D2F126713E4DED25C99E0FD472BF32327D46887213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244624, "uuid": "7a5b0406-44a5-4616-8125-2bcd38a5e8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244624, "uuid": "ba7c7e06-47e1-45d6-8b9e-5f26c7d0a3cd", "value": "24576:zkpdVycXX8PLDtatuBcn7nnNOlop9IpD34Drdbay0bOlMryoCaRJPiH8:z+78f5Mnclop904Dp+yFMr1cH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244624, "uuid": "d339c949-922f-471f-8993-f423b64ee37e", "value": 1764360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244624, "uuid": "89f4b9c1-12b6-42ea-ab7e-6e6f43ea1af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244624, "uuid": "d117b3b5-56ca-462f-bb02-5e6aa6ebc7e0", "value": "13aabc253e769e9e89c2365ea97d291a963938e81fb4287fccd5b2e5e20e1f0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8488875-4b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778278200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278200, "uuid": "ae036ec5-bc08-445f-8eba-1ee9ae6aa229", "comment": "Malware payload", "value": "479ccd540cf9972c3d72de5a2a9f0652", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278200, "uuid": "5ae10c5f-00f3-4450-b929-11141079b93f", "comment": "Malware payload", "value": "13cef0f106e564bf8c4d781a8a285cbb7a37f256b5b274404f13c873fc554605", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278200, "uuid": "ae9d8cf5-2ead-469b-a388-33fe490c4eff", "comment": "Malware payload", "value": "66ad90bf10ffdb15d5eb159aa561fca90501a7d6", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278200, "uuid": "2c5dc401-c62f-4ca3-9cbd-0197a1444c29", "comment": "Malware payload", "value": "5e1dac6c951778895e17283edfc331488bbfd93d874cbc0b4c28b5c676c23e2d1446ed216b9d8ab0f0c66e8f0c92463c", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278200, "uuid": "dc049b05-2b40-47c6-a320-7e81477c58b8", "value": "T1EE253355B2401ED5CE7BF316B9B487FF80853991CEB5A4448B28EBF385037B2A4626D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278200, "uuid": "04192727-d24c-4fa2-b095-e63938c85863", "value": "24576:edU4gS0JT9RFfWNlsYwF1roTH+Jkqk5ANUB:zQ0/T8lsYwF10qJkqk5YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778278200, "uuid": "a44f3c42-54ac-4a7b-b034-80838d8a3484", "value": 997337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778278200, "uuid": "d40a3ab1-75e8-4d1a-89d6-4e15d49603b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278200, "uuid": "e5378960-581b-4771-a307-b58c93507858", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba61864-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778246638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246638, "uuid": "74a4d2cb-f8f8-40a8-880e-3c72477749b2", "comment": "Malware payload (PureHVNC)", "value": "a5c3fe2e85190b086d9a1d3a149c52c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246638, "uuid": "5f886952-42ec-4244-96f1-7982cdf5bc98", "comment": "Malware payload (PureHVNC)", "value": "13e9f64b4718c08dace3ec7bedcbdbb7ba12756a235bc181c82527195bfde00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246638, "uuid": "32af1ef7-7040-40ce-b192-d0646aef79f5", "comment": "Malware payload (PureHVNC)", "value": "c8f18a85e232d92c4d81960de2f5bec2bfb29678", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246638, "uuid": "b6a42241-f29b-4244-9b8f-810b39bfd0ad", "comment": "Malware payload (PureHVNC)", "value": "fb2509e84596636c0901752bf9c981ed3ced4b878ddaf54428c7eae1025cf2974c41ef18675c2487cec986db20bb2311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246638, "uuid": "e22a44aa-2d95-429c-881e-1ebee7a57c7c", "value": "T1553412655BFEE731D2AF69392A31A4A02970F38B5176BF3E20F0B09A5D370910ED9315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246638, "uuid": "04b201f7-e000-4078-ac56-aa9ccc7d0a28", "value": "1536:Pf70kxBS8ACm8E8lHOAZ89y0Jl+XOW1Yjnu28VqlNU5grmVZ62Mri1l2b:Y8AISA3Ku284lNU5grmVZcOib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246638, "uuid": "545309cb-b53e-46a3-9581-7a4919c1a191", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246638, "uuid": "ff309cd4-07a4-4205-9dff-aad187c0344e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246638, "uuid": "3b73c0ed-9e6f-495b-b8f3-5f810046e92f", "value": "13e9f64b4718c08dace3ec7bedcbdbb7ba12756a235bc181c82527195bfde00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5ed1c3-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231369, "uuid": "9feabe0e-7513-48a1-a02c-94c83e94c4d0", "comment": "Malware payload", "value": "09c416b336a6c6e066894c2701e6a1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231369, "uuid": "9a808257-994a-4499-8ed3-6b39318c9162", "comment": "Malware payload", "value": "13eb1057e240356749c052fc2d4732fa98021d3b0af8257590b3f99575d991de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231369, "uuid": "f10a7266-f7a5-4db6-8a48-45af0389db7c", "comment": "Malware payload", "value": "2bf75f5e6137fac526646ab33153204fe0cb1806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231369, "uuid": "259db5e4-f9e8-492b-9e1b-f2a75919036f", "comment": "Malware payload", "value": "e28128ed3169522dcee774ea6687d6b1fe432b61731128c140699fe0443e83c2d5b2057a37d9279b3c0ac21fd1b17c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231369, "uuid": "6466a677-fce2-47e8-915c-2173cdea001b", "value": "T15A17238B2DCB40E9D4C11CD49B1B2BE713F2A56A8EC98C3466C53949E0B1F77507ECA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231369, "uuid": "351b9911-0a11-4c6b-832a-d0f3594d3cf3", "value": "cf7f59b4c85a169d5f0e9d7ebd16233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231369, "uuid": "7d73a422-d710-40ca-a5cf-2646e9345463", "value": "393216:4tBZvsPurs7HIE4LMAIUDFXAvoXUAWpCF0wwG1udK7Z8pv:4LNsPuEH/4LxJeCFVKdmZ8pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231369, "uuid": "1e9522f4-4718-42d6-8fb6-c5796224f49a", "value": 18946728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231369, "uuid": "09f05d4e-6064-4198-abfd-0e6816409515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231369, "uuid": "ae61fce3-c3e0-4284-9e10-f9ebd769c031", "value": "09c416b336a6c6e066894c2701e6a1d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a49362-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265075, "uuid": "0afe5706-ff69-44b7-8ca5-e858a04aebd4", "comment": "Malware payload (Mirai)", "value": "e1cbc66b8f9f006e60602d797129806d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265075, "uuid": "9a826d9c-bbe9-4b10-9832-0256f7dcd69a", "comment": "Malware payload (Mirai)", "value": "1417d5048a9de3c5754b2922bb488431a9d1ef4ead63dc8b5797f06ab2adf501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265075, "uuid": "4cfa04cc-7671-42e4-ab7e-7712942b4724", "comment": "Malware payload (Mirai)", "value": "a9d3a74ed306333453fc6c4abf0aaead1108e48b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265075, "uuid": "89ad3b62-204b-43b8-92e3-30c6c5ee0f27", "comment": "Malware payload (Mirai)", "value": "0e7ad8eb2ef9f76da9893737683953005f8ce7c7268abbd3a375501bcdade30c236c408c830cf9b2e8b7fcb51e2a27f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265075, "uuid": "c0ef2215-c250-43ae-9f9c-431149010f37", "value": "T10C13F684B8869E06C6C0537BFA0E82DD3B2973D8E2DD7303DD156F513BDBA2A096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265075, "uuid": "04aee9ea-1546-4b15-9113-bd4ce3e10aa0", "value": "768:5oXgKS/E5do3soaHo8zwESkBxl3zhdQhLljkbsZV0w1Wbg5:CXgB0tUg7BXQ0bu/oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265075, "uuid": "8670d34f-cfb6-4d2f-8da7-8176f742bf33", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265075, "uuid": "a247baa0-1b24-47f4-a863-2210c788c535", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265075, "uuid": "df5c2b7b-19a5-406e-9ebc-40485de81348", "value": "nexus.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277843bd-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243625, "uuid": "6c06bc76-2801-44db-a2f8-a2104860028e", "comment": "Malware payload", "value": "84caa1b6115d0f6a2e96942bc41306e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243625, "uuid": "d661d02a-f857-4a9b-96aa-47d864500033", "comment": "Malware payload", "value": "1461d81916a2cec46d806341b76e35e2df6fade2e9f441217fe93137a0967a0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243625, "uuid": "44e5253c-6deb-4382-8790-884f60f84777", "comment": "Malware payload", "value": "bf827b59131aa2e7fe6a320f7f3ba2f1d430c93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243625, "uuid": "0657e9a3-b51d-4f70-918c-97ad97607063", "comment": "Malware payload", "value": "e7f1eac06a0a27ef480e477f055b701a42b977ec80280b98947c920421848a4f7ba0090bd2dfbe2ec65c8144c27661a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243625, "uuid": "59448202-2bed-471f-aded-43d74b6d292b", "value": "T1AA03E096B6A8FC68F8BB863144741674FB6339602F3387AF013D707A7C765916A50B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243625, "uuid": "bd7c0ee0-1c93-48d9-9dbe-6ce4131fc59b", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243625, "uuid": "29b7dc18-6af8-4b83-ae16-dca43bf56391", "value": "768:JO7LbZgoEUd7spY5cEnyt2hNEY4WZaBblEf6xjuVNGnp:M7LbZgTQ5cr2hNsLEf6lkcnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243625, "uuid": "18d31a24-5e37-4791-b726-14a4eff48d54", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243625, "uuid": "cbc5b92f-9652-42ab-91da-96743ed48531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243625, "uuid": "28bbdfb7-485a-49a0-b1ce-56e9a070a84c", "value": "1461d81916a2cec46d806341b76e35e2df6fade2e9f441217fe93137a0967a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bc251b-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244311, "uuid": "1dc29def-0496-40d1-a3e1-889eb2eb144f", "comment": "Malware payload", "value": "b342d772c21a5f87996677063ab84b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244311, "uuid": "09ae48f1-102e-4d9d-8fce-ac4f0d5e3a67", "comment": "Malware payload", "value": "146ae83b1670cb8f0258b8518900dec455cbc9e140ffd1118015f7c2cecd40d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244311, "uuid": "60913671-5150-476a-a507-99c43d28946e", "comment": "Malware payload", "value": "59f4df833d2196190a9555b97839bc4353dcc80d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244311, "uuid": "53e04d27-e2b7-4a85-86be-dbf073caf165", "comment": "Malware payload", "value": "a965f9274b86abb36722cc7fc29f1927528f8fe1bf3d438151045baab507464bd1b1bbe2b0513b928db61d4a2dbcb0cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244311, "uuid": "1df3574d-52ef-447d-9f30-59d00f9e09fa", "value": "T10055CF292E834F50E06E4BB8D372195467F1CF139D96E7D79ED82AB4FA7334A9402243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244311, "uuid": "c972f728-73b7-4a98-a560-012ba409fb6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244311, "uuid": "dbdc9297-3bdb-4ab0-a910-1295bfad91f2", "value": "24576:pBFRj0Ud/NKB4kv5sEUtHP2iNW9CD8bPlThtJx:DvjXSSPhNq8O9tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244311, "uuid": "21fe4544-b3a7-4239-b083-6817a993a54c", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244311, "uuid": "545fe98f-71bf-4d78-8907-2b975f3d39d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244311, "uuid": "3ee33dca-00e4-4477-bb6b-72c66a2e80e8", "value": "146ae83b1670cb8f0258b8518900dec455cbc9e140ffd1118015f7c2cecd40d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9ba773-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243148, "uuid": "87dbcfda-f596-40f1-ac83-cb553126a2b0", "comment": "Malware payload (AgentTesla)", "value": "6addae8610ebf39fe462c8b1d1a2e6fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243148, "uuid": "696a6aa4-dd2f-49b8-b8e0-e2f00e64ba34", "comment": "Malware payload (AgentTesla)", "value": "15d9a13a2816d734cbc64b2318e49b6cad4e17c77157bbb956e985a084662372", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243148, "uuid": "b6028e8c-6015-4957-9005-d93377df1d13", "comment": "Malware payload (AgentTesla)", "value": "fd57115461d4f0ac029e44d2dd3a8471a2f62be6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243148, "uuid": "48907567-ba1a-4be1-8619-eb4cbaf8fd7d", "comment": "Malware payload (AgentTesla)", "value": "641fe0e0b7720e12437a50db4c5bf22290c41b198bf97da380adf38f2b5269673dceb455facdf8b935d4e2162a16f91e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243148, "uuid": "1953738b-2d04-4aaf-98d6-3a4f569f4201", "value": "T151340E037E88EB15E1A83E3B82EF6D2413B2B0C71633D20B6F49AF6614516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243148, "uuid": "2f76290f-41e8-4aa6-af0c-e09cb1348574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243148, "uuid": "47266cbb-a397-4a8b-be93-12af40498e68", "value": "3072:tynlw0w8gtQBAle5t0i/bMqOub254SskozG:onlw0w8gtQBAlaN/oqOub9/k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243148, "uuid": "f300787f-decd-4387-aee8-5ab561627bdf", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243148, "uuid": "389ae5e2-59ca-45a8-8bd9-0a0bc33923d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243148, "uuid": "222664db-6f2f-4d6b-93ee-02bd684538b6", "value": "15d9a13a2816d734cbc64b2318e49b6cad4e17c77157bbb956e985a084662372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b591da3b-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231408, "uuid": "a8db9822-0601-49bf-a6d7-99b733764e82", "comment": "Malware payload", "value": "4de6629caf994e805ceca12b8d6ba3d1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231408, "uuid": "2379558d-1112-4e8c-aac9-f867d1455b68", "comment": "Malware payload", "value": "1657544b1c70f59fdb749b084dfd312fda19e1788a5b80e8be28f2017f7f53ab", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231408, "uuid": "271cab49-240b-4888-91fc-04bd1d129c4d", "comment": "Malware payload", "value": "d6d027b5f3d9fd3c6690ce8e1ae8d4be1763758c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231408, "uuid": "ebd45b4e-56ad-4878-a92c-ae23bcda5557", "comment": "Malware payload", "value": "d3ee80060ba30c02ea2334b27cb6ee6028ba0f67ace2514cf81a3eea7e9dfcc6f815db35a7e8b29e67caa8fb95ca8b9e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231408, "uuid": "1e150fcc-e2b3-4039-abcd-4e2c49814ec8", "value": "T1B507230BF30CAC6AD9F75335B9364367641B0D254F83C68B68A0723DA9B36C05A6DBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231408, "uuid": "5c705fac-3fdf-4528-9bbb-02905cbce4c2", "value": "393216:VmkehPrWSsQuV1+1WSHMV13HXva/p+YjfkLfDbcv:uPrQr1cQjXvWYYjMbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231408, "uuid": "b2871108-c2ca-430d-9538-4a5edb1d9322", "value": 17347251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231408, "uuid": "3bdb7acf-88d8-4cc7-826e-6cf3520333f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231408, "uuid": "6683f17a-206d-401f-9083-81a20068a86f", "value": "iMobile Lite(8).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b954af-4abf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232027, "uuid": "8ea7191a-edbc-4c9d-9fe8-9fd15590244a", "comment": "Malware payload", "value": "3e5cbc45a865b8bd73eb0a141f01522c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232027, "uuid": "0ebc28b0-d838-41ce-99d7-7762602cd0dd", "comment": "Malware payload", "value": "171e5b1e8f74f71e76e38cac85180865f4042b7aaab2f863901e40bc0da11d11", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232027, "uuid": "b006cabf-df96-497a-9fa6-f5791f16fa29", "comment": "Malware payload", "value": "aff7c956e0a1ac531d4faaddc283f6b9430e75ec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232027, "uuid": "34b2bb93-0e33-474a-8208-cc88b812d395", "comment": "Malware payload", "value": "652804a13eec6724380f8e5d756e8c98cbcebef223b571bc8483ea63b5a4f20c9bcf07d88ae43dea5cd2efb986b6a628", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232027, "uuid": "77013608-dcc7-4302-bbc5-3a8dbd2c76a3", "value": "T1F4E5F187E708E87BC1B68136817A0B6652578C794A93DBD31E58B12C0DFB6805F5EF8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232027, "uuid": "269421db-72f7-4109-9b26-3aa60a1abdea", "value": "49152:n7GBMepPHeg+PTvzNmj/WkFTZ49y2ULDYPdGjfhew68DDpoYfifcX3O7u0UmVh81:n7cMiRcvBmLjsULDYVIf2WhfiEX3Oi0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232027, "uuid": "b58f2f0b-d4bc-49d8-a662-d4c8c216c013", "value": 3074092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232027, "uuid": "9713efc5-f7ac-4c7b-a5cc-e1e7d75cf597", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232027, "uuid": "d3493b23-74d8-4cb8-b626-820e0cc62e2c", "value": "Road24 Jarimalar Tekshirish.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdbb288-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778242961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242961, "uuid": "636643de-6f75-41a5-bf66-618103b632f7", "comment": "Malware payload (SnakeKeylogger)", "value": "2067b3444d2c079efee4287fec77f35b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242961, "uuid": "7daaf0d8-b1b9-42dc-b979-9a794170809b", "comment": "Malware payload (SnakeKeylogger)", "value": "1741fe897473e7b6f70d5fe19918ea3e41deb9babe12dc8b0a041c8ac71c767c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242961, "uuid": "d2082608-7da6-45d1-939d-fe84286b2b15", "comment": "Malware payload (SnakeKeylogger)", "value": "af8f242f28f896580474eca4960ee2fb256c1cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242961, "uuid": "591370ab-5d50-4c3f-8b50-60c6a63a107b", "comment": "Malware payload (SnakeKeylogger)", "value": "ac41b4cd7a9142f131d44c697e1814d3084a141af36b2862a50b6c0f458e8751030e8b861dcd03a0c5e5b66ba32732f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242961, "uuid": "e1a0747f-a251-4643-a460-9cbdf17ab601", "value": "T17C350148221AE902D4D62FB40D70E7B417A84E99A811D3039EFEFDEBF93D6167C441E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242961, "uuid": "2b37af33-23f3-4900-8932-c1b3fb2cbc03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242961, "uuid": "f4957c23-a7cb-4ceb-8d2a-05be558a684c", "value": "24576:z6OAS1/w0hkOTGCU9jVhfhAnej9jgDiiR5WEbpBhI7R:z6FSZ6OPw3fhAnejlgG4pBhIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242961, "uuid": "47d01d9a-8ffc-4c93-8877-e0af0a13493f", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242961, "uuid": "04615f98-8b6f-4faa-9160-6ca6f614b0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242961, "uuid": "a018b160-df8a-43cd-be5b-e903a72ec617", "value": "1741fe897473e7b6f70d5fe19918ea3e41deb9babe12dc8b0a041c8ac71c767c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa04d7f8-4af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778255870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255870, "uuid": "ad4065c6-a720-4ffd-802b-8b1bde048e88", "comment": "Malware payload", "value": "18685800b70e3e30f54d1a5fa1c4b080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255870, "uuid": "3de58af6-612f-48a0-a770-4cf24842684a", "comment": "Malware payload", "value": "19ec8e73f0283d3fa09fc73d244b7087cd81318c212d722bd0483f92b216f28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255870, "uuid": "ecbe870a-f459-4c0f-af6f-1524c3d64c3b", "comment": "Malware payload", "value": "ef778d59df9ac35dba1f28d603ce575718b9398a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255870, "uuid": "f756aa1c-25c9-49ae-9eb8-351f1211c78e", "comment": "Malware payload", "value": "129d6fdc856dcdf49f062cbf3eab614ade0eb932b57acc9429533c4bcefca6caa4e0aca5fb44e3a0f7d6cdf682879ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255870, "uuid": "d797afc8-1960-495e-aae9-fe57106625d0", "value": "T176749DBAE25911E8E66BC174D9920642E731B81D4735A2F7D67903523E33AD0CE3CB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255870, "uuid": "ae2aa54e-1ee4-43d5-9eff-63414f0b611c", "value": "a830c97b7498a71c0e88fd116c9c0d5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255870, "uuid": "2a4d7b09-c734-4d17-a986-da4ff2945aac", "value": "6144:0kjgTr8XJdA112RYyOamDWsoTF/we2aHcnELVIEp7:0kjCr8XsCay9oWssz2/ELVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778255870, "uuid": "14273aef-722b-44d7-9c90-5d99b5598ec1", "value": 366080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778255870, "uuid": "1abf7461-7e5e-4eaa-96a0-02a2f3c87068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255870, "uuid": "55c61e37-10ac-4550-a5fb-e76bec8a8111", "value": "2026\u5e74\u7b2c2\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42028491-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244528, "uuid": "dc2619ee-592b-493a-b7b4-a9bbcf60246b", "comment": "Malware payload", "value": "fb1d708e6e71f4034aac9f594721fe00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244528, "uuid": "ca52b352-f726-4a47-b4d3-e952aadd964a", "comment": "Malware payload", "value": "1a8162e337ae4c8910682f422a339c88ac20666665e973642d727601ce3231ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244528, "uuid": "7e6a4284-bc82-47c0-8b5d-b9c1e9a06933", "comment": "Malware payload", "value": "f59d00e4417915df4e406bf862eeddbeffbd0fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244528, "uuid": "8e9d85c9-e698-4ad0-a7ba-3e96ec7c34d4", "comment": "Malware payload", "value": "071891ef53f0950049bfbb526f0ad5af26388266d15edd1b069bf97bbf0e70eb8594db0e5be312cc4716d6cd31c46b03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244528, "uuid": "98508515-3b84-4586-809a-3547dd740471", "value": "T1ECC45116EA61A02FF453C9B06A3996467C292D361680EC5BF7801F6970B49BBF0F171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244528, "uuid": "4bc404d1-7911-48db-9018-15d44f2a89af", "value": "c64033c36f96e6b7ede716f94528b0e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244528, "uuid": "317eef23-31dc-435e-ae7a-34a783f18abe", "value": "12288:ykBrIA6hvT7Hh3veDIdjmEY0tVqpu6rDo9zc1XwtxHKFTAGidjnhygCkAoo1Lhyc:XBI3LjtVqpu6rDo9zc1XwtxHKFTAGidU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244528, "uuid": "cc28bcdd-3cc5-4d8c-9750-5b4728cd43e3", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244528, "uuid": "a01e4d51-14ec-43ca-a564-c5bae7256239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244528, "uuid": "9452a8fc-7a97-4cf7-8930-b24c9d39ec5b", "value": "1a8162e337ae4c8910682f422a339c88ac20666665e973642d727601ce3231ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a30c9ba-4b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271600, "uuid": "3ce09c62-c9e6-4ecc-b44b-ea5f10d98d3a", "comment": "Malware payload", "value": "1fe690c46537fd8280849a15666d450f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271600, "uuid": "3234d0f8-46c6-4868-a5f5-5da1d3f418b0", "comment": "Malware payload", "value": "1a8db74bf751f4acc8fda9ea4d5aa56518241e322a530cff30cf56a4bbcc591c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271600, "uuid": "060ea956-da30-4125-940a-7e8624c338fa", "comment": "Malware payload", "value": "1f704e6f7ad4f6f1846549d7bf976560ec24d7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271600, "uuid": "5831ae01-a271-4457-a3d2-c90049a8d8a0", "comment": "Malware payload", "value": "856a45da1774bb6a4a8e3d0aa9a654d9c9a5198f2139e29df8e3ca8a109837e98b7d4727bf4cb325e1dcf728339084ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271600, "uuid": "d799216f-c890-4748-83a1-5cff047b032f", "value": "T114C3E1E1D6C74E56F2C95A72238C7AA617B88977501F4340B7B5AA79BFA03C2970F1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271600, "uuid": "f14ad40d-caf7-493f-89dc-44dd02d41d7d", "value": "3072:1U/suahz+OJmoqYdmX3kOznC06vXMfQS7ZQEc1BAd+i:1dLSOvqymnlznL6P8QaZQEoWQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271600, "uuid": "02a19f07-b2f2-4a11-a1ab-f10a8fda1608", "value": 123522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271600, "uuid": "18bffb9f-4aa1-44e2-8a49-27be99646bfc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271600, "uuid": "a81ae046-0670-4c6c-aa38-220a5cdc54fb", "value": "bot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fc4187-4b32-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778281762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281762, "uuid": "77d0485d-3aef-42ee-8488-49abcf15ab94", "comment": "Malware payload", "value": "180f2abdf97d78f3223b839c86e62475", "object_relation": "md5", "Tag": [ { "name": "circ-rs-gov-br", "colour": "#5EC937", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281762, "uuid": "632ffb43-a5f6-4537-bcfd-290448fe0937", "comment": "Malware payload", "value": "1ad98cde2cbed03b279b41767b0568d3f6cd7e0ce252cec4b30deb702e5ff13b", "object_relation": "sha256", "Tag": [ { "name": "circ-rs-gov-br", "colour": "#5EC937", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281762, "uuid": "7bd96116-2791-48f0-8a45-00fe6f97342a", "comment": "Malware payload", "value": "345f1878676d61911562777c660a10f508506a6a", "object_relation": "sha1", "Tag": [ { "name": "circ-rs-gov-br", "colour": "#5EC937", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281762, "uuid": "aef833e1-ab40-4c9a-944a-a0badd7271e4", "comment": "Malware payload", "value": "f2d6484a67daff9c3979698332bec1a26a1f7dfcaddef935752efda326619a6b02fd7f9f92c76ea38bbf208204831957", "object_relation": "sha3-384", "Tag": [ { "name": "circ-rs-gov-br", "colour": "#5EC937", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281762, "uuid": "cb58228b-3c13-48df-96de-05e858e51e6e", "value": "T1E61271C5B7E4237D956038AC643F250B90B3D8213814C1D5EAEAFD973E3A6583526EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281762, "uuid": "0d92569a-9d94-45d3-a4d1-edd2c552d042", "value": "192:TIThnsk4IXx8da9Pg6bbsSpK6K4cJT2nNtcjeyjWwz7zo9g:TITZukYapg6bbsSM4cJT2El8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281762, "uuid": "6723f410-435d-49c1-84c3-011523141d0b", "value": 9247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281762, "uuid": "695684fa-b780-48f1-b83b-406ca6e926bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281762, "uuid": "b4dd279a-abb5-44e9-beb2-2ad545df5f71", "value": "OficioDigital.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51738782-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778244554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244554, "uuid": "1b83a4cd-61e3-4bdc-8b03-4e97582c5b9d", "comment": "Malware payload (RemcosRAT)", "value": "21dfac75befdfe6ca0ad867d42e8228b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244554, "uuid": "545a3894-a777-4976-8736-497e1fcc8671", "comment": "Malware payload (RemcosRAT)", "value": "1b79abd8fd656cbaedf758615f1a8c0cdbc5239f20a6d6a388d54241290a3b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244554, "uuid": "2f0849e4-cdcd-4343-aa29-9fc6d50989bf", "comment": "Malware payload (RemcosRAT)", "value": "e2bc37b8cbae6f2f11bb0355097ec63c3a4435bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244554, "uuid": "0c9c5b74-c2f3-4c7c-ae52-60a921b89e83", "comment": "Malware payload (RemcosRAT)", "value": "8b75ca75cc7604c658b1e220d5a548c406f191e5f853597a242bcdfbfb8026cdba92f4191da782d322ab55e88f8792f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244554, "uuid": "28c83b51-65a8-4947-af34-b16fc5d9ddcd", "value": "T1DCA4BEE2E2509996E82E533898738A321737AD6D9DB5874F135D70647FF33C22067A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244554, "uuid": "36ed84e8-8fad-4ae6-8728-6d12de464bf6", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244554, "uuid": "08a5c442-40d9-4a21-b1a5-b913d9915329", "value": "6144:H3hqLfyApabvBMFFFFFF+FFFvEPw3qvINZhEpazRydIw2nS6kCa/vBuZIIsGMPCB:H3eySeIs8INT17nBLa/5umpGeCI5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244554, "uuid": "d125e781-3fdf-4d16-ae57-4b290a0eda20", "value": 460464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244554, "uuid": "30a8985f-a048-4c91-a650-6ab17b1f40c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244554, "uuid": "2d54ced8-4380-40fb-aae7-c4653c3d869e", "value": "1b79abd8fd656cbaedf758615f1a8c0cdbc5239f20a6d6a388d54241290a3b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945b34ff-4aa7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778221903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221903, "uuid": "1d8cd2b1-143c-4cc3-a7a9-e1706bc83d4b", "comment": "Malware payload (Mirai)", "value": "d0bfe0eec55aa9da0e1dde9e8dd94f67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221903, "uuid": "a10d467d-4c7d-4bf5-92da-5388b5940808", "comment": "Malware payload (Mirai)", "value": "1b99806d49a6946c0599402ccd7ff662860bf3d17d55c7870da1cbb2e38da971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221903, "uuid": "98263342-ee29-409f-a884-7ec4b5c37b17", "comment": "Malware payload (Mirai)", "value": "d0dddc9fca704270abfbd7f3488d9dd8786fd5e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221903, "uuid": "b22aa5cf-4eb0-45ec-a3d6-db59f8276cab", "comment": "Malware payload (Mirai)", "value": "bf1a34587682ddb3db40ea65262f75a74931d856924ebc5486eb1e11cdae88ab067d28933fc16fe1c78a6d52b4c9d3ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221903, "uuid": "b2676722-54f7-4743-ab52-e28f1c50e6dd", "value": "T10404392F258192F0F6411B746BCFD3976C390BBF41A9909F6B516329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221903, "uuid": "14c0c073-5d98-4eb2-9a0f-de62e1647dd5", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wmUX9:7IJ5k1DVA2nDXNgEJi5azN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778221903, "uuid": "eb7d91f6-0f93-4bcf-bb97-803361a876c8", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778221903, "uuid": "a99f2c38-1d84-4cf4-892a-12a6d719410e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221903, "uuid": "50f0c736-07f0-4d23-bfb6-a5bf2d5ca024", "value": "xnxnxnxnxnxnxnxnor1kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c368e8-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244058, "uuid": "a2c44595-4e29-4df9-a801-f4dfba7117dd", "comment": "Malware payload", "value": "6e79c6ba582e0a4a92a2440f7e1c1f25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244058, "uuid": "1642cb21-59e3-4856-adf0-06a999624202", "comment": "Malware payload", "value": "1ba00625b318843154fcade434d868fa309e65e15d0ee584e98958ac1a929b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244058, "uuid": "35154d74-025f-448b-a084-91829af52a04", "comment": "Malware payload", "value": "a7148944d51fe242d284c2e58c9b837bb4cb3911", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244058, "uuid": "efe932d9-aa10-4179-876a-81dfcded9cc9", "comment": "Malware payload", "value": "e633c2831a3decfa9b99826c26aa0c1459372f312147d17e7ef1db011339bab3e28ef9d4414bb5db955831dbd272b217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244058, "uuid": "c4449f25-dcd8-4dfc-a756-4d0c634c2f4c", "value": "T15AE3120BBB3D1039D8EF9E7478BB4E4006F77AF79743431FAA91D08C4616191AEA24E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244058, "uuid": "1ac8e635-22b9-4bff-9302-507364c6631e", "value": "3072:jMOxo2wrpjXnmcpUMuQk9lakmTMQKidJpvfznAXN/PaFbarqWbeVa6T:j1l9DEkQRpvrnJba1beI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244058, "uuid": "245100c5-f7fb-43d9-ae1c-6da8774f75af", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244058, "uuid": "d20dfa23-309d-46ca-89e3-ce1cd7ba8e33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244058, "uuid": "1764333c-491a-41f2-b573-0159d8b6afe7", "value": "1ba00625b318843154fcade434d868fa309e65e15d0ee584e98958ac1a929b10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497fe3d7-4b11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778267304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267304, "uuid": "8010027a-e739-4fd3-ab47-66f6b3d1e297", "comment": "Malware payload", "value": "6def58d1a03dedebc866491897c31216", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267304, "uuid": "93473353-389e-441b-99c7-ed53dd82b432", "comment": "Malware payload", "value": "1c0191c681260a680367eeaa94365707f534edeee09a4934be541b6bb7037308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267304, "uuid": "c9d31cd2-3d36-4d9e-8fcd-f7456231a528", "comment": "Malware payload", "value": "5ab3f35e202afc8067a4c6a5b091c308b34b9d43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267304, "uuid": "1dc26545-63ff-43b8-940c-38adc5fa5737", "comment": "Malware payload", "value": "6fee61912225cd17a745fedb3182e7f5c97384cebb2e912d0344c04e867fcd8de9a9d75cd36509557a3679f865753de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267304, "uuid": "050f5106-2978-4b03-b616-370764e42d39", "value": "T16C967C03585719E4C1FAD639D0632254AA697C0887383BE77D90DCA22F3A7D46FB87B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267304, "uuid": "0a2e1c87-01df-44db-8c3d-b22a1a86c9f2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267304, "uuid": "c262d898-d562-4b68-97d9-f47d191cc79d", "value": "49152:pZgDIAbiWAKpVz89JI/NT74BCDceaHb0FvBr2dcy:pUGPxMNwwDjHC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778267304, "uuid": "bab21a5d-ab80-4c53-b99c-d49ed18498d6", "value": 9278088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778267304, "uuid": "138c29ac-4a6f-4c83-a7c9-43f24b6659cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267304, "uuid": "f5bd5d23-5a6c-4f48-bacf-f72fd1afa17e", "value": "ToolsUnlock_v2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2c8f92-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232491, "uuid": "539fe899-7bbe-4aa6-8423-ca2a0ba8eb2f", "comment": "Malware payload", "value": "ee920d9cd0af84c0fc5460bff4c15dd6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232491, "uuid": "62e85e06-856a-4cf1-9543-7a161889ee14", "comment": "Malware payload", "value": "1c074b4be09c1804539b2dd4f794a886aa923625b45748834e1120e713844485", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232491, "uuid": "3b83f2dc-9a2d-4f62-8b6f-9e85846250b7", "comment": "Malware payload", "value": "f19ea9a896383af9fb318c3dd87fdf21a21be39f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232491, "uuid": "2e15b443-db66-436c-83fd-74a227020550", "comment": "Malware payload", "value": "914cadfed43e7663ce2404415964e27967a5098ccaf0a42f9878c1c15d231783e8ef891713d9f54f5b818f7cae9f903e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232491, "uuid": "9a062cdf-8957-4671-b548-2b5070d86d83", "value": "T15AE60227F35C9A57C4F28A35B82543A15A2A3EF51B03D3B3B81077786DB3DE44A1A5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232491, "uuid": "c0bb9712-7478-473d-b292-aacb12a7d1fe", "value": "196608:CdOwmtFLcxTnCX0xij1WSpevK4kfllFIUE4b+q2rTPy/KQujKYdFS0YOAIv3KaAY:guSU1TpeK7llFILqOPLQmWOFayHbxEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232491, "uuid": "cc386879-e4c8-4fda-b928-778c83afb7c1", "value": 14623403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232491, "uuid": "a7479505-2138-4761-ae6b-e97ce03fc1b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232491, "uuid": "6321eccd-97c0-4d5e-a2cf-e04a373b28c8", "value": "1766631117_M Parivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29aee366-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243199, "uuid": "7d898e08-f200-4dee-bb97-251555d544dd", "comment": "Malware payload", "value": "04940dc05c3ac19ff98e32d84d94eb09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243199, "uuid": "9bd16c7a-fa5b-4061-ac92-ba26b82ed597", "comment": "Malware payload", "value": "1d4e7db28e41141d32bc36a1d60aa4e60451d2a61736994010c9e6c4f8bbe7f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243199, "uuid": "80a81597-2c56-475f-b142-4c78f51cff4b", "comment": "Malware payload", "value": "6a909c6ad87472678e1274c7f5fe1975f15b5f85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243199, "uuid": "cfa9de24-eb48-402c-a0cb-1205fb72555b", "comment": "Malware payload", "value": "2fef137e0270d05d6be478bc15a8b699ab79f7de56bd682a62f4332b51c697b0978c064f0c67a23d8abcde3e294525cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243199, "uuid": "73560269-efdc-4029-8d83-338b2cacc8a3", "value": "T153651255275AEE02D5821FB40D70D3B447B8AE99A822D203DFFA7DEBF9387413909253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243199, "uuid": "e76151da-5f5b-4c24-ba0b-28fcb9abec3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243199, "uuid": "e3ae6561-7ef8-4ea9-a62e-b6638a3160ef", "value": "24576:3SJJSHwm6ytuCY3pqqwyw1etqJ3scRGaLut/6aw2GS1Z0TlKAkT3LPlsDajDBQKV:3qUwm6jIqXw1yqRscRdC/6h6ZOYAkT7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243199, "uuid": "d2248010-6647-4087-b15d-4cdc60ee1a73", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243199, "uuid": "3bfc5d8b-e226-4f61-8f26-06936bf6db60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243199, "uuid": "3c2459bd-ad0e-43f1-bb82-1be86e3bf009", "value": "1d4e7db28e41141d32bc36a1d60aa4e60451d2a61736994010c9e6c4f8bbe7f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2939f1f3-4af7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1778256083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256083, "uuid": "fefb18a2-58d0-4631-ba5b-4af9131d0f62", "comment": "Malware payload (ValleyRAT)", "value": "6d51a96545f8a3e15308ef8683f64077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256083, "uuid": "ebf03956-570b-407c-bb4a-dab63bec48c3", "comment": "Malware payload (ValleyRAT)", "value": "1d54322168b05c28662453aaf2ddac6028364a138a55631f11f8c581eb01dac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256083, "uuid": "933c1a80-b711-4375-895e-bf70e5de067d", "comment": "Malware payload (ValleyRAT)", "value": "6b4f34f69bd1641413d3e34e53fba64def05d1cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256083, "uuid": "10c79102-2003-480c-9e1d-943b800aabf2", "comment": "Malware payload (ValleyRAT)", "value": "6fd1965751b3eb90334108377b3838b1c0b9c4e756a3fd01122378ab26e3f77933061a3914c834f9e14b9e32a9818e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256083, "uuid": "1ea67425-f44e-4217-a645-df73c6555ba2", "value": "T1F4B43CFEA20D16D8D219C478F1521B49D671301D1F22AAD3C2BB43B11D12E958FBE7BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256083, "uuid": "9efac939-95cb-420c-a20b-7cbc23b482f8", "value": "06a3cb853893ee50162ec7476f04cb3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256083, "uuid": "009a0878-b74a-45ed-9260-51898a427118", "value": "12288:R0YpKhNhnIkmSdM8ztkcOoufBat8EDv/4yMBttTaTKwuy5YGMvBOkmHAwagZ2zX6:R0lnIkmS68ztkcOoufgt8EDv/4yMBzT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256083, "uuid": "5424f3e0-7e7f-486f-8f7f-6a753b83b7e4", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256083, "uuid": "de9c1bc3-af39-4418-8612-de44c6c041cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256083, "uuid": "3a21b4b1-9901-4a00-be58-d381d0f1e07d", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u8fdd\u7eaa\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfe6d07-4ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234158, "uuid": "4a730c55-8687-46a8-88d2-006860516481", "comment": "Malware payload", "value": "ce6ee8fae4ea0017f6056b90209a9291", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234158, "uuid": "6ea02038-3f8d-408c-b281-392d4c5efeb8", "comment": "Malware payload", "value": "1df1286d68b48669633534d3b7dc24ad8e69d87929cdcf4250691a106df7cd41", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234158, "uuid": "0a1ecb4e-63bf-4ac0-b5b0-a500ad7e00b0", "comment": "Malware payload", "value": "efd6a4c26f57b28c684e03613853e78dc3a7e43c", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234158, "uuid": "4cfdada5-9844-42f0-a7c6-4e0d0eded6b4", "comment": "Malware payload", "value": "340d884648bee2d933d31f31446a2639b757ea31573b6835c73d5784e429dcb65f93993b6fa0d7a88b7a76d56dde29c9", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234158, "uuid": "60b267e7-c807-4083-a5d5-2cc52d4adbbd", "value": "T166E6C1D14F7820AEF0ED25B2E93C33D48BB35FD14C66444E92AA07A6D870BC4B869D5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234158, "uuid": "e01bf2af-0c25-41c8-9264-e0f08c54a660", "value": "384:xh7sVGV844cHMderuw3dmHlpY2KS5h3iyYU1h+9L67tyT8tJjsNRSRS5sHp2m+vy:xyl30z5OZia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234158, "uuid": "afa9b8c8-384d-41e9-b037-e1a98810df30", "value": 14444194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234158, "uuid": "06cbc2d9-5b20-4dfc-8957-96ff64b74629", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234158, "uuid": "8172a3cd-a77e-4074-ba1a-04fbe066f132", "value": "FEDEX-MR-26-20329 TS-ELE_M10-M26_GENERAL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4d3262-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778244441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244441, "uuid": "1e555ab8-c688-480c-b74c-12c475375e39", "comment": "Malware payload (CoinMiner)", "value": "137988c7fbe16680b59edfa146d844a1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244441, "uuid": "25b61259-37cf-4eaa-8d7d-2ca6a235a743", "comment": "Malware payload (CoinMiner)", "value": "1eedf9e28df3a305672087ed727afeefce0d29ef27daec20923251f1e14c0e12", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244441, "uuid": "9a9e7702-92d2-4075-bb7e-e17960e921ef", "comment": "Malware payload (CoinMiner)", "value": "214c86e75f35f8e5989e42e8dcfd7cb396b67564", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244441, "uuid": "b257aedf-7350-476c-971c-2ffecaa50ab1", "comment": "Malware payload (CoinMiner)", "value": "05cb49f4867e1375907a4ebaa0d5b4849e720390825b89df1bd018dda22999690c45ef0d24f7ef066cec93023f788e86", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244441, "uuid": "62ca99ae-505f-4758-ad22-f1a9c44f805e", "value": "T1E34633963B914AFCE92B903DC7298692E62278C41B61EEFF095105733F13E917E3E614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244441, "uuid": "f967f07d-0792-4ce3-8139-e8fb9ec4c57b", "value": "587c0153c289c9acc1644aba5b044755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244441, "uuid": "68826169-e19b-4660-8c3a-ea307bcaa84c", "value": "98304:Hwks4wpiskN6nB98fa3ecmtXctbnlQXfffzCyqUqav/tU0V9ZqeWttKkI+UuFJyi:HF9l698auc5tTlUOKzBjqLtKkx1nyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244441, "uuid": "9080aa45-4269-40a8-b1f2-e8d0de4c501e", "value": 5402112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244441, "uuid": "e158821d-e109-4358-8eeb-0aa6d908777a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244441, "uuid": "193a50c4-d99a-43bf-9fe6-2d21bb01727e", "value": "1eedf9e28df3a305672087ed727afeefce0d29ef27daec20923251f1e14c0e12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd30833-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244466, "uuid": "e9e28737-00a8-4a8f-ac4f-9769db42eddc", "comment": "Malware payload", "value": "a3f566549e94a11900f80e78a546b38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244466, "uuid": "e64efa93-b92a-4212-b9e2-d723d46c5899", "comment": "Malware payload", "value": "1f770cfa9f1dd1a303f0ae9512bb7225ded8cc5b8cbf782c29cc5f72712ee560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244466, "uuid": "1b536078-61d1-4add-935a-e2eece266cb6", "comment": "Malware payload", "value": "3d9b80887e74bc1df328b17a1424a8e9ec9d3b6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244466, "uuid": "f16360ce-d3dd-41eb-a452-57e3ea1c0c38", "comment": "Malware payload", "value": "b3aee3b760077525a7b1a65b9de51efaeb725249d364764845cc8edbd6f2ff9fddc09c2402fa8705acb34ec68ee709b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244466, "uuid": "359ecfd3-b7eb-4c72-a163-1065e4758b82", "value": "T112C42F1AEA60A02FF49389B079389587BD292D721790AC47F7805F9970749ABF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244466, "uuid": "06807a24-8f9f-44f4-b27e-5535aaca3176", "value": "c1f573389eb2f94effce1c53f9d96466", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244466, "uuid": "20204e67-a4e2-45f1-846c-a259bb24a46c", "value": "12288:stIKA7+6IcLJow16UC8ZSDrDcXQDUTQtsCEUZibmrMhBzgH4X4q:oIL7+6SUC8ZSDrDceUTNCPsRBb4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244466, "uuid": "2d917468-a3d7-47b4-b3d4-3eb50d4559b1", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244466, "uuid": "4a889341-ad47-4525-899d-5c96b3675df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244466, "uuid": "4321e857-7f15-4e3a-aaa9-157b2f9518e1", "value": "1f770cfa9f1dd1a303f0ae9512bb7225ded8cc5b8cbf782c29cc5f72712ee560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e44fe3-4abf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232059, "uuid": "3e9fc335-4a90-4335-8518-5eef10746b25", "comment": "Malware payload", "value": "8172c3fadaf74201b2d7178706dfe191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232059, "uuid": "18ce8d4c-9392-463f-a86b-51fa1b1307c1", "comment": "Malware payload", "value": "2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232059, "uuid": "e510fccd-b5f6-47c6-82fb-e6266df3238e", "comment": "Malware payload", "value": "cab28e14e4d218aefc4c21cff619baa1f0bf81e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232059, "uuid": "876bbbe9-e577-41b6-b8d9-12716755a389", "comment": "Malware payload", "value": "b07df116ea66e4636e6980c4c277cb5d2936e74f3ecf1ffb29ffd08db5bd698eecf4b66f1247c1a6890d1e4d59da2646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232059, "uuid": "78575adb-205d-4ec2-ba79-dceb1220b622", "value": "T1E0352209551CCB42D0665BB01EA9E0B0637C5D9EE620D643AFD6BEFFF1B93A01489363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232059, "uuid": "4e58a23c-5a2c-4f63-99b3-25985434ad61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232059, "uuid": "a0c7dfb0-3be1-4367-9c84-6eefa053844f", "value": "24576:HnNr5v67DQec9zqmTXz8Ks8kcLSqOSBPWX+2qwK4kjPLHWMlRl:tdv63lvc+q3BP6+IK4CPDWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232059, "uuid": "17129e2a-32de-4977-b7b7-04eb73c0160f", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232059, "uuid": "9dbdde8b-7d8f-48a6-8feb-4d496abae956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232059, "uuid": "a8abfd62-fb34-4053-8dd1-860303071734", "value": "106600037009 Proforma.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed033f58-4b08-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778263713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263713, "uuid": "3bf02930-d412-431a-986c-bf87ee202a32", "comment": "Malware payload", "value": "c852ac27e2eb3d6a009d703b4b079b97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263713, "uuid": "8443248d-0024-4c11-9748-9caf5782451f", "comment": "Malware payload", "value": "2071a114d26da204891d670de7035f869763799dc40aba610149e11846a26f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263713, "uuid": "71fb3365-5379-4b44-8595-992b4f9e118c", "comment": "Malware payload", "value": "e44635af217ad743450928df8df91586d79aef12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263713, "uuid": "e8648cc5-52a1-4934-afd3-8450117ce9dd", "comment": "Malware payload", "value": "d4958a064078180d8c95185e6c5489637098184326e2975f78d2f0dc4d867df77aa2af2bbe653dd31d91d4262b582ff2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263713, "uuid": "e49c5141-6832-4832-8fb1-6d374b983651", "value": "T1DD059F119F9352EAEC334939D4EA131B78F47CD882A08E33C6670E993D43565B33B666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263713, "uuid": "f8068fa5-9e84-4ef0-9032-b49bb7cec752", "value": "835e7131fceb7b369597efbebd85dc9d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263713, "uuid": "d032cdc1-23e4-4077-861d-cc87b651d70f", "value": "24576:CP134HzWJZncEGahYFQw6UOMc7YN2GAR:CEzgnceeOM8YYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778263713, "uuid": "2c1536e8-9753-4c57-8f7e-8231ac76f26a", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778263713, "uuid": "894241e2-9675-405c-bf21-71e51d12f414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263713, "uuid": "f354a9ab-b6e6-4dbd-a807-08f5aeb1769b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd975f16-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778256761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256761, "uuid": "eb4b53e9-084d-42a0-93ee-a8a024262f3c", "comment": "Malware payload", "value": "1c0fe1c75a2e5a8bd71f03a347096b03", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UDP", "colour": "#985B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256761, "uuid": "6c56c902-5adf-4f6e-bac0-626042a521b7", "comment": "Malware payload", "value": "20e8ac132992310f477965fc981e641eff5c6ee19e961e63eeb4e84635fcc7ea", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UDP", "colour": "#985B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256761, "uuid": "84007afd-fb37-4d10-aec3-748b28446939", "comment": "Malware payload", "value": "a818e888ac1303129f0dcdb63872c8b417f56628", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UDP", "colour": "#985B70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256761, "uuid": "a08ed9c0-bfa4-4978-aa6f-0042e918a105", "comment": "Malware payload", "value": "b3e920e66b3dabeddffd8108bf1f4da920ab4d23fad92a7ef2ef410ce587f356160e1f21160fe51ffffe2107b48f597b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UDP", "colour": "#985B70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256761, "uuid": "ae6afc39-e6a1-4e5b-b39a-7662e2ceca4a", "value": "T131269D0F279306ACC2B6AB39D5535A05E2357DF00BA280CF026DB7A91FB67C29EF5514", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256761, "uuid": "18bf0264-fee2-4059-b211-3de6cc54b830", "value": "a410ae650a0af67c8ef41c26a6f14597", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256761, "uuid": "76009f10-f1c9-4b80-9f1c-f466825a1cdf", "value": "49152:y20uWJRoZDGpmS8PQDiw0tATbOee9rYnR8HR2Zy1YP+ipqHiqsQTtyrJFCkc5lMU:y2m0GmYEf1YfSJwEnXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256761, "uuid": "ad6761d4-6f48-4431-a42e-af398d80d3fb", "value": 4595200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256761, "uuid": "c5ef7503-b336-4560-a8f5-3868523c4c61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256761, "uuid": "ad342ef7-6c72-4e29-a3ac-59ccb2ac5d5a", "value": "\u6210\u957f\u901a\u2014\u201c\u4e92\u52a8\u6613\u201d\u53d1\u5e03\u5185\u5bb9\u64a4\u9500\u6d41\u7a0b\u95ee\u9898\u54a8\u8be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9daba373-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246400, "uuid": "46547399-122d-4801-9457-03b70036f59e", "comment": "Malware payload", "value": "ba84f8048fea72d8bbdab0abfc4051ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246400, "uuid": "82b5cf0f-3797-45c0-96c9-9b1c307fb182", "comment": "Malware payload", "value": "215adc1397ce765297e468e9657fec26219a020724bce42be05745daec4a4d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246400, "uuid": "7e92289f-9b63-45e2-b0ff-27196f75bc8f", "comment": "Malware payload", "value": "e5d948edbc6fbb2bb02453f09482405df6409c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246400, "uuid": "987714f5-6442-4acd-a846-7c6ab820ffb0", "comment": "Malware payload", "value": "8d0e23f52903cd5ee89318bd3137f4df56ec6a188b19c9f538f2227f2b01719d30aa5d7765f00dfd7116b3d038e837d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246400, "uuid": "e02f9e43-5b62-4cfc-9313-13aa83d4168a", "value": "T135C43F12EA61A02FE49389B0797995467C293E321684EC5BF7801F5930B49BBF1F171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246400, "uuid": "4598871c-5fb1-4971-b590-7ce6ed06bb9a", "value": "c9b4920455cbfde73fc90762212c104b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246400, "uuid": "8b474c0e-7781-44fe-9b65-96f90bf43656", "value": "12288:Uzw9BYfCymdL09XybU2TYn9EgA4Fe8pCpdxqhMT6vIlx9ANC6CSC+:UGTqJvIWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246400, "uuid": "35cda2e6-6fb3-4c3d-a0b9-23ec043f599b", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246400, "uuid": "64b3a3c2-3ff5-44f9-87c6-82be3a21e99d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246400, "uuid": "01e8d458-2d15-4100-be6c-1b408d2d188d", "value": "215adc1397ce765297e468e9657fec26219a020724bce42be05745daec4a4d87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c535ae-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243920, "uuid": "a7c656e6-d3a8-45b5-beb2-cf426c59fbea", "comment": "Malware payload (AgentTesla)", "value": "2d7006c5e2ed453c8161ade575818770", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243920, "uuid": "aa821959-e56f-4453-bf5e-d40778df76dd", "comment": "Malware payload (AgentTesla)", "value": "217c329b02cfdddaca6fa28289b873f9411287589bc73e9c83c952f5f39b4b2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243920, "uuid": "94365360-1d1d-4642-8177-7e65dcd64a59", "comment": "Malware payload (AgentTesla)", "value": "98b0687cedd2d497c31c284315e6a9106d5af9d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243920, "uuid": "eded2435-5463-4078-96b3-37d97e3c9a83", "comment": "Malware payload (AgentTesla)", "value": "dafd9437675c7207cf98bc402079ae171f94151d541d6de28075ae5669f6f7441c2174e847d7036093a75c1e14b8d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243920, "uuid": "b6f09a51-cc33-47f8-8661-d90e7d4b9252", "value": "T18994AD037D00B776CB5206F02A2DAD951A737DF5B82FA5CEE3D07A9B56B2E8245381C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243920, "uuid": "9f06c948-f3f6-46a1-9f03-69d3cc0e5b1a", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243920, "uuid": "08cda99f-19f2-4ba0-a3be-74cf142f9505", "value": "6144:jR+xXQQwnYELq6IIs272tfPbj7KlDasdDX8WjQFS2:dswnbLqSozj7AL8Wjx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243920, "uuid": "9d953838-805b-473b-bf01-2ac969dcc22b", "value": 447528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243920, "uuid": "6b366a8b-f2e0-432f-ac28-1b90999db699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243920, "uuid": "40100967-5d8e-46bc-a05c-d977ccdd6dda", "value": "217c329b02cfdddaca6fa28289b873f9411287589bc73e9c83c952f5f39b4b2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca31a36-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233540, "uuid": "9decf6ae-390d-471f-abf9-c10669d4f784", "comment": "Malware payload", "value": "b516ec6c6b37618ad65080a063270ea4", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233540, "uuid": "ee695287-f72e-46bf-b7f3-4df19e1ea4ab", "comment": "Malware payload", "value": "22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233540, "uuid": "6f607962-445a-44eb-8c91-b8b49c0ea68c", "comment": "Malware payload", "value": "b9f25b21eccbcca77adb11a0e613d4eca4e38442", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233540, "uuid": "504eb75b-e03a-40f7-8890-829ed26cf217", "comment": "Malware payload", "value": "41259e481f83a6d945ceedffce05a00c0a202d4ff94f79f3fc3d0b355e35e66955327dfa883ac806d4bc63ccfcd92f87", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233540, "uuid": "b2e62f0f-269b-4fb0-ac8f-1688f10d746d", "value": "T13A540590D249A4FEC8DFF4F006152F643AA575F3B1D0C3B64A624B6369CBAC29F18176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233540, "uuid": "3397096e-43c7-41c9-a521-65ef85495db9", "value": "768:ICrvbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO:DrvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233540, "uuid": "25f5ed9e-6f0f-4e60-ab2c-dee0c8c7099e", "value": 304436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233540, "uuid": "e0edb3b5-fbf1-443e-b919-37769dc75177", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233540, "uuid": "562b5402-5dd1-4dad-913e-918dc6ed6ac8", "value": "22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88d1208-4afd-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778258981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778258981, "uuid": "815a59c0-82d9-4c4f-b512-818a354fcbae", "comment": "Malware payload (AsyncRAT)", "value": "8dbfaf0a1e685b1814237147961568a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778258981, "uuid": "1de7ab3e-dda2-497a-a58a-6e2c4e164a83", "comment": "Malware payload (AsyncRAT)", "value": "225e7d743bf14377c227a86d580e579f66d5d3fce26787c3a1a5677f27698d96", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778258981, "uuid": "84bb1fb8-f5d3-4412-b51d-5da8e8091e25", "comment": "Malware payload (AsyncRAT)", "value": "6f42a7f0358ef0c7c0c6c22e732851dd7de1a555", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778258981, "uuid": "58f883c7-e150-4f50-8c28-99bd9fb58ca9", "comment": "Malware payload (AsyncRAT)", "value": "3a1ea38c123be8c7c004cb072fc75d1e3cc211bb82e5e583a4b0f6f9cbe1fc4d881b7714f13d2cb1427dd9be60204928", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778258981, "uuid": "d560428f-f46d-4d1f-97e5-d4972124022d", "value": "T1DAF41246A60DD903D49A1FB41CB2D07417348E6ED921DB43AFDDBEEF787A3A2090521B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778258981, "uuid": "1080e288-2438-4d03-ba2c-36abf7215a15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778258981, "uuid": "5cf9cac7-07cd-4984-acba-1d2d175713a0", "value": "12288:U5shzjMhvX/sR/PZe31B4cnxX55ir7yThvQWNp2q5hSCL/cIcVMOtborhCLJyvhQ:U5shzjMhvX/sR/PZe31B4cnNruyT1Quq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778258981, "uuid": "29041364-1d7c-4b3b-8ef0-763fd8beab93", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778258981, "uuid": "5a8259c7-3587-43c2-b389-9ec03576ab08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778258981, "uuid": "9cceaf12-1665-4f09-8fcf-4e4b54ed873a", "value": "New Order PO023012026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f65475-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243914, "uuid": "33af37da-2227-4712-8f28-8f9c01f2281f", "comment": "Malware payload (GuLoader)", "value": "8e0ee9d450a92c82e4822392f51c7733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243914, "uuid": "4a1c72be-9d02-415e-9e28-a2358c266aa1", "comment": "Malware payload (GuLoader)", "value": "22d939bf7214c6d4c459c137aa017247273de1aea10cb5efbaa22e3f8410dbf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243914, "uuid": "a007d8f6-4f32-4bb1-aa23-bf124f375423", "comment": "Malware payload (GuLoader)", "value": "ee9d9f0948bb0599ed6ae9cd9630c184f200e34b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243914, "uuid": "d9fac5d9-a329-4bd9-b0d4-ece706561543", "comment": "Malware payload (GuLoader)", "value": "14e7b64ba52949b973a43816e0955793a51582bb9c0ad8d0de2209417d9f2ef75be70a94433ee663658be3fc9b338c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243914, "uuid": "b02e1769-9b22-456e-bce1-89fb96b7db17", "value": "T198A4BE533D44F772CB9202F02A2DAD9516737DB0786FA6CEE3D1769B5AB2E8114382C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243914, "uuid": "9aafce1d-2c0e-4e86-a00b-4e6332eb55d2", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243914, "uuid": "3d69e928-8bae-47f2-9a3d-07c7f6481397", "value": "6144:aR+xXQQwnYELrZLQnfMQHmyD8kWyy6nbmeYKmDixBUNZatcJrZidy6Y1sZSHo7:+swnbLrZ8nUWgyy6bmUdMEw1sZcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243914, "uuid": "79a0959f-4b15-42a8-bc27-e8567fb7bcbf", "value": 488568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243914, "uuid": "2faee303-1eca-4018-b82d-ff2b08c44190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243914, "uuid": "6591e701-5f30-4ef8-8421-94565c7cc62f", "value": "22d939bf7214c6d4c459c137aa017247273de1aea10cb5efbaa22e3f8410dbf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e416d6-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778245743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245743, "uuid": "4bfe301a-a015-4dd0-84f1-47429dfce212", "comment": "Malware payload (PhantomStealer)", "value": "aa257668a9db64ad0c51403ce5cb81b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245743, "uuid": "3ae208be-49c1-4190-8d07-07935985e053", "comment": "Malware payload (PhantomStealer)", "value": "22f734f721052d5fdb9bc8da8cae323d25d5e8bb001b4481fe41ca66cab2a05e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245743, "uuid": "7ed511be-eb3e-48b8-a8db-8da40795be2e", "comment": "Malware payload (PhantomStealer)", "value": "aeaf46b1ebe98716d13aa1c751f61a6081c17dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245743, "uuid": "b37bef55-24cb-483a-af35-832119a1be1d", "comment": "Malware payload (PhantomStealer)", "value": "16fc8159de7acbc9734bc192ed5a3b8176a9ef23126e0db7d28be9691e7b587a19f7b02b7f332cb1a3cf667fb71b37b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245743, "uuid": "33af2d5e-22d2-43d9-a379-c97e055b1f50", "value": "T12065232469A9CD11E8B66BB41C32E1B427394D6CE912C6539FDA7EEFF17DB241900383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245743, "uuid": "30d992e8-c48e-43f5-83b4-1eae5ed5d58f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245743, "uuid": "ec4570e9-80ed-4710-b69c-1023cf391f22", "value": "24576:wfxb3sZ61O+8JbdSBSGRHmRCCRSrqx6rConOe7NPshiwm/RKMqMaBgEA6liqX:wl3sc1SbdSBSGRHmnRSrqyOexRRKM9dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245743, "uuid": "91651d08-5901-47cb-8c37-9845c4165174", "value": 1482752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245743, "uuid": "3d1f48e3-d421-4531-8fbc-dedb7aab8015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245743, "uuid": "d4a7e4b7-2c57-4533-92c7-ff875d537a57", "value": "22f734f721052d5fdb9bc8da8cae323d25d5e8bb001b4481fe41ca66cab2a05e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ac1867-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778242784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242784, "uuid": "b80b4c2a-e886-4477-b099-01ef5ebe9500", "comment": "Malware payload (MassLogger)", "value": "c355ec51d26d8dafa0f37787c8476399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242784, "uuid": "917a76ab-322c-45bf-ace7-fb72905d1a80", "comment": "Malware payload (MassLogger)", "value": "2412c4722a80176c836f1aa773f488c9ef33e13ef0da22e606165f6d70421ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242784, "uuid": "7f166287-0196-4309-a68b-8f1c7c936dbe", "comment": "Malware payload (MassLogger)", "value": "fe71dd8fd43e6ceaad6a195e0d7e9ebf230afaa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242784, "uuid": "b6926817-c00b-46c9-bfe3-61cd19c6a95c", "comment": "Malware payload (MassLogger)", "value": "99ea5a6f36dae41bae1309f406a13918c762bc299867666f970baa996df1e46efc451bff0c7617b6af804366c8e50d08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242784, "uuid": "e671a346-5b27-4cb0-9f67-997f4b94de1c", "value": "T13F15E0443369E902D0A65FF40D31D3B447B86E89A412D307CEFAFDEBBC29795680A197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242784, "uuid": "fe1d6748-51c6-4ed4-9db7-8007bb7f1fd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242784, "uuid": "b50fc61e-7e06-43a6-a81d-1f39ba89991f", "value": "24576:5/amCULB37gyqaH9JYrH2VbYAbvr3K7aLHsOASo:g76B37MCY8MAbvLDsFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242784, "uuid": "ec778126-4f95-49af-822a-aaa0fa09d7b2", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242784, "uuid": "d1939728-4460-4369-bac4-114cb06c18dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242784, "uuid": "aeb2a385-8894-4e7b-96ec-06e3020c0dc8", "value": "2412c4722a80176c836f1aa773f488c9ef33e13ef0da22e606165f6d70421ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588ef8c4-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778243707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243707, "uuid": "e95dd31e-4ba9-4c16-890c-f711eef6938b", "comment": "Malware payload (RemcosRAT)", "value": "3c9c5141ac0819c02401fa90233ae6eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243707, "uuid": "f16ae5c0-3b66-4f15-a246-84216204b816", "comment": "Malware payload (RemcosRAT)", "value": "2423254abd06c4a88efb4d169dec1cbd7f4590eb29078a9a99457e1cfb3bd2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243707, "uuid": "b54e94bb-0529-456d-bd5a-74638a9b3290", "comment": "Malware payload (RemcosRAT)", "value": "a2b55e98beaad508b927155610623c3567a397a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243707, "uuid": "425731a9-a97a-4a7c-9313-2eda37f0e927", "comment": "Malware payload (RemcosRAT)", "value": "a7ec6241236bffa5eef974e1bc42b843f0eb1d3b4714f443ea70201061e8e452ee004f63ec26512d451afaaea1380f60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243707, "uuid": "05b6735f-843f-44c2-b685-31d3b56aeb44", "value": "T18AA4F1437781C6ABD478873659AFC35A2732ED665B821B0B3345B71D3CB32822A0779D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243707, "uuid": "11b6e794-02f8-4bdb-be4f-d5b911ff71b4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243707, "uuid": "11ab7a64-28be-41c3-ac3d-e5afcea6c171", "value": "6144:B5lz/1R2mcE9J92bjFRxhjkTZzX5aOVi/NTZ/bHZarwhHvvIt0PzDJUvc/:bfr9JiFRnkTZzXrVgNTZ/bHwrqYt036+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243707, "uuid": "6f79dec5-1d31-41ae-98a2-6d2cfecefd15", "value": 479992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243707, "uuid": "8073157e-3700-49be-8289-d72e316f0ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243707, "uuid": "bff3d4be-85c6-4aa9-a579-7d366bb4fa93", "value": "2423254abd06c4a88efb4d169dec1cbd7f4590eb29078a9a99457e1cfb3bd2ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b22c28d-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244033, "uuid": "da021380-0ceb-4a76-8c26-56c199903de1", "comment": "Malware payload (a310Logger)", "value": "80dfc8e83ebe6964599704a42e2d7652", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244033, "uuid": "9bcc68da-0e0b-41f2-b0f3-7f95ec60b5dc", "comment": "Malware payload (a310Logger)", "value": "243213f6165e7759b1814eca1052e900763f7ce7864888fb4f30e0f4859680fd", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244033, "uuid": "68830253-55bb-4dc1-b497-6da6bb479149", "comment": "Malware payload (a310Logger)", "value": "5f295a6bc734a4abd8bab059cc4dbec49cc5ab6c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244033, "uuid": "57150498-0d09-438f-ad05-f0836a265f19", "comment": "Malware payload (a310Logger)", "value": "1ce7077a01685276f6765a347e8567e92326f003fb0f814b299d7e925b925598a99008549efd73807e806f2455e94abf", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244033, "uuid": "2a0748aa-4b61-48eb-bbf9-657d1401bf30", "value": "T1C74512257BADC802DCEA03384EA5E3B513746DDDE812C326AEEDEEFB7425A457D04142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244033, "uuid": "3e3cbb5e-c515-49ec-8166-4dce8907684d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244033, "uuid": "69aa2b3b-9860-4f9a-9bdc-862eb3734fd8", "value": "24576:EYYDaU8+v9QbOUQ5FU5Ag/+qNI/vCc7dVPlmFvyAr2jj9ycf:EYYDXvKOUQ+AHHdZll6Hr2jj9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244033, "uuid": "0b914c77-66b8-453e-b479-7bc1018eb0c6", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244033, "uuid": "62eb4f6b-6ff8-4e34-8845-8c68aa587cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244033, "uuid": "17af8a2f-6e75-4a43-983b-7bc58c840230", "value": "243213f6165e7759b1814eca1052e900763f7ce7864888fb4f30e0f4859680fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407f0cad-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236795, "uuid": "65a8591f-ff82-42ba-b1b0-b58ba1c69be1", "comment": "Malware payload", "value": "64bc29705fa0b0c0f2e6cb9295c6f623", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236795, "uuid": "6b5ed042-b151-4792-b547-e878c40642b4", "comment": "Malware payload", "value": "250d41a4f0654fb73935b6aff3ea975ec8cbdeb9c1bc127858ec3ec5f6390290", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236795, "uuid": "ff4195bd-238f-4251-96b2-59422cdbb0c9", "comment": "Malware payload", "value": "e7db2117f21116fb3c7526739e5bfd26623c6542", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236795, "uuid": "47425468-fd42-4b07-9da7-565faaf7290c", "comment": "Malware payload", "value": "694c26268a59ec4d3a66a2d843def4993677c4186b8fab7a30a93506025fa31c6f4eaa747526885097b066c4e27cb76e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236795, "uuid": "43523014-7f68-4f11-a109-c7ac9750861f", "value": "T1D1726A8121E80308F2B6FF399A7BAB41093BF990ED71CB6C8E508C5D2954942ED75F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236795, "uuid": "3a5faeaa-ecdf-4638-bdd9-5e92b21f063c", "value": "24:8d/Cf3DwdfCXGiXnSpVT6XtBxb1En96pMERrBCU:8lCPkdfYXnSpEtb1U6p9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236795, "uuid": "4b383686-2708-4666-b928-4e545f004a82", "value": 16568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236795, "uuid": "a4278a25-b433-4d41-bc9b-480446fe38e4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236795, "uuid": "d6e46840-61ac-4012-b0c1-44c97ec3c668", "value": "Scan_003.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209625f9-4ac4-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778234164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234164, "uuid": "56792b0a-b015-430b-97f2-64e1134f6711", "comment": "Malware payload (RemcosRAT)", "value": "cc726118cbd826b716eeb32820cefcb6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234164, "uuid": "580a5b25-30c7-4595-8e08-0364a000b551", "comment": "Malware payload (RemcosRAT)", "value": "25c3bd326e331a73559179092b5d981361dbc693dea7ee098dd4e279f56e084e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234164, "uuid": "48bb4ea1-3ef2-495f-b78b-0c4fe9454007", "comment": "Malware payload (RemcosRAT)", "value": "a71a7fe89268e685c66ee9ad2f4b98e8488b9548", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234164, "uuid": "117a321c-1055-42d0-99f5-e28912eb6277", "comment": "Malware payload (RemcosRAT)", "value": "70ee74ccc2753f5f231161b20d90f5de5d7caeb3ae8a2a7fa5f36bc6bea4b9053bdda3c6eb368627c3f77316ec4bf5fa", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234164, "uuid": "9e337ab9-8156-4ac8-a8d2-d80a49675d52", "value": "T16A54CF27A55AC903EF7643744FA74959071DBE287BC1124B382E3F2A63B1E69CD8F049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234164, "uuid": "922880d2-19a8-4928-8708-e7a99858624a", "value": "6144:5NBkSlS8E6akBw9OVbWnKNdpkfomLnW1rm/wLHNQKzRxBfu6qdsxx:58SlLXzSnKTpMtMq/QnzQ6/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234164, "uuid": "900b7f48-35f4-4feb-9a90-5a581333ec71", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234164, "uuid": "9182db62-86c5-4649-b26f-0ba17ea0a203", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234164, "uuid": "75594686-8bd9-4578-95c3-ff9bfa0d297e", "value": "DHL Shipment Details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d08e9b0-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243204, "uuid": "9b0c91a3-82c1-426a-9db4-a7534028e1c2", "comment": "Malware payload", "value": "5e00e4ec0959027cf8980b5e32659fad", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243204, "uuid": "4c52e0d2-aca8-457c-94ad-fe7bbfe8f412", "comment": "Malware payload", "value": "25fbe263cb05ee2990b5cc9b984643b6bf3f50d0165fde95f9d1ee1c8a324611", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243204, "uuid": "77214a71-c307-4376-97b6-f3e59cc26c9f", "comment": "Malware payload", "value": "297178f7a81fd242dc9e9e9a2bc08a30abe19795", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243204, "uuid": "e51c7655-48a6-4608-835c-b6a6ddd7bee0", "comment": "Malware payload", "value": "7d855e042b1d4f688394a2dec1b58a7bb98b09173e316ad032e8d40f3f6cfec627714538cc82035bb9395181c71e9208", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243204, "uuid": "6d3b8aa7-b16c-4420-819d-1711ccf84811", "value": "T1C405AD1798488B57D62982B57E070D981F4A9F0CA9C135AF302F7E9B7BB4B364C9E01D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243204, "uuid": "88efff65-1d14-4853-bb26-7478d6b44620", "value": "12288:w7gX3umqfXLksVyImj3hvAZwakbPDfhPuDKnMD6WTANADTZcLq/Z:w4+mq4sVLKAjKP1PucwoADTSLUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243204, "uuid": "aba90c68-b1d0-44c7-bcca-50780bf5526c", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243204, "uuid": "d7ef8729-eff9-418e-b4ca-458ff2b23cb7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243204, "uuid": "c34c09d4-45e0-4346-be19-59a08033a0c8", "value": "SecuriteInfo.com.X97M.DownLoader.2343.13671.9317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99035b68-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778236514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236514, "uuid": "be9eb5fc-26a0-4124-ab5e-b32f6a922797", "comment": "Malware payload (AgentTesla)", "value": "854875b7cea51e0e98ddce20bb1f7cb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236514, "uuid": "aed1cc03-6908-4629-a527-9881c12f251f", "comment": "Malware payload (AgentTesla)", "value": "2706716e9372377ea0dfcf8acd74acff9b5097fa60215a4694afa016994058a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236514, "uuid": "f323a615-7199-4860-b8be-98a599a9a23e", "comment": "Malware payload (AgentTesla)", "value": "ece1c6458ab791a7ac865c97de770cef3427b65f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236514, "uuid": "98247ccf-c03a-4590-9c81-2da11cc397e5", "comment": "Malware payload (AgentTesla)", "value": "b9a3bec51d948e57522627a78e2c44b0e6ef4d5537e0dbaa9c0492f75e354d867701ed8ddec7a98291ec726a61cd9606", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236514, "uuid": "f9e2b4fd-70de-4499-a3d4-143bb4a87775", "value": "T17982F7278A05AFF4025E72926E5F2C172E0107229A713C0EF9AFD45E3BBD710DF91998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236514, "uuid": "96d92542-09de-49eb-a8f9-ed618a06df3d", "value": "384:KE+mpwfpRuUtmaIT9pDP0e9whJhTq1ARnlXlpsDNumsR7g4:KElwrfe6hbMNumsm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236514, "uuid": "ebbba767-022c-41dc-94a5-fb1861fb07eb", "value": 17695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236514, "uuid": "820e7dbb-bcbc-4b53-a7c1-caab16eb069b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236514, "uuid": "491c7ec3-ec6b-4d7d-aa10-b8f23b5cb330", "value": "MPM DETAILS 02.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e19f602-4aac-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778223906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223906, "uuid": "ed56d60e-9c9e-4a4a-8c99-51740634b42a", "comment": "Malware payload (NanoCore)", "value": "e49f44de597fb593d010bcf6dea5a4ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223906, "uuid": "7cffdb2d-c5e4-454b-9e14-94c152f53c90", "comment": "Malware payload (NanoCore)", "value": "278f6c04ddc26482fd33ee1035bbd970e6f517b554b22af03216b7d88cbf4335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223906, "uuid": "b027fbe8-c836-40bf-95a1-857228deb55b", "comment": "Malware payload (NanoCore)", "value": "7cf2969109c2207b10559f9f4abbcbfd3a63a780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223906, "uuid": "388d4f14-f368-4922-ae5d-db64a74cd132", "comment": "Malware payload (NanoCore)", "value": "c3996cf3d0cec8154b5797e6a33f7bf5452faad261f3f9817e4c1bf216e2c8044f42eb9adb161c4084c8bc3b8e0491f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223906, "uuid": "eb3fc188-0bac-4e1f-84ad-6520f670fe83", "value": "T1F314CF252BB88A3FE2DE85B9612251139379C2E399C3F3DE28D454B74F267E10A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223906, "uuid": "ee2a1a3f-6b8e-4aa9-b46c-a30f059825d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223906, "uuid": "84d6238a-6541-419e-af75-f2ee66a35eb6", "value": "6144:MLV6Bta6dtJmakIM5zd4SJm9dsJz1ORHP:MLV6BtpmkydvzORHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223906, "uuid": "f0b6a9d9-a220-43db-81c6-9be8086c0c18", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223906, "uuid": "b0820b9d-a7ff-499b-82ea-df25c3713ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223906, "uuid": "7bb08ca7-d1f8-4792-83a8-822c36411768", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a93c8f-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244182, "uuid": "7eb7be95-74fe-49e2-b9d3-47ad789f8fe4", "comment": "Malware payload (Formbook)", "value": "64698dea36e3e5110db6f0626d0b8941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244182, "uuid": "a32462bf-1ebc-46b8-a8d4-21f6ca357893", "comment": "Malware payload (Formbook)", "value": "27b74b1992bc452227f6aaba0f9f58dbe8d4dd4d8a1973aa869d26f59b6e4bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244182, "uuid": "0d9c27b1-6dfb-4adc-bf43-23fa62f7221c", "comment": "Malware payload (Formbook)", "value": "1edb271d33e9d60d5f538325e11ca5e2357f6aca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244182, "uuid": "30b43902-253b-4897-9e08-1efc9e6b243b", "comment": "Malware payload (Formbook)", "value": "27153281d575cf8b096b570073b6250d6fa310dc714dec4c7503c71245bddf3d1b992ee62f537395b962b1f14d1b63d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244182, "uuid": "94f6167e-a2ba-4532-ba51-1bd5e637c667", "value": "T1D5251251AB49D803DCDA13390970E37517759EECD811C31AAEFCFEEB786AA563908243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244182, "uuid": "8136a82f-f0b1-4f3d-a49e-75aa6575b177", "value": "24576:LYYDmV8+v9z/5wp3sieSIe2qxXDUCBaXLpCDZBjukx2eO:LYYDKvzw8KIjYXDpBaXLsDPj5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244182, "uuid": "0e8e653d-d90d-4b47-9512-bebc70712d1f", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244182, "uuid": "c5d2ce2f-7f09-4f6c-9c76-f6aed5c3f78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244182, "uuid": "5b63b2b3-a982-4560-b341-5f212c773955", "value": "27b74b1992bc452227f6aaba0f9f58dbe8d4dd4d8a1973aa869d26f59b6e4bad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bf1034-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1778243538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243538, "uuid": "05dccf46-0eb2-44ab-bf84-428b1c371dff", "comment": "Malware payload (SVCStealer)", "value": "408baa94cd3e766fc9d2326311c91e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243538, "uuid": "39b4ccce-2248-4926-8fc8-dab714fd2bec", "comment": "Malware payload (SVCStealer)", "value": "282eaff6ff1f1f1677ab4d9c1c140bc0f437f09f75a729bdf3b45dcdef441e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243538, "uuid": "2450dd1a-b384-451f-8786-513529076fa7", "comment": "Malware payload (SVCStealer)", "value": "01d7f7580ab948b383dfc13bbc0f2702b4fcdc9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243538, "uuid": "e963c104-793e-4041-9652-517b2a2af81c", "comment": "Malware payload (SVCStealer)", "value": "ecdd6db0136c50804e99fc6e1157a8eefbbbd412bc0d8789620d759b0b167c0b99b9d16049bbdc071709d89a64a86edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243538, "uuid": "0396dca5-72cb-4cbe-a4e9-31e3a05c806b", "value": "T11296338542E105E3F8A7E13D5AA65195C2B3B4101B22C9DF1BA483AE3F5B3F24D36F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243538, "uuid": "057d5469-1558-4ccc-8bdd-1e4ebe35e991", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243538, "uuid": "58aa3258-cff6-433d-a6fe-6d12f7aab23f", "value": "196608:QrlbatbW897G+x7eovq5XMP6PzFcx97WZHsoqEbRjMFb:Wba1Fdq1B7wgZHsoqEbpib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243538, "uuid": "ddf38d0d-0776-4be6-8cff-d898b2265816", "value": 9386333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243538, "uuid": "167a6789-6255-4ef8-a8a9-f65322f67756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243538, "uuid": "48b1dc1a-1ca4-44dc-8d37-211a0a7f1518", "value": "282eaff6ff1f1f1677ab4d9c1c140bc0f437f09f75a729bdf3b45dcdef441e1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81dc421-4ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778247786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247786, "uuid": "88b9e012-2f2d-4398-bc53-49a17896b413", "comment": "Malware payload", "value": "714966f6c9d03681477de142fd25338d", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247786, "uuid": "ed015eaa-96e8-4ff7-af2f-74ee0577ca40", "comment": "Malware payload", "value": "2872ea2e8dcde72e2d906895d62d646961111519ffacd5832dcd2234f7f087d1", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247786, "uuid": "20282a83-da33-4691-8ba6-cbaba5b09fac", "comment": "Malware payload", "value": "241052a10503f31150f96ca11ab1e7bee858e620", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247786, "uuid": "8dee9b54-c307-4ad7-b80f-3004572ebec2", "comment": "Malware payload", "value": "a7ec2090944527e45341a5c9a3b0badb9f1d10a96897cbc8046ac0c01c9a8502a6248d4109688068e1a585cf512635d8", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247786, "uuid": "03cd72b3-27b9-4092-a979-0854823c9da0", "value": "T111966C0718970CE4D1E6D235906362A5BB617C488B3437EBAED098A22F3A7D46F7C771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247786, "uuid": "1c33f153-d177-4e0b-8f4e-430f4bac390a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247786, "uuid": "acfb6d10-c5e9-48c4-b236-5eba01c2f89e", "value": "49152:NLS/GHMWKkLt2WUpeDFTScfQ0eP1ogUFt1UOFwFs409bMrbOcS:NG35kLnS11oHt1Uy4m4uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778247786, "uuid": "fc64fea7-2cb4-4811-a02c-062234067c11", "value": 9209992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778247786, "uuid": "9960ece0-917e-4e2e-8e12-73d246cf63c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247786, "uuid": "457d53de-7550-4cde-b55e-897f1a9d2655", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ca2123-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778242942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242942, "uuid": "49072169-72b0-417c-87cd-ea4648eb0e6c", "comment": "Malware payload (SnakeKeylogger)", "value": "29f1ad94239ac55946825efecc9588ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242942, "uuid": "f28dfea6-1822-47af-a090-e867b8ea9237", "comment": "Malware payload (SnakeKeylogger)", "value": "28e6160a0c931d0731823e752dc32659a51dc2b9abd3d75b9000366d3e2070a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242942, "uuid": "83a0b4f5-fa05-4bf0-995c-97d2f23c2e88", "comment": "Malware payload (SnakeKeylogger)", "value": "479cc249ead47c31761ef80b49af4b2addef5b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242942, "uuid": "31c86b5d-be0a-423c-b38e-a663819e4219", "comment": "Malware payload (SnakeKeylogger)", "value": "870c118abc21409f4e3491200e0d9420a22ef4096887390b2f7d407cd277f4963fe4a45c463128811daa45b1e6b935b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242942, "uuid": "f2cb0ed2-ad5e-4615-bd4d-5e033e6d0f2b", "value": "T197458D0E3381B023FE56BD324A56E3114678692601E3AD1F1A782B7DB9713F31E3E656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242942, "uuid": "25478da5-4b6b-4791-858a-1c23cfcdbb52", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242942, "uuid": "a4763340-8516-4f5f-82b4-648490fc049f", "value": "24576:/5EmXFtKaL4/oFe5T9yyXYfP1ijXda9rq3pmlT2puqY1kHs:/PVt/LZeJbInQRaNsTuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242942, "uuid": "ade3448a-33d9-474b-bdfa-7cf6e88c783a", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242942, "uuid": "98964615-593f-4d61-96ce-1b34f3f2949b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242942, "uuid": "4811237d-6547-4840-8a6d-16638ec19a8f", "value": "28e6160a0c931d0731823e752dc32659a51dc2b9abd3d75b9000366d3e2070a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81627482-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245923, "uuid": "19c9c8ce-096b-4169-ae98-b90e70f671e1", "comment": "Malware payload (Formbook)", "value": "c4081eaaa61acea0446a41b1fdbcb48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245923, "uuid": "a478cd9c-631c-435e-8a0d-02bff2805856", "comment": "Malware payload (Formbook)", "value": "29343979342fcf3f93bd27e25d05c4278d10c9ba479f8e04db3dc1ff06032f3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245923, "uuid": "85fc7d12-3448-4efd-871f-677ef5e1cba6", "comment": "Malware payload (Formbook)", "value": "6160bc923aca95d7a5264d9ab135f24fe367660f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245923, "uuid": "47ccafff-0145-4a7a-acb3-8f2d2e0388d2", "comment": "Malware payload (Formbook)", "value": "608afa58b89fcfe6d19fe9be775c443847173c554358e16e38bc2bf4131b4da941e8ad017148f30a624900f151060ca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245923, "uuid": "4c752776-a421-473f-b0fb-a5ad21b77dda", "value": "T1E5351254262EC846C8535BB448A6E47117B0AE9CE532C68B9FDA3FEFB13F7914895303", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245923, "uuid": "5337cd17-b525-4710-8b03-3d7d14ec7812", "value": "24576:iXI5ClpWU9lfP0ICnHow9NJQoy2f+s5N:iYERP0hn9NJQef+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245923, "uuid": "4cec28db-51af-4903-84f4-01366f7bd90b", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245923, "uuid": "378cf31c-d6f7-4321-82ef-0ae92be17983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245923, "uuid": "f244ce77-d839-4b35-a76d-955c483a19d8", "value": "29343979342fcf3f93bd27e25d05c4278d10c9ba479f8e04db3dc1ff06032f3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61964a8-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778246495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246495, "uuid": "6460fc4f-363c-4c26-90b8-dac32a9a2ab8", "comment": "Malware payload (a310Logger)", "value": "9cba03692581832f08d117af26192670", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246495, "uuid": "4e16b7c2-ad31-4125-a495-4e96837888e3", "comment": "Malware payload (a310Logger)", "value": "29a91390bd464a0f8553da6e98df79c8460c622974bf64d784bde5339b15e921", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246495, "uuid": "e664bb25-9df9-4b7e-b154-8043eed5118d", "comment": "Malware payload (a310Logger)", "value": "01fdb0c54a2a88efe3b0ba51268aeac9aa5b0ec5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246495, "uuid": "1b28d9e9-b4e8-40ba-acae-87811b47be8b", "comment": "Malware payload (a310Logger)", "value": "eff41d175fd78472148ccf749a30fc1caded76f113b251f31d5dd5a01bbf0336e1f74d7236b5d7b2cd412f5552538d85", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246495, "uuid": "fe9a3374-9e31-4afa-bd5c-356872fba3e9", "value": "T10B845A23EB50A12EF1A3C9F1B9A5A25728263D3A5688EC57B3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246495, "uuid": "54894077-84e1-4967-bb6e-93c446fef5ac", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246495, "uuid": "7f20445e-78ac-48ed-a947-6219d04d1c73", "value": "6144:yC8d1/w5KA81IJ8GpF6nuTmOOUWTjNnjiEhUbvlEsPypnmiyB2whedk8:yxjYKkJj6GmZUWHdEv0AiyB24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246495, "uuid": "1659fe44-a968-429c-895e-1c88ecd02d26", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246495, "uuid": "bf113191-571d-41db-8c61-6bbf93d6973f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246495, "uuid": "d6352d39-fae4-45d5-8375-aacbb21b9cfb", "value": "29a91390bd464a0f8553da6e98df79c8460c622974bf64d784bde5339b15e921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b66d00-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281020, "uuid": "6eef6f60-4dfd-43af-aff4-9696c2468a1b", "comment": "Malware payload (Mirai)", "value": "958503f6eb72a16c85a24d954f860e77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281020, "uuid": "8f2e4ccd-6b36-4007-946d-7604805b8a29", "comment": "Malware payload (Mirai)", "value": "2a0f04ea4cae167e20e75165299173fb705e319c07ca6ffedc7383fcd2f6e0a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281020, "uuid": "8aa6463f-f4f7-4495-b801-bd4b96f71b78", "comment": "Malware payload (Mirai)", "value": "03f751d9bba7222d116cf43909d7e0b5ba47f929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281020, "uuid": "ef914e64-24ed-4111-b989-ef3d007fbd75", "comment": "Malware payload (Mirai)", "value": "8b9330d73d29dd799295df0ee2caa0adea3339d7552e1d2ec55dfad6f6845141e2cd2216ea43d55f332e96650967cce8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281020, "uuid": "f5fcf1f3-7447-4104-9986-0f0c3e7940af", "value": "T117A33903B4C088FDC18AC17817AF763AD972F56E0139F1FB2BD0EA166D4DE215A1EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281020, "uuid": "5f76924d-a5cc-467c-8097-e87ed0293375", "value": "3072:EpSf3dIub3tZGahSksTYjSOoYQ2V1E1oRi6LbDMfs0MW/Uu:MSmub3tZrhSYjSOyiax6HDwMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281020, "uuid": "a679e593-68c7-4b3d-a01d-150bf2dd7571", "value": 101232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281020, "uuid": "1164d159-b2ec-4905-a6d9-fd1378da20ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281020, "uuid": "fa68f2e8-d23a-46af-8657-9f5b8c362d69", "value": "nerv.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678c8aaa-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778229988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229988, "uuid": "4bb2840b-68ea-4348-88a4-d9004bc17a67", "comment": "Malware payload", "value": "2baa599512241cc055cacc1647046e86", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229988, "uuid": "5aef02fa-ce43-4c89-a9f9-475989a79382", "comment": "Malware payload", "value": "2a62c5a7eaf2ba4a52a49998771e1a62073f299d4dab5fff23a6e121d2641079", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229988, "uuid": "23004ccc-3c4e-45a0-bbb7-320a09a9f890", "comment": "Malware payload", "value": "fb59829aa63acbd47122e5baca2ee29057838b42", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229988, "uuid": "bc380e39-37db-4671-8965-b0ce28c0e5e5", "comment": "Malware payload", "value": "8abad6518eafd6578ec814607297de924e5e99f233c99243978661c03fdffe3b06f704d47cbe18bce6839b67bfdb31d3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229988, "uuid": "526b2f12-88f2-4db1-95ac-f02d82af555a", "value": "T146E6224AF304982AE4F7523739B6436651131C268B43C6CB7960F23C6EBB6E54F1EB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229988, "uuid": "3dd24b7a-02ff-48c1-ac58-608cfcaeb898", "value": "196608:uiEODRZEtx8ZbP+m0/ccm/q7ilalOmCgJnic+6bntDfaL6Tq7DJ7lNMm8UmiKVz:ucEotwm6qaMhT6bntDfa5/Jx2fiKVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778229988, "uuid": "85d39910-6eb2-4b82-876c-fef81bc19a3d", "value": 14880706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778229988, "uuid": "8e9085ef-aeb8-45f3-8d24-0d5c7af5a955", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229988, "uuid": "c335c2e7-1419-4612-8d56-8ae5923c9256", "value": "iMobile Lite(4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96869cf1-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246817, "uuid": "97f05d60-e71b-4c54-8848-1df9e444fdb9", "comment": "Malware payload (Formbook)", "value": "c03da6fa644e0192de7ad4344891a82d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246817, "uuid": "79b0145d-da7e-4b59-acd3-63c91a265fbe", "comment": "Malware payload (Formbook)", "value": "2af9816b540cfa33d8d62d8d84d1881d3d3c4f250d92c9d046df3469458f56a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246817, "uuid": "22e2514b-4605-4820-b293-e8e2c043ea22", "comment": "Malware payload (Formbook)", "value": "35d8d7a3330af31fbc84690ea4daf916d6930f3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246817, "uuid": "9c463b69-4b5a-49af-b7c0-e0c089e11337", "comment": "Malware payload (Formbook)", "value": "cea0a2aa1206fad13aaef2fde8099204fa810c251e19165584045ef2c8283d4c71a3417b84056df36d58653f831cdbec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246817, "uuid": "b20cf0a2-9c76-49ac-b919-c49d24e04262", "value": "T10E35124822689B02D9516BFC4A76F27513B91EDE6412D30A8FD9BDEF79B6B018C18343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246817, "uuid": "1861d1d7-c1a6-4eb0-844f-5780706065ab", "value": "24576:DJvTm5+qLhEQ6wntEbJs/ta4N31Z/Ym5O3T5GooRqctMGuEj9hci:ZTm5+qLe4KbJs/taqlZ/YmLooEctMGVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246817, "uuid": "8882cfc6-4168-4fcb-88c6-d1f1c7b658af", "value": 1116672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246817, "uuid": "e0af3ed1-a802-4f9e-a29c-aeae45088573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246817, "uuid": "b886601a-0a78-4a8c-bd0e-628abdd0b308", "value": "2af9816b540cfa33d8d62d8d84d1881d3d3c4f250d92c9d046df3469458f56a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84944e9-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload (MaksRAT)", "timestamp": 1778231520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231520, "uuid": "96f638bd-ef9f-4e3e-927a-0adc4072c34b", "comment": "Malware payload (MaksRAT)", "value": "fa1930e13e74572411ae29693110a799", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231520, "uuid": "634285b8-ce51-465d-a352-57bbdb7f910a", "comment": "Malware payload (MaksRAT)", "value": "2b127d3989e38dac7f220e082813b65bc355c1cb819ffaddd6b4e6aa2b101dfd", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231520, "uuid": "4030b809-47c0-45f4-968e-00a0b54e8ab5", "comment": "Malware payload (MaksRAT)", "value": "6685cae8f85b22bbaca855ef7dd914d5e2470085", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231520, "uuid": "e51c4071-d9db-448f-9ded-3977650cac7d", "comment": "Malware payload (MaksRAT)", "value": "68eb1938de09f5da01500182ec409a6957cc9fc25c0b672446b83f8c0cc93898dcfb8a3150988ef9630bbba928f6c11d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "maksrat", "colour": "#20BF9C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231520, "uuid": "0454eaa4-9576-41c2-b4b7-175b27047d93", "value": "T1D16423EBA460F9F5F4365A7A69FB8C91312D71C047938111A1747DE0ABB4E8FC0079AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231520, "uuid": "4a1a38fc-8cad-489c-9451-2731891d4d14", "value": "6144:Je1KftIDje1D1zoMMWI1QuiPMqrZB4+Wc1+JaaBB:w+yCh1+WIqJ74+H07B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231520, "uuid": "b939e7ea-99fe-42b8-ad08-5b82ececd38a", "value": 323180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231520, "uuid": "8a4ebad4-0f8e-4e94-97c2-006f506cc88e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231520, "uuid": "b192ffbd-f2eb-48c3-a487-d08373a6bde0", "value": "Pussy_builderr.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b4d8f8-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778246246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246246, "uuid": "81bb4f60-1387-4e39-9515-2c404f4146a8", "comment": "Malware payload (GuLoader)", "value": "9494a2871a5782e1c3044e2dc8784282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246246, "uuid": "ddbb24ba-20ec-4dc7-8455-0d008f881144", "comment": "Malware payload (GuLoader)", "value": "2b1d5fea7898a417de16b96beaeea9bed041c62a72a23aa59e911f27f68600de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246246, "uuid": "d2dba0c1-ed3c-4c25-9171-73041e8a8d9f", "comment": "Malware payload (GuLoader)", "value": "daa5bcb603981597c9e7cb17455b0a3dd69615b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246246, "uuid": "11dfd1db-4a02-49d8-920a-9502550d6d54", "comment": "Malware payload (GuLoader)", "value": "c213997fbf83bdafa59b9b17cf5aa26124b3e2551f9c74bfd21968b7bf2ef088f5d1806b071faa8e1e6ee37c6df457eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246246, "uuid": "505270f2-8042-440f-a50e-6e4455d232fa", "value": "T175056C517670E7AEE6761639B4CAC26D65547C30AD06038FF1B07FA807B2EAC4F82791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246246, "uuid": "021d33de-7ea2-46a6-9cb5-b86476260dfe", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246246, "uuid": "f71a90ab-241e-42b0-b8d9-d3490c422788", "value": "12288:FSW9MrpT34uxqhxw3LUOCxiO4VYdTxC7dZcU6siAaPmpmM:FSW9MrpT3kbw3LUOHtYC7dZcPs+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246246, "uuid": "9f29f29b-f671-440f-8feb-12f4dbc720e4", "value": 808936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246246, "uuid": "63411078-30cb-444d-a506-0468fd21d5fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246246, "uuid": "fe0f928f-f910-4fe3-9a9a-c64d10054ff7", "value": "2b1d5fea7898a417de16b96beaeea9bed041c62a72a23aa59e911f27f68600de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b1650c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244163, "uuid": "bfa6489e-7b14-478a-96b7-51ec1404398b", "comment": "Malware payload (AsyncRAT)", "value": "5b5b7b71cbe55e95c0fcb875d636f2cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244163, "uuid": "c362adc4-8bfe-41d8-8216-eb764e35a5c1", "comment": "Malware payload (AsyncRAT)", "value": "2b4d160dc8b2bc16e003e0f837a7ed56c7139b8a51bbeab72efad0fc7f26ac58", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244163, "uuid": "19413302-e5a0-40f4-b19b-1ac41524b3a4", "comment": "Malware payload (AsyncRAT)", "value": "fea3ae5afa74871701f85ece7906bf038108b751", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244163, "uuid": "cc18ed27-262a-4dbf-9da2-ea8e783510e1", "comment": "Malware payload (AsyncRAT)", "value": "268e8f449f0ec510949c5ec9dd8ecbb44162f57406df2741225889416e12f8bbe0203d4e52fc030299cc8757874c5a07", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244163, "uuid": "6f2e6f88-f5de-4223-9418-fcd6ee09c150", "value": "T170050165AB88CD42D89613740AB6E73017B6AD9EE821C30B5EFDFDE77835B41342850B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244163, "uuid": "789cdfc6-4ed6-4b08-a572-c655978e33d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244163, "uuid": "d6fa9f85-c784-4b7d-b543-558dea448511", "value": "24576:bYYD9f8+v9SZK3vRzQv5SgP3QH0H15aC4oTJMM7Nee:bYYDbvgZCzvZ0H15fNZ7Nee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244163, "uuid": "2ea3b563-3b34-4f54-bea9-22d2e9e7739a", "value": 796168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244163, "uuid": "30fd5387-4830-4f49-8405-5fee93a4a83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244163, "uuid": "197f7b25-43b1-4c44-b73d-286db30d3f0f", "value": "2b4d160dc8b2bc16e003e0f837a7ed56c7139b8a51bbeab72efad0fc7f26ac58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692b08df-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246741, "uuid": "e0c33640-c9c5-4c29-92eb-e30427b1428b", "comment": "Malware payload (PhantomStealer)", "value": "9c3aa9851b750fb96d207fed55b17cf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246741, "uuid": "d7579447-7c59-4e20-b6bd-ac02829b0561", "comment": "Malware payload (PhantomStealer)", "value": "2bc8ac0bc033b568ed2c8fcc3630cfc2c94ce2493f28aa07ed12bd625a7d3219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246741, "uuid": "0dac4d3e-9198-4af7-acbe-ac2c33f7bf73", "comment": "Malware payload (PhantomStealer)", "value": "d4dc3be1c7511de228d4ba5ce2f98be50a4f2438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246741, "uuid": "b487fdd5-14a0-4002-b755-478066000d38", "comment": "Malware payload (PhantomStealer)", "value": "89fff0c1d653e7f13e9c95b3cf7122402c5ac63ac82832abc3a41b2ab9ced1d7a8be435c397b00de8bcc8607f32820d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246741, "uuid": "499b0a42-cf56-4680-bf33-3694c35408d0", "value": "T1D395F1053249CF12C52F47B5C9A2E1F827BB6E48ED00D3C7AAC5BEEB78B27955950183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246741, "uuid": "55bc9977-27b3-43a3-8920-2b36df0e4152", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246741, "uuid": "ad5fb77b-efad-448c-a1c6-536259a11dc7", "value": "24576:50xClc6oPQ2FuAr/zDUYUA4mdTKkr8t7NLY6NaPNc2DctreibFEP7:KxCaZPQFAbzDUJoekr8t7NL58cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246741, "uuid": "5f967408-73c8-4f8e-9e2d-755cbd9950f6", "value": 2026496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246741, "uuid": "cdb7e077-9130-4eda-9392-92c35deade6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246741, "uuid": "079fa43b-f29f-4eb7-a007-028e83d75b13", "value": "2bc8ac0bc033b568ed2c8fcc3630cfc2c94ce2493f28aa07ed12bd625a7d3219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb25959-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Expiro)", "timestamp": 1778243531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243531, "uuid": "78c64f67-22cd-4547-9f0a-47491ae726db", "comment": "Malware payload (Expiro)", "value": "9aa82530ee9e33521138b5025f23d07d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243531, "uuid": "e2ee9306-bc77-4bef-a70c-cae9732fd177", "comment": "Malware payload (Expiro)", "value": "2be59c2b83f8ec8502987ee271146930658252f99cd0711fba2ac4ab1375806c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243531, "uuid": "eaadd8fb-450e-4601-ac51-bc8e6dcfe025", "comment": "Malware payload (Expiro)", "value": "488d2ab56c63010981f13176ef80b4f7a805870b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243531, "uuid": "6ef2a563-14cf-4b7a-baf1-f47d7011157d", "comment": "Malware payload (Expiro)", "value": "e3498869bcb545c43d7e5f4630634e3c6a7986bfb6bb146d699ca631bfde4a048e080ff6366b412cbe02d3bacf1d701a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243531, "uuid": "4f8ae2de-aefb-483a-8114-9691c5a9a686", "value": "T15875E00273C1C062FFAB95734B56F6115ABD79260123A62F13981DBAFE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243531, "uuid": "e3ea8068-b0d0-4282-b509-68a62345bc50", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243531, "uuid": "0ec5cb52-f0f5-4bdf-aded-4894f30e1d32", "value": "24576:b5EmXFtSaL4/oFe5T9yyXYfP1ijXdaucQ7/FtugpgSsqjnhMgeiCl7G0nehbGZpv:bPVtXLZeJbInQRauj/zDmg27RnWGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243531, "uuid": "b06fa64b-7371-46fd-918c-07cee47038a7", "value": 1679872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243531, "uuid": "765aa32c-8bff-49d5-aaac-5e1ebfbf9992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243531, "uuid": "277fb847-aa35-4c13-a7b8-2bf82c69a04d", "value": "2be59c2b83f8ec8502987ee271146930658252f99cd0711fba2ac4ab1375806c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5496cf70-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232963, "uuid": "e6e74c78-9e4d-41f2-b6e7-00034caf0ff7", "comment": "Malware payload", "value": "fc1d2b1f3b01513b98e8476bef20b304", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232963, "uuid": "129a43d7-b5c2-46f5-86ad-70eb98b5b0a5", "comment": "Malware payload", "value": "2c33a9805daeab5d18b819bd1d45bdcafd91d1e6a292e1281c351e712922dc0d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232963, "uuid": "bc14be6a-e224-4301-b749-c864a21536ea", "comment": "Malware payload", "value": "3e4b251c83aadda81ca681e28251aef173dd0ba6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232963, "uuid": "ef124a71-75cb-4a6e-ab42-ddc092b50a9d", "comment": "Malware payload", "value": "1a9c8879baeca9acae39b55e380b2a193864a592113e57b569562d578fae484c031464f48625d8db1aea15420afc58c8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232963, "uuid": "ede6bc27-529e-4e97-a214-3c76259f6cac", "value": "T17707CE23F50969A6CEC6A135F5E3479136350D480793A229271FF026FDF25CECA67AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232963, "uuid": "96dcf43f-95f6-4d10-af40-d7c0a86ed13b", "value": "393216:diP4+hiitQ64xe5ZKIBgFCBrAEkmI8Hhj:f+Bu64sVCFerAEFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232963, "uuid": "f118a344-3d51-4192-a031-6774865374f3", "value": 17839703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232963, "uuid": "42500bef-c11a-4d37-b104-232b82808ba6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232963, "uuid": "bc3eef39-a5e4-4f06-9857-c3186a2ee744", "value": "IDFC Mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5ce181-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230025, "uuid": "c311d3c4-9f5f-4153-81ea-70d855a47239", "comment": "Malware payload", "value": "ed25d49dac03f793e837c5f38a36e9f4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230025, "uuid": "6e2eba68-7b5c-4a82-803d-419c928207b5", "comment": "Malware payload", "value": "2c61b874f3aadf71653c698babf2c36c9ef165e4e8dd506183feaee1a20ea462", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230025, "uuid": "b294c7a8-52e9-463d-a8af-36cb39b293b2", "comment": "Malware payload", "value": "271dc5eee4552cd10b9e0c642dc632e1c72c1a14", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230025, "uuid": "2dd15d63-5aa2-48dd-a2d4-587a1621565d", "comment": "Malware payload", "value": "769a9de6ace32a0f4569df93e066c894eb9fc101a819c1f7f3ce1159f97b225b5feafb28a519f4a1a62328c0f3bbb6d9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230025, "uuid": "95714ce9-bfa1-41b5-aa7f-a01e16ba2448", "value": "T1F6E62249F309982AE4F7523739B2436264131C668F43C687B821F23C6EB76E55F1EB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230025, "uuid": "098b4ec5-80f6-4fd2-b13a-4be695bc2fe9", "value": "196608:w2BQFeeuhZStcZe3UUk4cydpK2XsXhX/VhsElqq29NfFM3fanDhdpSTWAZhh2:w/8ZBZqRkydM2X4dINfFYSnDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230025, "uuid": "c5e3dd69-d3d0-4775-8ded-e86608ffb26d", "value": 14880696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230025, "uuid": "8f02646d-d100-448e-b5b7-65d66d2b7594", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230025, "uuid": "7355e0d2-1f2c-4cfa-912d-af6afada27ea", "value": "iMobile Lite (21).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2bd15b-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281029, "uuid": "e9bb88dc-f4a0-4ddf-90df-0da9f91589e6", "comment": "Malware payload (Mirai)", "value": "195a3bddf70a62d4433283b4f11b9ee0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281029, "uuid": "f00c393f-3204-4d24-84ab-248d2b59491a", "comment": "Malware payload (Mirai)", "value": "2cac889fe9d2acda6ae6ef8c2fc89ecd2b52ba5ea9baa59fd2fecbfd16884607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281029, "uuid": "0152046b-29f9-4339-a47f-28845c178679", "comment": "Malware payload (Mirai)", "value": "9be0f8ff05e6af1bb761c8cc52363525924bbd23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281029, "uuid": "b053836e-aed7-404c-bb89-02fe8873fe88", "comment": "Malware payload (Mirai)", "value": "a601ebbc44ad134b75d937eeffc19723b3ee2fb4b05fdd0122722de74e8d71a22794a5add10d2c2ea99113ec1c943692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281029, "uuid": "e97920ac-bb05-415c-ab3c-df101cbeb6ef", "value": "T14CB34D02731C0F47C5A75AB02E3F57E1A3FF999021F4BA89251E9B5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281029, "uuid": "36304bf4-d131-4d3a-b123-ffdc4e9b902c", "value": "1536:bL8aGHx7rZazxJWsvNW/GHogtC4srA3+LzK9HqfYLObJqe4KwgmkyRwPIeL5:bKKNvjoUsDCOb9djN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281029, "uuid": "a4266c93-fe30-4b17-86f4-d0a92da2f1ee", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281029, "uuid": "d330ae69-2efa-49bc-84e6-1f52eb3b6990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281029, "uuid": "13f7affb-d030-472e-981b-c59bed8e3b23", "value": "nerv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd124077-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238722, "uuid": "6e7c8c6e-5920-4441-b953-9b71b156173a", "comment": "Malware payload (Mirai)", "value": "5502527a899b1da8ceb60b7aa719c420", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238722, "uuid": "2c0804f4-1e82-4c73-8956-4a95ae12f195", "comment": "Malware payload (Mirai)", "value": "2cae167abfd3b65acee1a0a82fed25236ea8fb844c4d01fce1d7d07302f01eb5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238722, "uuid": "4714b357-2f3a-430c-b32d-62e6add8fb90", "comment": "Malware payload (Mirai)", "value": "f0221b997ea25d3b2a4b870cc6fe2c88889c47de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238722, "uuid": "76be3948-a7a9-473e-821e-13f9c0c9b0e6", "comment": "Malware payload (Mirai)", "value": "9509c9c06d367dd4a52725416b0c2ced021f3ee78be56453a42e27792c70ec3630ce7bbd55f5614dc10700c0743a1315", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238722, "uuid": "6f7f62e0-5b5e-4d1a-9dd7-3e7b8eb537e1", "value": "T156433A86BD819A13C5D0227BFB5E028D372713E8D2EA3307DD266F21378A95B0E7B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238722, "uuid": "cc30c904-da6f-4fd0-bacf-c826c3082e5d", "value": "768:OmKvrCbJxkw68NlWYVaNPkkehciA4DM5VeOHifB+ul7V6rcv1IV:xKv+bz1WYVPkYE5oO8+uZocv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238722, "uuid": "e9018aaf-0144-4397-ac5b-664107e2e062", "value": 56040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238722, "uuid": "0a78b16c-fb32-4491-98a0-5596525492ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238722, "uuid": "4d806bd0-cf4a-4aa8-832a-e2d579b332c8", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678a6120-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244591, "uuid": "ef387d90-c6be-439c-9189-3c7dae25d725", "comment": "Malware payload", "value": "25066a813d59ec01ad148904e1d44657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244591, "uuid": "ce26de4c-0c29-44eb-a4a5-c2d8b55511ac", "comment": "Malware payload", "value": "2d1e0bddbddfbe9b41252fac454665f288b54dcb51b34da61c55d62fc158e495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244591, "uuid": "48c4c1ad-dedc-4b02-a4e3-729bbc9a561d", "comment": "Malware payload", "value": "4ff69a14d76c8f2638e1b8ad6c8b5f7a9191c0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244591, "uuid": "012c4aad-1b69-49df-9896-3815841583d2", "comment": "Malware payload", "value": "cad1d10b20599b534f38eef98b37f0d5063a1d1e182f675072431f9ad68f606c2136b63ca1c419ab6361c42e2c7f14a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244591, "uuid": "fa70cc14-f629-4d50-8346-b9212775294b", "value": "T112C44116EA21A02FE45389B0797996867C292E321790EC57F7801F997074ABBF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244591, "uuid": "a2f48a95-29b8-4ce0-af6c-bb305d67f711", "value": "ac4c70fc01d47aeae65c3a8d62f1866e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244591, "uuid": "276b15af-38e1-4ae8-93fd-26df0bf4eeae", "value": "12288:caDRy0C8LqrNkVvY8x1J4XdYbCxNziU062i8+qBLoRIsE3VCtCX0w9jD:FDRyDyzFJ4XdYiNz/jihsXLw9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244591, "uuid": "37a136f3-94bf-40e9-84f4-70d5b5875e77", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244591, "uuid": "dc75d802-3eb9-4c8b-ae70-efd18670b601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244591, "uuid": "4563ab66-dfe6-46db-b7fb-edd61a2991e4", "value": "2d1e0bddbddfbe9b41252fac454665f288b54dcb51b34da61c55d62fc158e495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aeac61c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778244194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244194, "uuid": "610c0434-4e95-495d-a9b1-e38ffef14291", "comment": "Malware payload (GuLoader)", "value": "55f762797c8dd7296c3eff76fd5c4ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244194, "uuid": "8ae1ad59-a14d-421c-beb2-9be94603dbcb", "comment": "Malware payload (GuLoader)", "value": "2d4821a97fccb90138a732b9ef6ad9f5c7880cb583b44807860ce1184afb7e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244194, "uuid": "4a16468f-7a1b-47a1-b2a4-006097150bb2", "comment": "Malware payload (GuLoader)", "value": "92a8ff79b56ccae49c2cd18a3180a761e0d51fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244194, "uuid": "a16b005a-2360-4bbe-8d4f-271bc8d9cc6e", "comment": "Malware payload (GuLoader)", "value": "04dd81487433202d3db4a3bd31868d1930640096f02e3bade602cb719ff96f57c2946ef8d8e4d39049d29da20569ef2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244194, "uuid": "5ab27975-4ead-4a45-8a23-4f071ee29f64", "value": "T106550190F0A581CAEEBA0B729D3BDD3421E1BEFC94F5911E51DE7A3A36D3351110E60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244194, "uuid": "92c33b83-9922-4a3d-bf6f-be66ddccded1", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244194, "uuid": "07de1c69-652f-4815-84c8-3cb9611b1e8c", "value": "24576:ETAopOx3mYKNROjwSxjpWTB/OujvuzmyxAgh8uI464mp728FjeIM:yMWYSRGwPFTeMgh8uI4Mpi8FjeIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244194, "uuid": "aea86325-0286-4e8b-a9f9-7643b5154819", "value": 1308771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244194, "uuid": "2125ef62-260b-4f28-a0db-4c2709cbeccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244194, "uuid": "91fa9323-8151-4015-8c73-7a0c82d5d7cf", "value": "2d4821a97fccb90138a732b9ef6ad9f5c7880cb583b44807860ce1184afb7e7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40367b2c-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281032, "uuid": "5d060599-f1c9-424a-8e88-f5244e7b3528", "comment": "Malware payload (Mirai)", "value": "10a5b79d92d3ffa26a75e328eb011bce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281032, "uuid": "fc939bbd-5fe4-4f16-8549-8786eeecf047", "comment": "Malware payload (Mirai)", "value": "2de44ba31cb7107ac7ca78e056c2c3517f294215582e02febbc0c423831bf2f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281032, "uuid": "a78cd5d9-3992-4fff-9eff-6e49c1af408c", "comment": "Malware payload (Mirai)", "value": "a50b9aaf114d46873b9319f7b3d851c51dfd0e00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281032, "uuid": "bf1bda00-29e5-4a81-959c-5d2a295b9938", "comment": "Malware payload (Mirai)", "value": "50e169ca20ac9ed842e95d882493689cec1cc8206677108ca93e6447f64b6f8a247d32de36977f12ee35a403d77ef368", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281032, "uuid": "1c1ab5cc-7279-4977-95c9-0b507c0b6e4c", "value": "T1E3936BC1E253E8F5ED1705751137E33B4B37F139102DDA97DBA8AA32BCA2600D5262AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281032, "uuid": "3b4890cb-cb99-4134-b1d0-68787588cd80", "value": "1536:Lh+jn2+ifI/EIzRBIepUGzX+VCW+XpElUx02V7VKTiI3nPKxCdg71G+dkChCs:9+jn2tA/EIzPIepUG6VCPulo7VAiI3PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281032, "uuid": "02600dd9-99c4-4e85-a45a-bdac1bf51e87", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281032, "uuid": "85386fd3-666f-4bff-9fd7-a1461ab1772e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281032, "uuid": "8d2d81e0-4d78-47e5-9904-12bd769c01e2", "value": "nerv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e4d835-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232723, "uuid": "a2a5f21c-ce08-416c-a062-35c0d3ba82a6", "comment": "Malware payload", "value": "328cc22e3ee331ed873d70bdfd8ffd89", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232723, "uuid": "cfb88426-ffcc-4190-8b99-666efa064ae9", "comment": "Malware payload", "value": "2e11badbd558a37c88ee22a7315c8220b90213fb712ea1ec1f39b14e3ae8475c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232723, "uuid": "3e976527-2241-41be-9a28-82776f194c41", "comment": "Malware payload", "value": "c43efafa69c43be60145e81527cecc12702342c3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232723, "uuid": "5b57d043-efca-4bd8-bbec-712c381f901c", "comment": "Malware payload", "value": "8a31684f770ce65533a105c8e69bb13b71d3fedc7ea634d1837a3630f133f3c42a199a4e8b3e7e4f016d22e6759af66f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232723, "uuid": "c62a6db5-65de-45ed-859d-bdbdbc946adb", "value": "T1B766D041E7878596C8BEC17AC579833B1BB71E12C79383936419F214CD7A3F72D8AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232723, "uuid": "7298e6e2-dbef-44ed-a31b-d0bcfe6709f8", "value": "98304:oWtM5WQRLQSvlxJrsf/3qjklUng3vGsqM88aF8oAaphSOT0nAE1zHNUKc39dH:oWtDQnlxhdklUoODR9bTQAWCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232723, "uuid": "0933eda4-3b2f-4398-923a-fb8d9b4ea6f9", "value": 6628636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232723, "uuid": "078f7f99-fdf2-43b8-839d-6e5978eb8745", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232723, "uuid": "7a2b51fd-e864-427c-8c46-1ea80d99f9a8", "value": "file_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14ffe13-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230085, "uuid": "79b35d47-3db1-4a66-b13a-aa376d123039", "comment": "Malware payload", "value": "1fc7c800eab4f46c0491da338cb658ee", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230085, "uuid": "ae3b1c9e-f5be-4763-a099-6f754ed8d0f0", "comment": "Malware payload", "value": "2e68a33c37c5ce8d0c1ccfe44868c2cd0931ccc41d3bc01784f2f02e7e5820c1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230085, "uuid": "8e13f750-a527-4faf-923c-2467e75ff505", "comment": "Malware payload", "value": "569b59a95263c6da67d95129b7bad49f1756963d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230085, "uuid": "857be5b1-7c36-40b4-92a9-9a191f2b58f9", "comment": "Malware payload", "value": "a9d0883237712894f0a4c3befefc743b3ae1053f0c64e68341a5ca533b1929df0343a10e821e9046fe86283c198796f4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230085, "uuid": "00a518ba-24ea-46df-958c-f2b6c3304888", "value": "T185E62227F74979AFD8FBE331887A56A540199D26CF47A1C76928733C14B38C59B8B2C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230085, "uuid": "cf6f2783-6210-46b5-95ee-42a6f0103a52", "value": "393216:IlHj3p85aBQ0rRo9JdRMyUi9+xqZX5jq/CGLcKIk8:o36krYMO6qZpjmCGPF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230085, "uuid": "a8225046-5ec4-4181-b0d8-64a46a886009", "value": 15066736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230085, "uuid": "763d9208-e22d-4c52-b28c-2e5e11daa4f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230085, "uuid": "f5bd706b-5ed9-43ca-a73c-a3dd782ded6a", "value": "iMobile Lite (23).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78df847-4ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778241343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241343, "uuid": "8e2e5137-d155-47ef-8b40-c51dc2595ca6", "comment": "Malware payload (Mirai)", "value": "26a58a2fa61c253321f10c786a48e959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241343, "uuid": "e8df9d1d-0ce8-4502-8993-1961d922d5bd", "comment": "Malware payload (Mirai)", "value": "2ef71ffa6b038ba342552a0b21e741b6894a29f1205542cfaa384e4efcdd1ec6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241343, "uuid": "2c2d7547-a157-4c65-8662-9173a33cebad", "comment": "Malware payload (Mirai)", "value": "e6048a1daae617a71bd98ac3feb4c5218c3519af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241343, "uuid": "4862d5a2-37d6-4eff-b6d1-a156b723e767", "comment": "Malware payload (Mirai)", "value": "54d739e9dc1a5953b1f72bad591803c62f62b3ec06b1f3fd177082e5edf5b7b130a4cc26153bd9fc8cad10b45e9a5bd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241343, "uuid": "60b5419c-aa0a-48e5-9cfd-e36d8b719db1", "value": "T1F2D3F945F8509F27CAC255BBFB4E438D7B2A176CE2EE720399255F30378B9560E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241343, "uuid": "4c587a3b-875c-4612-b9bc-a4bd6beb93de", "value": "1536:NJoY1lFVW6XOZgnVxUzF3I5+wfDxTYZThZ/xvOkBTHzAEtBxOlLnwywInOdubP3g:NJVl26XOZgzUxIwwVEZ7/nDzdvwUnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778241343, "uuid": "422233c9-43e5-489c-8d64-fd48aa942d5e", "value": 133688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778241343, "uuid": "9b562b5f-38bf-4768-9fef-c8199ce38a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241343, "uuid": "7c2a4705-1b76-433c-9d39-6f7391d84c13", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7661c0a7-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778242898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242898, "uuid": "d896db04-a994-47df-a123-13801b955a7e", "comment": "Malware payload (AgentTesla)", "value": "1dce82ba1f2cc6e7927bd5d373529b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242898, "uuid": "cc526889-4c8a-4d36-ae81-fdb8bd8a206a", "comment": "Malware payload (AgentTesla)", "value": "2f295e50760e14d62c5789c91bb916c82c7c29874adcc184f2184ae6d0b601d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242898, "uuid": "a0cd0b36-db1f-4501-a611-0bd18c708553", "comment": "Malware payload (AgentTesla)", "value": "dca34765244b52d181653ca984537e881737e91e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242898, "uuid": "38bdb2c2-7357-4106-a886-f9d531ed8f69", "comment": "Malware payload (AgentTesla)", "value": "8d0b4f6e9134aa79d547c7eebd8bc39d0aef15d3be1a048ad6178aa8aa4dd25a928ea4d1bde3d10c874dbfe2548f54be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242898, "uuid": "61e5e285-97c1-482a-a776-f69e02904a38", "value": "T12A340F037E48EB15E1A87E3782EF2D2413B2B0C71733D60B6F49AAA518517825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242898, "uuid": "b4ca37a1-086b-426b-9da3-025599c38d7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242898, "uuid": "f2b900f1-2f0b-41f3-93ca-1ab694c7929f", "value": "3072:r3ul7h+CuSWCWz/vgn2EITYU5+QqXc3xgPPfCU57lUqIvoH1d:bul7UCuSWCY/vgn2EITYU5U5PaKUqAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242898, "uuid": "2b5bcf26-fdcf-460a-9196-1d6920c02670", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242898, "uuid": "29fb2bb2-5ee7-4d4c-917d-f21c9e0e0def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242898, "uuid": "ce526714-66b8-4017-a9bd-c02d216da5ac", "value": "2f295e50760e14d62c5789c91bb916c82c7c29874adcc184f2184ae6d0b601d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919faf69-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778243803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243803, "uuid": "302eb6dc-b565-4ae2-8eef-c53391ed78fd", "comment": "Malware payload (RemcosRAT)", "value": "9b39de37abf009cc187f077e6f7c9f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243803, "uuid": "4371f0ba-50ec-4ce0-9589-a52f1456e8a1", "comment": "Malware payload (RemcosRAT)", "value": "2f436331d1dadb54d020d10fa1b38fd0469e9c408469a75960be7120ed1a440f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243803, "uuid": "4582d6f9-e953-4246-9836-e2d0d4078933", "comment": "Malware payload (RemcosRAT)", "value": "bd25aafc56f009571c86712d6e471a7ee25a2eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243803, "uuid": "6a510fa4-c3af-4616-8179-967fe1cc6cff", "comment": "Malware payload (RemcosRAT)", "value": "5846e7beb22b4ab1b325e17253a924ecd34e8ca716a5ecfd703396ebaf0b294b1c126abeaef7218557bf2be6c66e385a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243803, "uuid": "228251dd-c00a-4b78-814e-7e16d779c157", "value": "T19894F1437781C6E7C83486329D9F83956B71ED555B821B0B7388B71C3DB32921A0BB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243803, "uuid": "624bdbc6-1b42-4960-be92-ab83906148c7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243803, "uuid": "48144346-a175-4057-833d-7edbffd437ba", "value": "6144:V5lz/1R2mcE9JeCxp3h9iUFsqBM2uhoIL6BWG4uVD0TC6l:nfr9JeSJh3sqryEPuC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243803, "uuid": "a8cad2fd-371d-4867-846b-ceb9f9fe09fc", "value": 448736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243803, "uuid": "556b39ce-4d17-48ef-b144-2f67650ff65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243803, "uuid": "bee739dc-a8c5-4ac2-b6e9-942c680a042d", "value": "2f436331d1dadb54d020d10fa1b38fd0469e9c408469a75960be7120ed1a440f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555429d4-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246708, "uuid": "e4a94894-22c5-47ef-b865-acc4f9cdff5d", "comment": "Malware payload", "value": "1f6eaab6d1482869c86bb485f66ae9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246708, "uuid": "7730cc08-9302-407b-9e3d-73f90a6c9796", "comment": "Malware payload", "value": "2f4dca84f27e36c74fe7044f53808419793c7f151fa0edb17a17daae8ca21d13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246708, "uuid": "13b84ea8-51b8-41bb-8685-7f99562404a3", "comment": "Malware payload", "value": "83f6a63c3c960696f06ab74480eb9cc063214630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246708, "uuid": "31722750-5972-4d40-a9da-dbd1c4e15ae7", "comment": "Malware payload", "value": "13f5ef7eabf2c2b75b7221a0970870b4de306c57c2133e39ffe871f8de1c74b5c24f198e7b4761a711a27d81dcc2d107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246708, "uuid": "4fbe27de-68b3-4ed3-b2b5-b20bc1db4e31", "value": "T10A55C015B68380F3D651353014AB673AEA35AA469F26CFD39368EE3C6C33181DE3715A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246708, "uuid": "0c1edcd9-0d92-47e8-bf69-c91e43a26c39", "value": "4fc158e650a5d42016e827e6d3e2fe41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246708, "uuid": "4db4351f-b22e-431e-838f-a05867484b45", "value": "24576:3N7EwhhXNUdHJj/codlG4A0/4uAGkQwFn3nWBWic9uR0D1r:3NRt4JjjlG4x/4ufmtic9r1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246708, "uuid": "65476e29-02b5-4812-b3d0-5e14ef95af9c", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246708, "uuid": "850a073a-f94c-4a8e-9d2c-d9ab601dea53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246708, "uuid": "fab2edb0-4a20-4a67-80e8-21a609ad7c8b", "value": "2f4dca84f27e36c74fe7044f53808419793c7f151fa0edb17a17daae8ca21d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80aaae41-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233037, "uuid": "544231e4-fabd-4e2e-b428-1c8b9bf3f851", "comment": "Malware payload", "value": "6100ae647fd62ee5939b73c11d80c5d2", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233037, "uuid": "8a7a7df9-854d-41d2-9701-8e0eec526337", "comment": "Malware payload", "value": "2fbde057c22b6cb517116d6c797c3474de2f4d3bda09037a9f043a6ad843982f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233037, "uuid": "49cdcd22-6647-40c5-ba6b-cf4ef4c94f65", "comment": "Malware payload", "value": "37ce07c843bd041cbae8b1dd87c47c725b36cfbe", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233037, "uuid": "f2090d07-95d5-405f-b110-37755dbf0464", "comment": "Malware payload", "value": "a954fd0b8994e371668609f8664f32a7046596d67080e6a36cd61be0de6037ee60f8b1a097025eabdefda97aec3ace06", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233037, "uuid": "c89329fe-c27b-4d34-b81d-7a12b55fa88a", "value": "T19E17DF63F244299ACDE6A231F4E313D132361D514783A76A171FF136BDB31DD8A26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233037, "uuid": "c819eb3c-851f-4897-868e-24f76f682e14", "value": "393216:31zPg+nyK4hA+XgkIBlTIeodNT0mdZOVLe:LnyK4hA+XMlT7odpbLwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233037, "uuid": "276887b8-3e1d-42c4-aa70-8f43772e5def", "value": 20148621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233037, "uuid": "76f2e253-6ff1-4a43-a65c-c4444640b017", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233037, "uuid": "3c8cb15b-99f7-4030-8f01-eccb909944ba", "value": "PNB Credit Card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1e9a3b-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244496, "uuid": "8e5a7862-4c00-4117-8e99-bb5270ca78cc", "comment": "Malware payload", "value": "368c17701c362a93bb34e7794184a7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244496, "uuid": "e91f7ffb-163d-45d6-8b97-c89cfc68d1e2", "comment": "Malware payload", "value": "2fc6304942abfb77fa22b7cabc813f1eea23a1bc52d71adeb6ffbc35a693fa07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244496, "uuid": "2ba446c0-56b0-4794-abb8-638999f3b6ee", "comment": "Malware payload", "value": "a30e8e5ec3efcb5a6ce1f59c0a87ca625b04c13e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244496, "uuid": "ef655c63-d534-4ec5-afa2-2b836ef80f3e", "comment": "Malware payload", "value": "2a70881389449cd7993b67b0790e5493e2e698b57c985535fae20a0d90f3d586359ab70bf0c63291925e15cee01998da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244496, "uuid": "47076395-c37b-418e-9dcc-98586f075e1f", "value": "T15AC45116EA20A02FF453C9B069799646BC292E351790EC5BF7805F993070AABF1F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244496, "uuid": "7202eb73-c5b9-42a4-82a3-7742d906d9bb", "value": "a9cc5bb9cf6b4d35d74e629d66003ea5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244496, "uuid": "00615a09-28cd-421a-9749-49e1a43adbcb", "value": "12288:b3ouBkpH2P3UGlCNH3sgHfuwtLVE+Oun6kPyz3lBvY5BheE:Uvp+6XsOtLTVPUvao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244496, "uuid": "77ced363-cf9c-4962-8bd9-aa94e707d489", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244496, "uuid": "098dcb21-8652-4bf8-bd0f-0853ed106785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244496, "uuid": "53facf1d-e3d3-4260-b0a2-ab1435b6bcff", "value": "2fc6304942abfb77fa22b7cabc813f1eea23a1bc52d71adeb6ffbc35a693fa07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3deaef68-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246239, "uuid": "8de94c17-ebd4-4846-8b48-be14a81a78ed", "comment": "Malware payload", "value": "7de070d7aa4fccb2ed290c5312519f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246239, "uuid": "730e2875-0800-454e-b909-fd7cac89e092", "comment": "Malware payload", "value": "2ff62ba4cdc7e59e65013712b7bed3798a3a3362820c872efef4818a22a6777f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246239, "uuid": "b88838e7-61d5-4b42-aba9-6f84aa285a25", "comment": "Malware payload", "value": "8be67766a2cc6be19d43308484da7a254d7da816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246239, "uuid": "312c0b45-ee82-4cd0-aadf-dfea306cc4f4", "comment": "Malware payload", "value": "311932d329700f83abd45691f13998c0c706bd332cac77e6956a35565aa5df83d13dba6b971520505eee5b73b186d703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246239, "uuid": "c1595c11-ff3b-434c-8e08-66c85fe8861c", "value": "T116B2B67DD5E4ADC0CB6B22F069ABF7C502AAA717BD2A0B1CF4CC10561E60354E7B8259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246239, "uuid": "0d121ee3-2edf-4c12-be01-d03af7a3c671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246239, "uuid": "e2591349-b03b-4706-85b7-138123861cbb", "value": "768:Xz57Ngy0RRHbFMWco/dTmu8tr8h1j8dc9O05qJZpO4:+HbGWco/hmu8tovj8dc9O05qJZY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246239, "uuid": "5f8ab641-d24d-4d15-8f90-bf46d203101e", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246239, "uuid": "bd21d58e-9b5c-43ce-92b2-05ffd7b3325d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246239, "uuid": "97519fd2-0896-4be1-954b-a24765a3f596", "value": "2ff62ba4cdc7e59e65013712b7bed3798a3a3362820c872efef4818a22a6777f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdf7dbd-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1778265082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265082, "uuid": "f1416531-cb05-4111-a778-a8ae68ca25f2", "comment": "Malware payload (SalatStealer)", "value": "975d7b50caf2ba5f0adb7376ffc6712b", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265082, "uuid": "9146dc19-ecfb-4d55-a7e3-50a7f458ecf4", "comment": "Malware payload (SalatStealer)", "value": "300466d2b1311e767edc13ee6ffed1e50023d0319efde61bb5b7da2cd70f1c48", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265082, "uuid": "192f1fae-34f7-4084-becc-84df523b469f", "comment": "Malware payload (SalatStealer)", "value": "8406fd4e6605f94c4a68c209fd86b027bb23b4d1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265082, "uuid": "361b6eb6-9eff-4f84-b7c9-cfd277e101b3", "comment": "Malware payload (SalatStealer)", "value": "8940fa0293a87a8a6c8b3f0b353fd0ce65e6ae2cb4f96660ce7d69e548af43e7b0e6c75e0d6d1d3e4f2c048f839898d8", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265082, "uuid": "4d07610d-74d9-487c-9564-b3130c0b24dc", "value": "T1B6469E037BFEB05EEAAB97B4957962418625FC374C91804971CD548B0F9B9007EBC3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265082, "uuid": "f934c838-1d7b-4727-b61a-b74bf0f291ce", "value": "ae7a42e29350aed7f649339ae59dd83d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265082, "uuid": "c8dcd47c-573e-4884-8ab9-f931e5691b57", "value": "98304:epO0MKVMbKIX7WHNsxOmIZXmrZ+iGRM7k/YOz:H9GMrWHNqhIZXkZ+Qgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265082, "uuid": "bcdec96d-0c2b-446c-be3d-f5d6f2594466", "value": 5708288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265082, "uuid": "9615c487-3105-4363-834e-a80c7f33591c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265082, "uuid": "f00d9506-ca64-40e8-906d-081eb23c98e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fbcd7a-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246520, "uuid": "4b5a0284-98f6-4a9d-ae5f-deabf9fb1788", "comment": "Malware payload (XWorm)", "value": "8398f17f594a4053f973df693092f88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246520, "uuid": "52f27ab0-7a07-471c-9e54-8a3dc953a594", "comment": "Malware payload (XWorm)", "value": "301aacc4bac5acd89177dfa0ed6fbafc8460f58a7e9a1b546187372ca6883e2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246520, "uuid": "d222b045-be6c-4470-8964-b10511b088d5", "comment": "Malware payload (XWorm)", "value": "6dfcc74b3720ec4db1ca38ea3ed6ee3e145db00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246520, "uuid": "10090192-4d1e-4e83-b685-377ae37b500f", "comment": "Malware payload (XWorm)", "value": "8d83d2e00d59e3dee1d29211292c3e73eccd3d5f266b7d6cb68aad27b8946c34156e0765713c638d10b1d04a8ca85954", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246520, "uuid": "1be59581-6cae-4bae-ab5b-e066f2b4ecde", "value": "T1AA15121532A8CF03E8BBABF84461E07017B12D6DA521E21B5FD1BEEB3436B608349747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246520, "uuid": "51ecd662-3195-44e1-b1f5-fbae43515cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246520, "uuid": "23cfd9f6-570f-4844-b048-272e6b5b2f2e", "value": "12288:sHeB9BulzoMm44F5aZoTuN+uxpESKVhF5XidYkc0PjjBtJNXmN/iOydqqwhbg:7E0fEVN+uxpESK2TP3BtJlmNKVkX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246520, "uuid": "05860500-9254-4cd8-8f05-c64d8514b531", "value": 958464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246520, "uuid": "72497391-8ea6-42d6-a037-c3b85d548044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246520, "uuid": "82c10be3-cac8-4f49-b9e0-36bc16b22f8d", "value": "301aacc4bac5acd89177dfa0ed6fbafc8460f58a7e9a1b546187372ca6883e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0eb7714-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243399, "uuid": "8f55f65f-8992-4ad4-85fe-cc7c1e4c0ab8", "comment": "Malware payload", "value": "3e98ed4ac6d0db8385c09612dbfe58cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243399, "uuid": "1e4ed667-90f0-4040-b990-f78b1f1b8bf7", "comment": "Malware payload", "value": "304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243399, "uuid": "756638c1-94fc-4ea5-aade-ff21a9412bfd", "comment": "Malware payload", "value": "ae3d12491e91d0dbdf524e16eee197d720d65bf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243399, "uuid": "b78df954-c04c-4d73-9098-81c52aa823d8", "comment": "Malware payload", "value": "1fefc594d6933ef1dc268b6f4b3e4cef0a477068aafd49492bed52033b72812b7b3527000504c27781aff2c8e0b65023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243399, "uuid": "b314ec94-38bc-4624-b1fb-e83a0b6da374", "value": "T1D845F11473AADC02D4AA5BB08DF1D37407B4BD95E422D2479FE63EDBBA367811948383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243399, "uuid": "507be019-8281-45a7-8454-a907a18267b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243399, "uuid": "cca2ce54-88ed-44d2-90ef-bf256c40ef7b", "value": "24576:EPBSJJSHwF4JI+8cwgOGWNSxIqjXvj1+1aYn0BTl:4qUwFWFJwtToygDTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243399, "uuid": "b3219270-6e93-439d-8f3e-d0d4afd01219", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243399, "uuid": "3bd0fe57-c27c-44ac-b144-88779f4ad02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243399, "uuid": "0f2b5c7f-6169-46ec-8236-14684986b1be", "value": "304e74bb2868005bff8d72845057fa033413d4472e8cc5cd60893bc51bc69fba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca39a02-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778245942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245942, "uuid": "44060dc0-84bd-4197-87c0-b6c5138c0eb3", "comment": "Malware payload (a310Logger)", "value": "f57db39323e7952a45bd298821287dbf", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245942, "uuid": "ffeb1cc1-7030-43b9-915e-44a107bbb70b", "comment": "Malware payload (a310Logger)", "value": "306ce6f1bdfe0797633ec88d90ad8ef2fead4c1cddddbb17d6aff4d1384925b4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245942, "uuid": "75765e48-ade0-477a-a429-924633bb1e89", "comment": "Malware payload (a310Logger)", "value": "4bbceb16e598da12a33f49be1af5a24132e385e7", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245942, "uuid": "e3b7aa23-efab-4646-a236-a175b0f278ce", "comment": "Malware payload (a310Logger)", "value": "e01e2fd9fdb1301dcfbc4680fff870fdbc29f4bc5d669a1da801a9c5649feaccff4e2a4b8596640a15c1b6723a1d72e5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245942, "uuid": "127d24be-a68f-4887-a5a6-52d9648a04ac", "value": "T126944A13EB60611EF1A389B0B9B5925A68267D351B98EC4BF3409F1A35725D3ACF031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245942, "uuid": "5460c87f-443c-4f34-9a3e-f1cb4a330dfd", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245942, "uuid": "8cbc3f78-3a97-47bb-8ef0-5a0bcdc82884", "value": "6144:Zsm68d1/w5KA81IJ8GpF6nuTmOOUiBUrj0xTg2uPxmWFb4aI3/yU8qmLO:ZHjYKkJj6GmZUiqrIsxAB/yU8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245942, "uuid": "06543787-efd1-4243-b625-fce694eb6b39", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245942, "uuid": "5553f685-9fc1-4613-9aea-8032068e5864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245942, "uuid": "b9b62c37-beb5-44f0-b4d0-294c61e27d13", "value": "306ce6f1bdfe0797633ec88d90ad8ef2fead4c1cddddbb17d6aff4d1384925b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158ca0f0-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233287, "uuid": "ed4b307f-c44b-49aa-837b-6397661d74d8", "comment": "Malware payload", "value": "41c9b9ee2795d6261d32b408ed66c5e8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233287, "uuid": "e1ab75f6-4c4c-4015-8797-e038f8b7cb05", "comment": "Malware payload", "value": "306fda439baacbad62df66c6f52c431ea2292eff002220c11be43ed5c0b961f4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233287, "uuid": "72925181-a871-4075-959c-18bf3f096c44", "comment": "Malware payload", "value": "008b0f3e471d8762151652a327e37c0caafc613f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233287, "uuid": "979f82cb-7ca2-4b20-b95e-df73282fe45f", "comment": "Malware payload", "value": "eb7cf87065c7ed198afce09d93e276bbab29f747f1d23fa96a718ccad9e71bd97f10a0ead954d8925d7884440e396898", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233287, "uuid": "f374a607-d57b-42ff-802e-68403abd7ae0", "value": "T1CC07CE23F50969A6CED6A035F5E7079532341D480793A229271FF026FDF25CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233287, "uuid": "0bf6c028-4e12-40f1-8a50-ba18958a1406", "value": "393216:h8rdjD+m0KtpRPAI2unIwGYwv6764m9L+Fd10wquT1W:gV0KtTF2Swv8m9aFbFFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233287, "uuid": "cbcb5d0d-4dff-4430-bf41-9213e12eccb1", "value": 17888831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233287, "uuid": "f8a88825-eb8f-4310-8eb0-e4b26c047561", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233287, "uuid": "e1c5c96a-b664-47c4-9940-63d4fbefa07a", "value": "iMobile Lite (48).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "438db62f-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244101, "uuid": "c4dfae1f-f78a-4ee1-90ae-c6dc3340885d", "comment": "Malware payload", "value": "838ae48fb57ac075a6d12ef58fe73f08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244101, "uuid": "dbb07603-f32f-4073-92ee-50eb3f019fc2", "comment": "Malware payload", "value": "310df2ea557e408a07c5cf43ae11d001df02f969fcbe8206c38edf9958caeea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244101, "uuid": "49e04d4a-542c-4761-9244-04e27c92e032", "comment": "Malware payload", "value": "111064023987d552ca125892553b3409457c28ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244101, "uuid": "59690a6b-1d6e-40b6-862a-989a9b27f354", "comment": "Malware payload", "value": "2fae5f78eccb55ffa07546d0378126fa6b3f1dacca81561dddcc376a025d434f4383993999139ef84bb766a37b77dfa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244101, "uuid": "60208a43-e8a1-48f6-a339-3cf51fc3f9a0", "value": "T1A245F0123A1FEA81F8991F301966FA3857263ED9B400D2869EC4BEE77BF17527412713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244101, "uuid": "d2d8c6e2-3170-4e6b-9e99-6dcef406f417", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244101, "uuid": "a9ad4655-2782-4fcc-8380-8d0ee4fc9875", "value": "24576:sY+8+v9tfcCL3OACKYGU26qEo46x0cQWetsKGs:dsvbHCDGvQmKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244101, "uuid": "b1044a73-d0a8-4bb6-b11d-99eed6b90e72", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244101, "uuid": "5fea9bad-6900-434a-a464-8b94d74fcf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244101, "uuid": "1a1945f4-d5d4-463c-8ea7-e1f456ac55c8", "value": "310df2ea557e408a07c5cf43ae11d001df02f969fcbe8206c38edf9958caeea8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a574eaba-4add-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245124, "uuid": "e502dee2-66f6-4787-8a15-a50cbc4d3d30", "comment": "Malware payload", "value": "3b78f54942637bc99453db31c527ef36", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245124, "uuid": "864e0185-d614-41ae-960d-74daa926ff35", "comment": "Malware payload", "value": "3135f445ab5b45fb2803968098956af928b3f4053755de3e39311bece5a93efd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245124, "uuid": "4bdcd759-8c3a-4831-978a-0b83595a2987", "comment": "Malware payload", "value": "0a3bbd27a04fb55e9f74125f54b8dc54091ce05c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245124, "uuid": "7a0e5540-978e-4ad3-9d16-ba550a06978a", "comment": "Malware payload", "value": "516f039cb7e032cc2673e8d344d47a1c20cf855829600c069dbec3d57736a9fb92bc7611077dfcfe426e47513e2cd6aa", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245124, "uuid": "efbed72b-1d5e-4fb9-9780-c8e74ffb1521", "value": "T109137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245124, "uuid": "cf4fe60b-2d4b-44bc-9fba-30a045620380", "value": "768:b5+79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:b5+Mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245124, "uuid": "e0a66762-4703-4b9d-9fcc-0898ca82dd6a", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245124, "uuid": "2bc062df-1055-4b1f-9cb8-d56d3f6e5ca1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245124, "uuid": "81ed9c69-5efa-4b63-95d3-b68018d90f79", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa5b45c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244363, "uuid": "ce92f1b8-8cad-48e2-b1d2-2a0650fa6235", "comment": "Malware payload", "value": "e842f327ac205fbab1a67d1c160d2c02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244363, "uuid": "fb4f0d37-a6d7-4d18-9285-03afd17e8232", "comment": "Malware payload", "value": "317dbdb7797a504f9a15ef0207871ed8910d4a89c63874c16759800512e3def0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244363, "uuid": "16e5aae6-962e-46f4-bdfe-199e12e45bac", "comment": "Malware payload", "value": "f38d45698b693f571567295b0e84a0806f95c783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244363, "uuid": "548c801e-f4dd-474b-a667-b7e4f99512e0", "comment": "Malware payload", "value": "085b968403146a352c550c1c16860eb9a37b7dacc74f25b3da6136b1bd71c1bba2ff916224ea48eafe6368618a22ec74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244363, "uuid": "332d8717-d9a5-4a29-9d54-68fb60dd18d7", "value": "T1FD5523117181C5B6D4BA027499F2DE356978343297BA41D3B2E827BA9E203F1B3363D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244363, "uuid": "ce75f9d5-40e1-479a-94c7-ae3c9d302bb5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244363, "uuid": "2664506e-0976-4298-8e7f-1e7879211a6e", "value": "24576:jk70Trc4zC5Mzaou/qk2G+9YAosiaPKnXOxD8OBD9/0wSMRFNuYcw1PE1ylvsq:jkQTACCuzCq2+GAosdPtD8OD/OYFPEoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244363, "uuid": "9f962da1-0d9a-4686-9752-ec3f4856eb5f", "value": 1303040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244363, "uuid": "cfb4f3f0-1644-4e0c-b525-092d53b1b77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244363, "uuid": "8d6d629f-c111-4980-b9cc-312ecc508133", "value": "317dbdb7797a504f9a15ef0207871ed8910d4a89c63874c16759800512e3def0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51a60a7-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778244292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244292, "uuid": "61e92670-f0d5-4603-aa13-573914993b4b", "comment": "Malware payload (DarkCloud)", "value": "317914132b548c5cfc43966656f86236", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244292, "uuid": "2ace5dca-a7c7-4c4b-8f15-8a4ae8628910", "comment": "Malware payload (DarkCloud)", "value": "31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244292, "uuid": "f728979d-4583-48ab-a745-b0ff6ef60ace", "comment": "Malware payload (DarkCloud)", "value": "22919df58b44b2357645bfe44ee06c4f56634b42", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244292, "uuid": "5742dc2a-9157-4647-80ed-abaf27d0229e", "comment": "Malware payload (DarkCloud)", "value": "98741c4373b7667feaa208c9feb6d22a7abc057efb93fae968d4ccb8388473503237bf32c3b24a0320cb4bff61192f8e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244292, "uuid": "824cc7ff-9f9c-44b4-9279-375609c3e34d", "value": "T133451224AA3DDA42D8F487F80DA1E37613B49D8DE511C2138EFEFDE77865B0A2409653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244292, "uuid": "6e479948-ca2a-4d60-bd99-09059795f842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244292, "uuid": "d9c0d86d-dc7b-44d3-838b-27a339b50ddd", "value": "24576:qO8+v9N5aNtbXLJQlQ/Sh2hOsjVHbQL1VRTozLqCH:jvOtb9Y2caRbQL1V4+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244292, "uuid": "aafc8f32-bde7-43db-b224-7e35f492c210", "value": 1218048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244292, "uuid": "07400ed1-9131-4888-8c4d-ca82d44b2104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244292, "uuid": "e8affa67-19a6-4f9d-888b-c948eb848d69", "value": "31eb24228ec0ef19a119bc6cd18140ffe187c3d8c7df9f992dfb67ad9d64b1ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a0e0fb-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778242949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242949, "uuid": "05b8cf78-2f60-4488-b732-f97990ec9143", "comment": "Malware payload (a310Logger)", "value": "b1a9867e22db3618939d063acd0396c0", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242949, "uuid": "f3014638-a736-4885-8b54-739c3a07a8c5", "comment": "Malware payload (a310Logger)", "value": "3217c4605a9639caaa2f000125740e7a261f8a09bb16581b3c882a2c9cbc107d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242949, "uuid": "abd509ab-eb82-4a9e-9ae7-b84bb94fb210", "comment": "Malware payload (a310Logger)", "value": "29a0fd3170c9cc75a35f4607e6db695dffabb2ea", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242949, "uuid": "1c9708a0-7bb9-41fc-8d32-28e8eeb63e57", "comment": "Malware payload (a310Logger)", "value": "5013aa1315a39a74ae463aa9799618b9ace5ff79a8dd302546cae7a88f20965f306190dad657ee892d02cd9f8cc9dd98", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242949, "uuid": "3c818bbe-73cf-4f84-a5f8-11fea744ca98", "value": "T1ED55CF0273C1C022FFAB96734F5AF6515ABC79260123A61F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242949, "uuid": "48beb14a-8569-4572-9106-b9781f6231db", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242949, "uuid": "94c86331-7d0c-4933-b805-387d116c5db4", "value": "24576:X5EmXFtKaL4/oFe5T9yyXYfP1ijXday4zZ+Q5vaNLZSFVm5U4Jy1/7K1sRwB:XPVt/LZeJbInQRay64BvJyYsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242949, "uuid": "8332ca86-f678-4885-849b-8516d2fa0e40", "value": 1393664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242949, "uuid": "17c42bf4-5915-4e8a-abea-9f43fc2604de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242949, "uuid": "f449c201-266c-41b1-8b12-34dc4b397528", "value": "3217c4605a9639caaa2f000125740e7a261f8a09bb16581b3c882a2c9cbc107d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e955b94-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243180, "uuid": "437f7d0e-fc72-4c19-8b98-73adf836bad5", "comment": "Malware payload (PhantomStealer)", "value": "3e89752e78c4df9f09d97cf40773ff2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243180, "uuid": "8e6cc7b8-640a-4266-907e-895132035146", "comment": "Malware payload (PhantomStealer)", "value": "32381bda3ca992cc7bf2c09bf36e013fd3ee562d56d244edc7c6c8133a87fea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243180, "uuid": "a8c1e1cc-66c5-49e8-8f74-13b32dff1703", "comment": "Malware payload (PhantomStealer)", "value": "ed129c2172a54e3c0bc40babbe785d12e5f75512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243180, "uuid": "df439e73-3d6e-430d-9aa8-0a554863d604", "comment": "Malware payload (PhantomStealer)", "value": "8c2f2f61c3da5461879290f9658fcc5b77d7411fe6d7c16538ea3a66dbcf8481479205aa7ddeff8788b864b2b7ac27a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243180, "uuid": "69743962-85a0-43da-8996-2a8329e50a89", "value": "T189F4DF6873F85A00F1FF5BB294B59D51AB35B513A962D71E11C081C80E72B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243180, "uuid": "ff5eeb7b-bee8-46bd-b116-d8a754f2ae0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243180, "uuid": "bc9eaf8f-7f26-4a82-a569-b954c3bee21b", "value": "12288:H9sNWvkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabm3NUW6:H9TkqjVnlqud+/2P+ATAS/JYec3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243180, "uuid": "b213c31f-318e-4a38-96c6-74b59c95e98b", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243180, "uuid": "1f510678-bc3f-4b8c-a4ce-9e1b0c2f7815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243180, "uuid": "01692c15-c4ec-459a-89e0-6b35a6f0eb01", "value": "32381bda3ca992cc7bf2c09bf36e013fd3ee562d56d244edc7c6c8133a87fea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5ef74f-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778245965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245965, "uuid": "91f388f9-a023-48e3-b901-b43bbde604b8", "comment": "Malware payload (Mirai)", "value": "f1d822d06ed70b4279549adc35fdb8a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245965, "uuid": "80a01d74-74fd-4dab-ab5b-4c5aeade364d", "comment": "Malware payload (Mirai)", "value": "32521b2316623775148471c5b6015801625d7ef95b696d37ee937fecf31284b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245965, "uuid": "a0da4bf6-8207-4736-bbc6-eddae65349ca", "comment": "Malware payload (Mirai)", "value": "c479ee7a242493966c200a7ad2efa8918cab1be4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245965, "uuid": "bbb91be7-b5a8-4362-a5d1-e1e4f56887b4", "comment": "Malware payload (Mirai)", "value": "db00aeba175c211b793dbeab3f1437dea30f0c19dfa746069f1fb60235a5ab3b7caea495e3c382c48e2dba82d8602942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245965, "uuid": "675059a9-0c0b-4ac8-86c0-f6139ea72e4f", "value": "T148B349A3CC256F68C624E5B4B0B18F792B939A6091875FBE15B7C2749083D8DF9053BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245965, "uuid": "635b0351-9fa7-432a-aba3-62db4fc1862b", "value": "1536:+s2ahljEj0Fw5C9KmUuF7+X6mWHlWRzyRJ+Wvcgzz6ru5fr+bl:wa7uMw55m1I6pHlWUj+WHz4ulru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245965, "uuid": "edeb7b5f-93b0-45c6-91c0-535b9bf89970", "value": 117368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245965, "uuid": "f7fdefa3-4d56-4db5-a3a8-32c039184450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245965, "uuid": "1845d641-a714-4d5f-a0c9-7d0201721c56", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94c0738-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243440, "uuid": "327cbab4-3227-44c9-82f6-5dd798caadb9", "comment": "Malware payload", "value": "218813fe1dc7989567f2061b42531bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243440, "uuid": "5a6a2b3d-a140-446a-9d90-790f1af9387d", "comment": "Malware payload", "value": "32e92b0f7b7622529f9a08e8ba1597fb42c10ec84af5ed877ce3311a170d2354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243440, "uuid": "3d7219d5-8c90-4796-b569-60cc10e44563", "comment": "Malware payload", "value": "791b75b81e6a3554e3628733f0f8fd7fa9defb20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243440, "uuid": "39942590-bd88-4149-a977-78aee78949bc", "comment": "Malware payload", "value": "7b997b4d9f2b67bb6b3a0e74263de574c10a8c6f0a9ab8931e7371d0bb5d0924a2afb9b65651dd0e1400b07ecf6ae17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243440, "uuid": "1b336077-4018-46ff-899e-4d8be4636dff", "value": "T12E55E012326ADD02C8A60BB158A0D37047F46CD7D422C21B6FE67EDFBD36752694A783", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243440, "uuid": "a954affb-09f8-4d68-9bf9-9997f46d303d", "value": "24576:PYTySJJSHwM5Mv4gqDnndydDsqLfOPAtdXtOl:FqUwyMQrnsd/Lfft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243440, "uuid": "636efcb4-79da-4d04-8c0f-a92e384760ef", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243440, "uuid": "a574be91-1e49-4322-a28e-615bf4ee329d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243440, "uuid": "63e25f65-ce93-45ed-855a-c7dd197cb73a", "value": "32e92b0f7b7622529f9a08e8ba1597fb42c10ec84af5ed877ce3311a170d2354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119c8d7e-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256473, "uuid": "b77d5013-539e-4656-8020-552e3b697ece", "comment": "Malware payload (Mirai)", "value": "8c81027f7990f164df33cd5466d09c36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256473, "uuid": "2479537c-8338-4e9b-8a00-0a8395c67141", "comment": "Malware payload (Mirai)", "value": "331becf8eff63cf0b668ccecd096667c5ae8f6d36a04e4acc2693ad8cc67c3f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256473, "uuid": "1c648ad9-2762-4d6d-8929-bb5f76a2bc9b", "comment": "Malware payload (Mirai)", "value": "af9387ee7c7caa13c62baa3a7db2b69ff25d4fef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256473, "uuid": "df538a38-4a24-4483-bc18-f1aaefcfd85d", "comment": "Malware payload (Mirai)", "value": "254a4f34c3f31d49f7245de5e082b92fcfed5188901aef7b2c965485110f03a35793e53cf2161b603a9e6ee1172ff412", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256473, "uuid": "a061192b-abe0-466e-93aa-546fe89e7c18", "value": "T120E3E50AAF210EF7E8AFDD3753ED0B0124DD954A22687B75B570D858F18A14B06E3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256473, "uuid": "abfb9a0c-d30e-4cb9-bae9-2f17f02f433a", "value": "3072:3uRYywLlCIcQ7Q1Z52O17NYV4fvp/eAwbZny:+RYywLlR17MZ52C5YV4fR/xwRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256473, "uuid": "c7c48f65-205c-4bae-b66e-1897041b32b9", "value": 152968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256473, "uuid": "70a97af3-bf81-478a-a01e-65218721a3b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256473, "uuid": "c068dc0d-292f-4568-a55e-ac6f76a84f9b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b443df6-4ae4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778248006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778248006, "uuid": "a5386eef-616b-4a9c-918b-e9a7b767c666", "comment": "Malware payload (Mirai)", "value": "b8a46030dc5b36c6222bef3e3c22e993", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778248006, "uuid": "f0e1ee1f-609e-480d-b0d4-f31282046366", "comment": "Malware payload (Mirai)", "value": "334033351ec5aa6f61928b789cf74238c625c4f8ab067b1d2fc21ed51c12d653", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778248006, "uuid": "74b6eac1-e719-4d6f-ac15-3a1310a8a7a0", "comment": "Malware payload (Mirai)", "value": "99549e066dca6216f740c5e472a579e4d62546f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778248006, "uuid": "8b837a00-d73e-4ef6-8812-3ab83dd090fb", "comment": "Malware payload (Mirai)", "value": "f72d561137197d472810f9ee45f1e60e85e2d890532b6bded2bf4111b8bf704a09ab25894ab181cfad10ed7d31e6b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778248006, "uuid": "9fb49cf3-410b-4118-8bfb-ccdb7a37a42f", "value": "T17B04D81A9F610FFBDC6FDD3701A90A0635CD954722A43B393678D928F54E90B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778248006, "uuid": "1677eb1b-a136-4efa-a0dd-329b19adb9af", "value": "3072:f5+BhVi1+PbfS1pGJhE1EHmxX96hTlqwNw3nF2iP7:x+/oYbfS1pKsEGx96hTlqwi3nF2iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778248006, "uuid": "a36ccf57-f1de-41cf-8612-721b9c1f21ea", "value": 177432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778248006, "uuid": "c178dd81-550e-4188-95ed-4d36ba954ea4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778248006, "uuid": "6c3c48fb-01d3-4a2b-868b-f09082043985", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b3bfaf-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238728, "uuid": "2d9e8d4a-6581-4cff-afd4-c157eb908143", "comment": "Malware payload (Mirai)", "value": "f30140c4318d05f0c6463980abdbf1e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238728, "uuid": "cf0c81c4-027b-4648-9f5e-8de8a44d3f43", "comment": "Malware payload (Mirai)", "value": "3348c9da39c981e258b53c644feb9962286384e25fe53718afca0d222ba86954", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238728, "uuid": "cb40f5bd-3f9d-4678-994e-6b1dfa378bf4", "comment": "Malware payload (Mirai)", "value": "d25904e0a5c19b8a8961b73338247c6278abf7ba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238728, "uuid": "647e99e8-63a5-46a0-82cb-6909d9b3addb", "comment": "Malware payload (Mirai)", "value": "b6ccd7c3cc2daa91ba6e9eb622d37d2c17ee51c27a327b8fb62899dee3bfbb08065d7399008351dd6228776ce0182c0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238728, "uuid": "f4cd468c-58f1-4299-a916-7a9daea42c59", "value": "T1E4236CC5DA43E8F5FC9701B51177B7339BB6E1290064EE63C358E532AE63601B62A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238728, "uuid": "7979a65c-2fd2-41b0-8f8d-f64cd0763821", "value": "768:ZlHXwYLwhXyL2uWBAHwkbTeJBJiFI3P4XWaqUmp6PIO73THOr3F7t7tnz1toYo8J:z3jwhyWBAHw8eLkFAWt3XPIize7rzLoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238728, "uuid": "d0e21566-b07c-4a2f-af5a-aadd749a5e74", "value": 46672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238728, "uuid": "266d084e-5a35-470c-b50e-739abbfa31d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238728, "uuid": "793836d5-9bb7-4ef1-b19a-ff03e68c6c1d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc61ded8-4b23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778275281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778275281, "uuid": "08182b3d-554b-48ab-ae6a-a33bf821fd26", "comment": "Malware payload", "value": "26a425d4eefb504c4fe08b0ced63a73f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778275281, "uuid": "d7d4ce4a-27c2-4171-988e-f385ed5c8a25", "comment": "Malware payload", "value": "3351f5e08bbd479b919e7120ddfdd1912c1e3564a627722040ac9581c08180ef", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778275281, "uuid": "493ba4bc-9a04-4e6d-b79d-bba0970679fa", "comment": "Malware payload", "value": "5a5601afa22418f8a9813d1c4f9ac26600704b99", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778275281, "uuid": "4e1680ad-373b-40ed-84e9-cd3d56b618a0", "comment": "Malware payload", "value": "f2bf7d7436b272957f0826c8403d58e2217c22bd1ab7055821c329dc64269b756b4777f76780768b34791466e3cb1f58", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778275281, "uuid": "cebcac89-4441-4bb2-b9c3-d01d0cc9828a", "value": "T1E1365B03686601F9C1E5E231C467A692EE25B849973827D36ED09EF02F327C16F39B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778275281, "uuid": "458c86c8-2084-4cbc-a94a-dfddcbb96945", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778275281, "uuid": "09dc559c-4d23-40c2-814f-2c8b13489f65", "value": "49152:qwjrahVCOxZWwyTUulEpft4vkUPSIwlQta400Cc45V2:qiEdbWwHft4vkUqIwlQtO0CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778275281, "uuid": "88ebb34e-1f6e-4e7b-946c-d36e4214ad2e", "value": 5014152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778275281, "uuid": "a339577c-b35c-44dc-a27d-ea513f35e2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778275281, "uuid": "13a2be79-237d-4d1b-924e-ea794e3da496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb23a0c-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236793, "uuid": "a78adac4-a9c4-46a6-bdb9-5e9b2f7cabc1", "comment": "Malware payload", "value": "55233b00b087d7545387494259c66b9a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236793, "uuid": "3eec034f-a451-4552-9bef-1c7c9b007d34", "comment": "Malware payload", "value": "33df08276de56d21e1f2b82205ef14a1f51570a9b2aaae65b26b922c0942a9fc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236793, "uuid": "3da56946-0842-4c1a-875e-cadfd27c89db", "comment": "Malware payload", "value": "45e4f0edaff89a9af354dac709681399efd9cf80", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236793, "uuid": "cd16d7a2-e16a-4d98-9caa-2faf3a1ee9ed", "comment": "Malware payload", "value": "703cc6d40a9814dbcb9b13267971445a510867d94bb9cbdaf7126cb88ef1006dd39474e6a730aff7db22cb32905a793e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236793, "uuid": "7e04aee3-9a5f-4f0f-838b-aef7206b0663", "value": "T168729A8132F80300F5B6BF35DB3AAB85093AB980ED71C75C8D508C5D2864612EE72F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236793, "uuid": "9de81c5c-2e48-4fee-b526-58cd68b33f91", "value": "24:8d/jZusvqU3iXnSpVT6g4uNBxb1En989MBTRrrUb:8lj/C7XnSpEHkb1Uuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236793, "uuid": "78c5c07e-aa0f-4b8a-a89e-55ba6fee9621", "value": 16489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236793, "uuid": "63ca415a-f798-4968-a271-1c5e4b679762", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236793, "uuid": "a3566aa7-8609-4e8c-9cfd-86ed328dd9cf", "value": "Scan_001.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a843ffe-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Jalapeno)", "timestamp": 1778243361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243361, "uuid": "62b9f135-f0f9-47cf-9681-e1b280ee41ff", "comment": "Malware payload (Jalapeno)", "value": "43d3c9a140743cfd2b941ab6afa1c315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243361, "uuid": "d5ed1ced-d86b-4aaf-b068-6efa0597587d", "comment": "Malware payload (Jalapeno)", "value": "342d41e8ae9fa05397b6d4a9a340e85f01c5aec205b203707361faa2f9f64750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243361, "uuid": "88f38480-cc89-4c7d-8e59-19f8c2f67aa1", "comment": "Malware payload (Jalapeno)", "value": "1a531277b59094e899c953bbc964ca3546b77935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243361, "uuid": "cbc87fa3-c729-40d8-97d8-0cb2cdbcb52a", "comment": "Malware payload (Jalapeno)", "value": "d8c51c048300038cea6b9e5cfe3ddcef32d3e1a8afebaf865470723c46e44cb409b48bd64c184a87b9406610a40ff826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243361, "uuid": "27094b6a-f5ce-402d-87d2-7bec0dd2c891", "value": "T1FD531A79D9C0ADC4CB5B9371745AA3C603A79F076839069C6ADC38970F733906A39379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243361, "uuid": "df0ebf39-b689-41e0-97d1-7aca718388db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243361, "uuid": "f41cec19-8e9d-484c-b763-ce3efa399831", "value": "1536:Oqbujm90ehOq+kcoIvI9WWpbL3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW:Oqb+mael21ggWuDud7r6GiX8QiQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243361, "uuid": "59312c31-7075-4d00-bd72-24f5524e37aa", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243361, "uuid": "9142fc6d-27a0-4205-9ef1-54548e0742c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243361, "uuid": "3d5485f5-d17d-4424-88d0-eb314bec38e6", "value": "342d41e8ae9fa05397b6d4a9a340e85f01c5aec205b203707361faa2f9f64750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c7cc58-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246111, "uuid": "1c0f28ad-a675-491e-aa18-9489ddff4df5", "comment": "Malware payload (Formbook)", "value": "0cc56c38dd02639c5ec3d8d90f79de2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246111, "uuid": "e10221b3-9199-4b1b-a73b-65f310ae3bde", "comment": "Malware payload (Formbook)", "value": "3461dbb55bcf73af2babafd1e537e9d0f2ca89a4117c1bc2a014353cdfe2d95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246111, "uuid": "c20505c0-fe3a-40a9-83f7-3db1825695be", "comment": "Malware payload (Formbook)", "value": "554f616f9857f6b3f5fb25a060dfdc55c0e7701c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246111, "uuid": "47a40a8d-6199-49f8-a8c7-01e1945003d4", "comment": "Malware payload (Formbook)", "value": "2eeb9105fa26f2f415f9ed1ab26ae1902c08b8345f689d80f99cbdb3aa6f9e7c60d3b1ed15863106ad8e37e643ced280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246111, "uuid": "30520123-eb2d-47bc-8e8a-148243d771be", "value": "T1E635BF0273C1D022FFAB92734F5AF6515ABC79260123A61F13981D7ABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246111, "uuid": "dd99b892-46e3-46a9-80a4-261b43856b54", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246111, "uuid": "e899c9cd-c42b-4a74-a9f4-41f6f7b76f5c", "value": "24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8aOVD5m6VqHzHw:0TvC/MTQYxsWR7aOVlm6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246111, "uuid": "39babee5-7c08-4a80-9b0c-f22f0cb0841a", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246111, "uuid": "f15eba6b-cac6-4201-b71b-a522a8f61de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246111, "uuid": "26fd7732-4c97-45b9-928b-58c081c55c42", "value": "3461dbb55bcf73af2babafd1e537e9d0f2ca89a4117c1bc2a014353cdfe2d95d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bb3e8f-4aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778225496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225496, "uuid": "48f95f32-4680-4664-bc81-4a7f450643a8", "comment": "Malware payload", "value": "cfe1ddc4403014679c17072ba0883e8e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225496, "uuid": "b5c2644b-d2ac-40aa-ba65-836066d6e6d7", "comment": "Malware payload", "value": "34c5b71e75522c2c06c45342dbfd02976e48826e8d8af96073d76c425e9b0d9c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225496, "uuid": "e20d374b-db15-45de-9a10-91702fc5ab7e", "comment": "Malware payload", "value": "c4dd6c1419959247b9f32338c2059ddcade65aa9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225496, "uuid": "afb92ea7-278b-4505-be8c-3066b9212e50", "comment": "Malware payload", "value": "f7f9330329c646482c8eb912876539271c19ebe7911a30ded404b1be86bf6aa3ecc3e00551a987f0c22409283736ca3f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225496, "uuid": "ca0dff70-6881-4e47-9628-df6569eb997b", "value": "T11182F9053BF514A742821AA4E1CEC30D9B29416B61591E90BEDCC3C4FF6213EA7F5BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225496, "uuid": "f431892d-c53e-4c7b-a80f-9a41ba3989a5", "value": "384:YRuTCZu7yrY7fluAEyHpZZa1v9nnWy41MoLgnjW5z5z5CLFpF87i/+:dpaRnxoLgnjY15QP8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225496, "uuid": "166547c6-10c9-4b7c-a0d3-b8639ace8900", "value": 18156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225496, "uuid": "003a62b6-ab27-48c7-930a-fd2ccbe6266a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225496, "uuid": "2f4d67e2-d43e-438b-98bf-8b183bbdc7b4", "value": "tianyangge.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c074aa-4b05-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1778262248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262248, "uuid": "3c84d738-b505-4393-81d7-7d4f8591ab7e", "comment": "Malware payload (Socks5Systemz)", "value": "c2aaaa39c30f3e6387671e14b18d0da6", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262248, "uuid": "74728380-654f-47a8-8a08-422f85e33c0f", "comment": "Malware payload (Socks5Systemz)", "value": "351e87e7af9441c2444517b86c41ee7483614b2e11c6890d8dad4c1dc14249bf", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262248, "uuid": "776b4a3d-691f-473b-bad0-79f000f06abc", "comment": "Malware payload (Socks5Systemz)", "value": "dc6ffcca583dbf5fbde70d9ad1750def0c9d0da8", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262248, "uuid": "4dcf6697-3b12-4902-9e9a-5db675e11d0a", "comment": "Malware payload (Socks5Systemz)", "value": "fd636740fb2fdc16529ecf8b7b51959705af505b8fb4463bd42a4b4139b51b93946be81824b9764fc817da8e673bcade", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262248, "uuid": "0c2a21ce-8911-4abb-b487-69b439efc3b5", "value": "T10D0633C652116DB8ECE2EF787C5E28F50047F41A09BE625033BE64FD132BA7A50DA6D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262248, "uuid": "b326387f-24bd-44bb-93d6-6c7f467c09fd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262248, "uuid": "d256fb07-fc6d-4a40-a2be-85bd56a65e5b", "value": "98304:NOFgZRyshE1c/3jQ1VzVTAfr5+y6hd730tlek1+POup:UGZRysZ/3j0bEky6hd7303r1+Fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778262248, "uuid": "350db6d2-4f01-47c3-8df2-5d0296b3a613", "value": 4016836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778262248, "uuid": "be917e3c-7978-4395-be14-e8dc52195119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262248, "uuid": "4101799f-5a5d-4d71-867d-68a9447abab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115ac98c-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246594, "uuid": "59bc2766-b6ec-4d51-b9f6-166940ffa897", "comment": "Malware payload (RemcosRAT)", "value": "e8e8d8a3f9a9e92282b1a2b660843a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246594, "uuid": "328dbdd9-499d-4bd2-89bf-f3ab5494a319", "comment": "Malware payload (RemcosRAT)", "value": "356fff64ff9df80d01dcaa27e448ef80e28767a80f82d03bede6062db9f21156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246594, "uuid": "00cf60e0-4046-45dd-b334-feaec1f9d78e", "comment": "Malware payload (RemcosRAT)", "value": "7da8278de842d1ff0e2a4d547c9db9b0dfd6fa93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246594, "uuid": "7d32582a-45b6-414d-9d34-9013c8bff30b", "comment": "Malware payload (RemcosRAT)", "value": "8f1699fce25f35a463c0ea3fe1bfdc37f51bd67e320735099ea64a0b8684d2ea86e06a2520fc87ad7dba30eff0866d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246594, "uuid": "5a104289-9544-49e4-9bbc-8fce6e0a02b2", "value": "T114D4F1D3BE2080A5D421D6B4CCA9EDF6237B7D295D50692A23EC7E0F3C311608567A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246594, "uuid": "c7be61b8-a4ef-4b79-8675-3e87d06671c4", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246594, "uuid": "43068757-6632-4728-8ca3-02d2df1e1b85", "value": "12288:mX4OKQAFtTNproO9WXofMP/D1Ue6z6UWY1LeaopAjRKG2:44OkwO9WJnZsz6UWweSRKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246594, "uuid": "6106c5cf-650d-4ec2-a1fd-8e2c50e51bee", "value": 653049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246594, "uuid": "57590297-a9f5-49f1-b184-2b4b23dde45e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246594, "uuid": "350d9efc-2645-4a7e-98d7-5d54df0896fe", "value": "356fff64ff9df80d01dcaa27e448ef80e28767a80f82d03bede6062db9f21156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fc36ff-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246575, "uuid": "93d13409-a835-40ec-bd93-f0c18f63d59c", "comment": "Malware payload (RemcosRAT)", "value": "2f48f78fc796d6f84abbf2b6fa1242ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246575, "uuid": "36a220eb-57b6-492e-b230-2235888dfc21", "comment": "Malware payload (RemcosRAT)", "value": "361436a35e227ad65a1fbebd6f76e8b970334ae5c89996fd85d1f7cfa69eb0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246575, "uuid": "4a8c35c5-dc80-498a-8de8-09dddc42717d", "comment": "Malware payload (RemcosRAT)", "value": "9b7f7cc5a494043dc0ff3395a79f57b064ea6195", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246575, "uuid": "cd0bd484-cd11-413b-bd6d-d8392d029f5e", "comment": "Malware payload (RemcosRAT)", "value": "92718f44ec6da39d387127a8be0993f75607756f49752d2ae35cdd68700c9812407513313ad8ea34a09df46340cfb321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246575, "uuid": "eb91c909-5a5e-4e57-8f78-2cd4f4548d7a", "value": "T18ED4F1E3FA208094E82297F4CCF9E9FA6A7B3D299850291633EC7E1F7C31151851795B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246575, "uuid": "9265c0ba-974f-4264-8a27-fcc032886041", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246575, "uuid": "78650e55-e3bb-486f-976b-ec46281f669f", "value": "12288:mX4OKQAFtdzo1Chtn+cP9TxXlKIWp33mkZojjahP:44Ok5ht+k9TvKVFlZojO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246575, "uuid": "898b9cd8-5c8f-49ce-b4e1-b4a1b1611dbd", "value": 608649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246575, "uuid": "683fdd1e-c6f7-4286-b4d3-8f321ffb49e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246575, "uuid": "f7f23b0b-929e-4780-be74-1c6f6ff13b3a", "value": "361436a35e227ad65a1fbebd6f76e8b970334ae5c89996fd85d1f7cfa69eb0fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff0dd4c-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243236, "uuid": "d01c2c74-41c2-4a91-8e73-4f99e27fc94e", "comment": "Malware payload (Formbook)", "value": "df18d7c7ee80403c73a04cfcb90d0dc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243236, "uuid": "46a51c0d-1be2-4e69-ada3-1dd7cf21e790", "comment": "Malware payload (Formbook)", "value": "3759e9e7b22db85ca085a7b7110c604a530a803a234b64eb9b39bd39fb02eb24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243236, "uuid": "78c75033-a465-4459-b78a-11225c71e268", "comment": "Malware payload (Formbook)", "value": "75d25b35c689e03dc675acba25d2ddf22b64ed09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243236, "uuid": "4763919d-e72d-4497-8f0a-11d10b5dcdb1", "comment": "Malware payload (Formbook)", "value": "f77f06f7c8f942dc84d3c8b391b981803273208caf37ca681764b715072dd4fe3932d0bda17985315ade73d7508e5fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243236, "uuid": "767e284f-555a-4b3e-a61d-6fb36d18c95b", "value": "T12945BF0273C1D062FFAB91734B5AF6115BBC7A260123A62F13981DB9BD705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243236, "uuid": "6bb8bc52-ef14-4b84-bb3c-8284da323b21", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243236, "uuid": "a078c453-a7bf-48f9-99cf-a92a34b5abb7", "value": "24576:J5EmXFtKaL4/oFe5T9yyXYfP1ijXdaC0LvrAhucZ8K7xCwa2:JPVt/LZeJbInQRaC0vr4zFCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243236, "uuid": "0002347d-3782-4983-8765-ed79b1461325", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243236, "uuid": "b620c283-634d-407d-b053-b47e552138d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243236, "uuid": "63d4f96c-2874-484b-9694-9ab4e50f2b24", "value": "3759e9e7b22db85ca085a7b7110c604a530a803a234b64eb9b39bd39fb02eb24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e33532b-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265057, "uuid": "35a15a45-8097-4f78-aa40-cb231833ec18", "comment": "Malware payload (Mirai)", "value": "ab428971b5f4b9f33c54473e7b034144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265057, "uuid": "d4b34d83-9b96-421d-add4-1e1a43f8673c", "comment": "Malware payload (Mirai)", "value": "37646d54145b0a209a3d7e0468c21881c7b3d14650fc583c1fc5982dcd37d033", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265057, "uuid": "ecf45599-1d63-44aa-8000-b901764f9a9d", "comment": "Malware payload (Mirai)", "value": "0c2ce707cb30c99ff92d76f2e4ea9304d815bbb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265057, "uuid": "9e421a9d-59fe-4dce-b1df-25f6e8d26a15", "comment": "Malware payload (Mirai)", "value": "779acfd73c27a1591c192d48d0506ca5c43a8686ab0a9ace4ed10cda9ee3b38ad321ea2fc5bbd9d5418705e11e2ebde6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265057, "uuid": "65dc2d96-f586-4bca-8d62-301ab3d28e9d", "value": "T15C33F1AD81337C9CC68469B0068781D4F296FF16CC8AABAB15E512BF4E1BDE1731BC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265057, "uuid": "0499f6e4-958f-495c-a91f-81f5f665b75c", "value": "1536:I4P6dEjsnq5uubaHKHhs1/rCcPno2vXA8NwRYT:9vjsnqbeKhAmc5AorT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265057, "uuid": "b8ff8487-94e5-4ee7-a495-614e551efb9b", "value": 54300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265057, "uuid": "c0efc630-93cb-4df6-9bac-fa401d5679d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265057, "uuid": "3130ad89-1e4f-4ac8-9e7b-fc688c7e647d", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83148efa-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1778232611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232611, "uuid": "5229bf2c-274c-4423-af46-8d9496833d5f", "comment": "Malware payload (CobaltStrike)", "value": "fb527fb59660ba2af9960c14a17ee3c1", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232611, "uuid": "42b88c35-660d-4c8e-8825-9b06548690d6", "comment": "Malware payload (CobaltStrike)", "value": "37a82b306178d9bf25af2c794d675630ce55336cf1cbf5734701e471e1abaa14", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232611, "uuid": "c70dd08c-fb1b-48e1-9127-a19a5436c8a1", "comment": "Malware payload (CobaltStrike)", "value": "25f5009d83ed9d6fdecd3b72030cad8e5f9b514e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232611, "uuid": "e0c8bf95-36b6-4a6f-8064-a39ae1dab8de", "comment": "Malware payload (CobaltStrike)", "value": "627aa55b6e63c8049579a743f5577837f1f435d0ee479986580949563d8a6d4b823c4ed2f8f9f85023696ce57bbc3d2a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232611, "uuid": "f44623fd-9763-4550-8703-4750d2ae37d5", "value": "T1F265392EBCA804FAD0AA5272887661517BB1BC050F3127D72EA1B37C2FB67E48D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232611, "uuid": "99f91dee-9536-4269-98ba-ff3369ee4a38", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232611, "uuid": "b3d6b5f5-119d-45a6-b13b-57f17fc328e7", "value": "24576:OYXqBWpVUALzM2LEvj8U1/oeleTLj4HJsvb:OYpHUYMmmjyUp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232611, "uuid": "f960687e-aaf8-420b-85c1-ad7fced8ac35", "value": 1530368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232611, "uuid": "c0ad97cb-034a-4117-b72d-56c399f0a29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232611, "uuid": "b4468106-b9eb-4df9-849e-18abbc8585de", "value": "37a82b306178d9bf25af2c794d675630ce55336cf1cbf5734701e471e1abaa14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b83cb1-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778244566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244566, "uuid": "d295e5e4-b2b6-4ff4-857b-7d0dc078de93", "comment": "Malware payload (MassLogger)", "value": "68b9408bf0d8c98da7993e92028b48ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244566, "uuid": "966844a5-84ff-46ac-907e-40fbc08176cb", "comment": "Malware payload (MassLogger)", "value": "3802eb81a756b854a51788f7f1bdb7fbfad556a17393ec9725ac09a1c90ce045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244566, "uuid": "66e4deea-3cee-4ba7-bba9-92e63e8aa1df", "comment": "Malware payload (MassLogger)", "value": "55fff3503f1106735cf41edf565ea01d69bf5d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244566, "uuid": "88ebc8fc-789c-4413-a7c0-a0f80a89be01", "comment": "Malware payload (MassLogger)", "value": "7424eb5810071322102b9159a062f46a81ac5332b08d04d54ecb74237a77e50d5022fc7f145dce8de8cd30afa6e953b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244566, "uuid": "4c8efb9a-7fff-4b7c-8f13-8e1a744ce26c", "value": "T1C105011463BACE02E57B1BB148F2D07417B12E8ED925C18B5FDA6EDBB636B8146C4343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244566, "uuid": "a30e2c5b-d46a-4fb6-a731-c4f2096fdd93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244566, "uuid": "d3741c4a-3d1e-4304-ad33-61f639c09613", "value": "24576:goHR5XIUoi5QTRM5o0D4BAech8KA5OSWt0:BrYJJBi4BAecGKA5OSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244566, "uuid": "d56c0308-1505-4798-9e69-1a7efab0fc0d", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244566, "uuid": "4d3e953b-5db5-4267-9ea3-062bf65cbba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244566, "uuid": "1b3bc0ef-a28b-4426-929b-1d5515c4e99d", "value": "3802eb81a756b854a51788f7f1bdb7fbfad556a17393ec9725ac09a1c90ce045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd76d872-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244789, "uuid": "9feed478-3787-4a1a-956b-4f32a2a98a85", "comment": "Malware payload", "value": "50f85a1e6596276b6791474bf0ddbd3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244789, "uuid": "5606710e-c9df-4502-b7d5-b42d54cd2388", "comment": "Malware payload", "value": "3811cc6e2506757c39222ab017a028e75b6f3b40c1b5e14c1576c30785627204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244789, "uuid": "32eb9ce5-0260-4777-b8c4-017379023db2", "comment": "Malware payload", "value": "e9e0e40ad15bec85eea8bdf91f5003c5f108f450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244789, "uuid": "f48cd5b2-a36c-47d1-94d4-595c254cb62c", "comment": "Malware payload", "value": "3d94402632f29b7b2487c8ec36a05c25be088ad8fe2ec9101d8a7cf8f5ae790742b0c9590a5caab02f922b75e717d94f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244789, "uuid": "41e220b4-5ad7-4e0b-9e3b-80be6edec13e", "value": "T15DE49D2123D85B04F0BE9B3E9739165403F5FD86C62AE50E7D28B1E90972BC19B63723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244789, "uuid": "1685bf36-ba86-473a-9c6b-0f6acabbe619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244789, "uuid": "0aaae909-20b8-4bd6-a9a7-5ebaee5de320", "value": "12288:NJmnJK57GR9ObL3ZF8L9BgfHHZljG0uSRZWMiYnZy66:WE7GR9ObtuKnZv0OZy66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244789, "uuid": "4bc7bf6d-39a7-4723-82b0-0a3a38569a3b", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244789, "uuid": "19241cb5-4505-42c3-a41a-5f6edc1e70cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244789, "uuid": "9c370ec5-3795-4e01-8467-8c6438997469", "value": "3811cc6e2506757c39222ab017a028e75b6f3b40c1b5e14c1576c30785627204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262f8145-4acd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778238039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238039, "uuid": "9ae6bd31-87cd-475e-b4b6-cea77fc287fa", "comment": "Malware payload", "value": "c2f9057723780bb8d799b9dd70923cd9", "object_relation": "md5", "Tag": [ { "name": "0-day", "colour": "#39CD87", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-43500", "colour": "#F64F01", "exportable": true, "hide_tag": false }, { "name": "DirtyFrag", "colour": "#E3C6B8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "LPE", "colour": "#9DDC75", "exportable": true, "hide_tag": false }, { "name": "Zero-day", "colour": "#8060A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238039, "uuid": "43ee3625-4747-4c7d-be2b-e17d9cf8647e", "comment": "Malware payload", "value": "381755b623dd7a4c2b5d80aaf40d7083eea727dd1f473545539029656ca81817", "object_relation": "sha256", "Tag": [ { "name": "0-day", "colour": "#39CD87", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-43500", "colour": "#F64F01", "exportable": true, "hide_tag": false }, { "name": "DirtyFrag", "colour": "#E3C6B8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "LPE", "colour": "#9DDC75", "exportable": true, "hide_tag": false }, { "name": "Zero-day", "colour": "#8060A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238039, "uuid": "523a6bad-fe98-44fa-8106-cd3275503531", "comment": "Malware payload", "value": "74c42b57609f51ae70c9840622b8ae89811192d1", "object_relation": "sha1", "Tag": [ { "name": "0-day", "colour": "#39CD87", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-43500", "colour": "#F64F01", "exportable": true, "hide_tag": false }, { "name": "DirtyFrag", "colour": "#E3C6B8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "LPE", "colour": "#9DDC75", "exportable": true, "hide_tag": false }, { "name": "Zero-day", "colour": "#8060A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238039, "uuid": "156d854b-520c-4e89-a3c2-92cfa5bc6be7", "comment": "Malware payload", "value": "8da657dd76f4a3bd5152dcfbfb2988a7e821da57cf2081aeebdbedd09346c3c584b5a92077271d4b8ecc04aa2280e69a", "object_relation": "sha3-384", "Tag": [ { "name": "0-day", "colour": "#39CD87", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-43500", "colour": "#F64F01", "exportable": true, "hide_tag": false }, { "name": "DirtyFrag", "colour": "#E3C6B8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "LPE", "colour": "#9DDC75", "exportable": true, "hide_tag": false }, { "name": "Zero-day", "colour": "#8060A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238039, "uuid": "178e3782-9120-429f-ac59-57a41a140ee2", "value": "T16F931A5ABF50D839C491C2719FFF826C553070342B31952F3B443BBA2E62665DA6BE32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238039, "uuid": "62bdd006-b9ff-4a38-a6d9-daf90d32f587", "value": "1536:EYR37Cc6KUhI9nX3mJJSEF7sbBi9vE8ePIOl7WovTa/yJ7Im:EYxCc6KsmnX3mJJSE2bQBdsfaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238039, "uuid": "eb041e8d-dc8e-4eed-b1f9-bc6a49c78595", "value": 97288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238039, "uuid": "cc4929aa-363a-4cbf-8625-8e0bb556d9aa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238039, "uuid": "21b71a43-0e88-495d-95ca-cd34aa8e7700", "value": "dirtyfrag", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f704626-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243155, "uuid": "7fa9ea18-bfd7-4636-8c5e-6a27cb4e83ba", "comment": "Malware payload (PhantomStealer)", "value": "3a301947413b24c845ff5273929713bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243155, "uuid": "4c318c6f-8b50-482a-8a75-0efe308767cb", "comment": "Malware payload (PhantomStealer)", "value": "38a2a571067c0c87c696bc876c40863642aff029dafff87709ff50e86e91fdbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243155, "uuid": "c0258e2a-d55c-42cf-a8be-72091087c9b7", "comment": "Malware payload (PhantomStealer)", "value": "75c0ed92df90629376a2ceaba68c3c8f5fbeffc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243155, "uuid": "adc0ccfb-28c8-4221-bec7-5eb048ecf13e", "comment": "Malware payload (PhantomStealer)", "value": "ac39d8df10f70bb20d00be432b5e6625c0dea79fa046cd59b85bd76592b2afbf4659d6d80e3f4fc24aa8aab4502fffe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243155, "uuid": "8d8389b9-c9ea-44d9-b3a7-8fb6cf5d0820", "value": "T1107512582269EE02D5AB5BF45D70D33447F86D985822E30B8FE13DEBBA3DB016905393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243155, "uuid": "f808b2ab-f80b-4775-9779-c5650e01dde1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243155, "uuid": "bb5343f5-04f3-471d-a9b0-f2ab415280aa", "value": "49152:Hjx3qUwjk5ABTP/5IwjsHeM1n9bqo/xBGGejFcFeYe:HxrwjkaB7/i1nL/vG3jxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243155, "uuid": "759935ca-735a-4bbc-93d2-eb07986c1082", "value": 1690624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243155, "uuid": "da6029b9-a6bd-46b1-920e-424ab16ebb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243155, "uuid": "63ef44da-1105-4d1f-b423-b975d592b605", "value": "38a2a571067c0c87c696bc876c40863642aff029dafff87709ff50e86e91fdbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4219ecb-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244344, "uuid": "363ba045-e0f6-4254-886c-9cb6bfe56e19", "comment": "Malware payload (a310Logger)", "value": "f3296af6d1684ca144ea0ccd505a61a7", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244344, "uuid": "bcd9cfd5-1187-4602-994b-008f383f4807", "comment": "Malware payload (a310Logger)", "value": "38b1105fa9f7dacfd00f868b006874f11a90e81d6c35c12d484373fce2990542", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244344, "uuid": "699a2bac-e84a-4f9d-b304-8fa15ad966b4", "comment": "Malware payload (a310Logger)", "value": "56c22563bd14d9cc598debbef245f69f9f409d65", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244344, "uuid": "87f54bf9-c9aa-4033-98da-a71812712015", "comment": "Malware payload (a310Logger)", "value": "3996953c816d2b5c7dd6d0f66bb436fb55ce37900dc0ac51b4694bc0962960b9d6e669dcac647087ecb08f56a4345a74", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244344, "uuid": "69490798-cb14-432c-8a11-7546982b3709", "value": "T173943913EB60601EF1A389B0B9B6925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244344, "uuid": "5f23df10-1949-4ce7-8d65-068575b14415", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244344, "uuid": "ebb106f1-e332-4428-8d52-442d10066563", "value": "6144:a48d1/w5KA81IJ8GpF6nuTmOOUiBUrjjHGAO6dByWF2SqGjLyRZtD6odU:QjYKkJj6GmZUiqr/vBjjLyRZtOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244344, "uuid": "d3dda898-8912-453a-b177-0e7237e47259", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244344, "uuid": "76a7a4da-896b-401b-9a2c-beaec09729c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244344, "uuid": "1c863340-c671-4b12-92c2-68b4b9d20657", "value": "38b1105fa9f7dacfd00f868b006874f11a90e81d6c35c12d484373fce2990542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055ca176-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778245715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245715, "uuid": "cdab67cf-1eb3-44a7-ba98-50952083b938", "comment": "Malware payload (Mirai)", "value": "ef046d6797ffbd54fa1351210c49bdc6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245715, "uuid": "95d21747-13e3-4a88-9bf3-c06373f3b355", "comment": "Malware payload (Mirai)", "value": "38e4193816b8f46765e0fef1bbbaf0447188ddc086cb6b8a9604757cf2329a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245715, "uuid": "b2bc8b8a-c49b-4225-be5c-a06c0916eec3", "comment": "Malware payload (Mirai)", "value": "22a3ef3e1f37f779550e5a34adc8623b13e1c452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245715, "uuid": "5e49d73f-942e-4c0e-9fd3-47f6974e39d0", "comment": "Malware payload (Mirai)", "value": "85b2c5c8913cca86e8de6235d297b89caaa32a88855dd688b6461915fb2b929d2d3acc26ddf12c3b811bd69bc12af4fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245715, "uuid": "d9afbb13-3b2b-44a0-8f4c-eeeefb2a1ff5", "value": "T184D39EA7B30F2450C42507F41BCB5BAD2A3325018E6B96E72C6E363E5A775DF68063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245715, "uuid": "88107cb1-1a11-4389-b5ec-8a90755ac9a6", "value": "3072:VnMJ0iUxXH6MPWEKmlAdQ385UXcgqCjLgF0rq:Vndb6/EKitsaXACjLg4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245715, "uuid": "b1affe61-1dd7-49d1-b738-8fa2e67ee9fc", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245715, "uuid": "d01e1802-a8af-40d4-bb19-efee408829b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245715, "uuid": "5f37d941-0a64-4fbe-82dd-31478e264f7f", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbe657b-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244095, "uuid": "217577a7-c987-45b9-b08e-f67089321099", "comment": "Malware payload (AsyncRAT)", "value": "1c7efadc9c9e44bd6c5468299ffcca6a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244095, "uuid": "65bf1759-5c3d-4c85-8040-11ebc909b9a2", "comment": "Malware payload (AsyncRAT)", "value": "39372952a0ca56656f0a9c5070d421fdec8f8bb424e6e7b96a69a9387c7a259f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244095, "uuid": "111006e1-2f6a-4c9a-81bc-720c93708c37", "comment": "Malware payload (AsyncRAT)", "value": "06e341402cfbfcee351899631efd4a074fe27ae8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244095, "uuid": "c46a9fd9-35b8-404f-bfda-a73e98961616", "comment": "Malware payload (AsyncRAT)", "value": "ec2815971c34c71998c1be5bc9d3aefb331801f4335ecda866f11248d6ae44765cb03204232cd574794e27731d50df1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244095, "uuid": "9daef800-87ef-41a1-9880-54acaedcee05", "value": "T12E15E0523A2FD982F8980F7015A6FA7947627EDCB400D2069ED8BED777F2B563416302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244095, "uuid": "68925b62-24e9-408c-8268-88c1145b74d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244095, "uuid": "b83d68f1-6927-4431-8738-e708e9dfc350", "value": "12288:dpHYFp8+DbFdr9/OI+GhqKyTURMU1FMBFILDUPy+IW4qvttw/f3V63yIL1MmoXHz:XYz8+v9H+G7y4RzARyRWa/V4LGmS5G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244095, "uuid": "2e8a7868-e0a0-4228-a611-32b26609a51a", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244095, "uuid": "5cd89b64-4aa5-4a64-b4e5-6b1f2a5b1b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244095, "uuid": "31798510-6bdd-44c9-88e0-629e727a507d", "value": "39372952a0ca56656f0a9c5070d421fdec8f8bb424e6e7b96a69a9387c7a259f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9409db-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778244413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244413, "uuid": "94e2e29a-d350-4273-bbf7-c4bee2c22c7a", "comment": "Malware payload (AgentTesla)", "value": "f5f4f64143fbf784cd267330107cf509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244413, "uuid": "f75c87e8-9911-42d8-bde2-d22bd009146b", "comment": "Malware payload (AgentTesla)", "value": "394eef4c157e698bab54305b6c37dbd6d068685e6a559b771d42510c41046c6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244413, "uuid": "86db2e20-3e56-4d87-aa40-635bb1e8809e", "comment": "Malware payload (AgentTesla)", "value": "5b9d3e40569616a9f051445674705d4b3b3417bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244413, "uuid": "9e4d4684-d833-473b-9c5e-9d4d03ac3888", "comment": "Malware payload (AgentTesla)", "value": "8e888e511389ff5dd79108e1887c0754c4059b15197c04f8209c4bf86903f3e001260b41f49fe4dae9de4f3df41a438f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244413, "uuid": "028629b7-085d-4f9b-ab3b-7930065ec637", "value": "T1E035BE027381D062FFAB91334B5AF6115BBC79260123E62F13981DBABD705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244413, "uuid": "a786f41e-b382-41fe-9cd4-0e1aabbee4d1", "value": "c1ce208b1192bfcf652c179f34f034d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244413, "uuid": "d2473a35-92db-4068-9269-db1c50820ef8", "value": "24576:s5EmXFtKaL4/oFe5T9yyXYfP1MAXDzGgAjCrN1au:sPVt/LZeJbInGizGFeN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244413, "uuid": "a184670a-d02f-45d1-ad54-2a3e9dbaf068", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244413, "uuid": "4fc3fdae-bf5a-4e95-9bd9-d591be4f483f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244413, "uuid": "6f706a42-deef-4b82-88b8-d9d67c8c76d0", "value": "3a6a0ab3db459924004565bdd50e5882bd5ea586174f525ec7e60b363ac6809c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e8c261-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233227, "uuid": "af5d9936-1c86-4b03-8669-8665075665df", "comment": "Malware payload", "value": "6e743f2d73f3863932889f65efa9c5f6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233227, "uuid": "53d8f667-6671-4cdc-8f9e-7f4b5c7ab589", "comment": "Malware payload", "value": "39c54636a6f3bf9d4c64607750a59d940db4f4106c8e0b6af05c9fac8e445761", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233227, "uuid": "a0fce3a1-9478-4fd4-bdbc-972c7b6d2f25", "comment": "Malware payload", "value": "8d580610e33065e4d585d22aae046ed2cb4f8ea8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233227, "uuid": "cd0cfcc9-2d32-4684-b078-a7e8e6ae8dd1", "comment": "Malware payload", "value": "1489b2b10673d0b9450127e47a5a04660253101b813d9f41b091ddbd3427aa1fcc8295c3eb184307b74ee225ec7c8b2b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233227, "uuid": "cf225a05-fd4d-4515-b072-9d88056f7413", "value": "T1C407CD23F50569A6DED6E135F5E707A136201D580793A22D271FF026FDF21CECA62AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233227, "uuid": "df224b32-7427-47ae-bf34-0e2a39e46ef4", "value": "393216:C4a3iPuOYYsFFVKMGRn31c5tZFMoTZ+UJTF8:OVOgLGRnqZFMSx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233227, "uuid": "674855b5-28be-4342-a955-269e4e48c278", "value": 17888847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233227, "uuid": "434ee871-0b10-4dd1-9621-0e866bf90419", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233227, "uuid": "3a3bf0d9-4db4-48de-aaa3-2851453d9908", "value": "iMobile Lite (47).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b60b160-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244651, "uuid": "bf0866f0-135a-49d3-a740-a9d5a72ff7b2", "comment": "Malware payload (Formbook)", "value": "56ccca2e38dda7685d6addd1a41e3c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244651, "uuid": "1fded8d6-c5b4-47cc-9ad0-321b27b742cb", "comment": "Malware payload (Formbook)", "value": "39fd8f3f3b2826c260700fe581af6a48d1d3374e4d80b41ffc6442df84f52a41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244651, "uuid": "ba71bdf3-2667-471a-8aea-ec831f6e1b82", "comment": "Malware payload (Formbook)", "value": "9f60cdc5e702114c0f803a8e6e07679160d491cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244651, "uuid": "609b83cf-b317-465d-b255-7460d9c48fdc", "comment": "Malware payload (Formbook)", "value": "e7b82c1f850a4596b64632422fdc65365536d90a2a27abf9347dc0ac63b6c346e258e70bb69aa6886b369a5be20aca85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244651, "uuid": "885f9078-e312-491d-883e-c30f322b7012", "value": "T156351200267BCD02D0BA4BB944E2D27407B9AE8EE422C5879FD93EEF7936B9155C4347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244651, "uuid": "aa89368f-e919-4da3-b576-c52aff9591b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244651, "uuid": "8a55dc1e-7966-4d48-8691-c04a97a0d0fe", "value": "24576:gLXAo8M0gCub9gNnpxmfBix3TLYOBZMvX5dPBj1JZbRA1xrsfKHXR:OhDpxgbSBixj0QZMvXfnbRImi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244651, "uuid": "01d4b563-78d0-46aa-a126-02430dc69943", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244651, "uuid": "2bc2c5ca-0f6e-4649-9dba-3882a36a43ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244651, "uuid": "d8a9bff6-7743-4fe6-a3d3-4b2f8f9aeb50", "value": "39fd8f3f3b2826c260700fe581af6a48d1d3374e4d80b41ffc6442df84f52a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82f1966-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230231, "uuid": "c84b1605-db66-4238-8e44-285b9a4b265d", "comment": "Malware payload", "value": "fff26fa7c4ea36c30da2c28f656c81cc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230231, "uuid": "74ce26d0-8d5a-49cb-bcdd-67dffba5981c", "comment": "Malware payload", "value": "3a5b77deef28935b06d6ebd4c82643b921a139f66244ef260a1abfc6b215327a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230231, "uuid": "4b538cf7-a862-495b-ad98-f6f287fb24b5", "comment": "Malware payload", "value": "2ecc7bdfbe8fefce84b199ee03ae08a4cd5f4acd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230231, "uuid": "5ddbd011-7848-4342-a676-95c8ff6aa18c", "comment": "Malware payload", "value": "af2a63242c86cf215893e3e8cf03acecb351206ea7701f893df1270784205f59201e3735bb77be40b8b5d48cc860bd27", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230231, "uuid": "63bd731a-fbbf-4b80-8311-cc42f6eb5460", "value": "T143673343F7C9445EFDF387350B350222A85A9CA28B6782C76964367C2437BC459E2FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230231, "uuid": "7a176632-1cc0-4c45-80be-f534b70438bd", "value": "786432:rpOg4tTlP/lCZV7TPiWQEhpcntn4g4UWonWyGoQfxC1:rpxklwZVGEh6D4UWoZGZfxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230231, "uuid": "0d18a2f9-0a8a-4983-8d56-fbe27588dadf", "value": 30066200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230231, "uuid": "f7f33939-c1a0-4919-a92b-69885142401a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230231, "uuid": "703775b7-e710-4548-96e8-869bcbe3d834", "value": "ChatKaro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14deee2-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243883, "uuid": "dd2d3cd8-7e4f-4b08-83b1-90e55b166bcd", "comment": "Malware payload (AgentTesla)", "value": "efcffed253c276853946a3f9278b9d97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243883, "uuid": "8f56f26a-8012-4bd2-ae9f-fa3a140562c3", "comment": "Malware payload (AgentTesla)", "value": "3a6a0ab3db459924004565bdd50e5882bd5ea586174f525ec7e60b363ac6809c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243883, "uuid": "a3e3ae42-c413-4476-a3d2-bb12054a530f", "comment": "Malware payload (AgentTesla)", "value": "b6e44afd81e1e5fd209e882ed2eedcc3040581ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243883, "uuid": "aab143f2-c466-4f79-b9f5-dbf0c0131bc2", "comment": "Malware payload (AgentTesla)", "value": "3b5d8b6fc2b0691e267fa6c54e625f302a4b6de9e3a2e15c23a1a96b9f30bf8189264738f1d1e25893e416d47484ee05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243883, "uuid": "712386b7-854a-42b7-ae65-886b5a5eac20", "value": "T14FD423829591A991C200B330C036CCA095797971AD05763F8B2DE6BBBC757C3EAB7B4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243883, "uuid": "b719f8d2-c005-4d61-88b5-5fe04938d7e9", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243883, "uuid": "29c88fba-72a8-4266-bbc4-6169bd44669b", "value": "12288:0z7hU5I5yuNHIgzSFKxWltRohBfSTso93UcKNAXDZFCllN46swVuq:0f+iN57Gtene3sAjCrN1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243883, "uuid": "aea4de8c-7d69-4f9f-892f-21154a3ff3a8", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243883, "uuid": "634b8478-0039-46b8-9e6f-2725c9a32d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243883, "uuid": "eb655006-2175-4236-b39d-03580eafe55e", "value": "3a6a0ab3db459924004565bdd50e5882bd5ea586174f525ec7e60b363ac6809c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b252aede-4ad4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778241281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241281, "uuid": "0edd690f-69bd-4686-9ff4-893b5d2ceef7", "comment": "Malware payload", "value": "6d7d65ead068d85f06a4a9c0c2da0cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241281, "uuid": "254b7f14-e069-44b4-9fc7-1c5fff36ba42", "comment": "Malware payload", "value": "3b55733eaf68fbb92691ec5df6192f90a2467feb8ac8581f4123dc13752e671b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241281, "uuid": "28166651-591c-4232-8d4e-755cf9f8201d", "comment": "Malware payload", "value": "260b7b8efa59c85039aeb19782345f386c034631", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241281, "uuid": "575fb418-5238-49c9-9215-c16d2ff53b4b", "comment": "Malware payload", "value": "dbb7dc6f3a4d31ca93b8943dd07cb3eb80b503d7a600430caa5a8150cbcce661c0fdc542661f1617844a0e0bcee423b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241281, "uuid": "4d33aeec-1121-48fc-806d-a7dad2142425", "value": "T19582F61767BAAE97C0D0B7B701930363E1EAAB945660831F7E094C8D1EA9360186E7D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241281, "uuid": "be92bc57-d855-4317-bbec-2db435f5cf27", "value": "384:cJCNs/ziez+SrlOnr6BV1cW8YI2ZZ83D4:cJCNs/ziez+SZOr6BPcdYrZZ8z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778241281, "uuid": "e94cae30-5e3d-4da6-8dd8-fb5239981124", "value": 18624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778241281, "uuid": "15325fa1-3639-434e-a468-609e3a09ffa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241281, "uuid": "e66a0f95-9e89-4fe5-8ebf-cb47cd91736a", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e5730-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233204, "uuid": "55a6ce4b-a23e-4577-90be-3ae0353ee613", "comment": "Malware payload", "value": "3c7ebd025d6810ba221b758d1776b4fe", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233204, "uuid": "189cee7c-6949-418c-a0b8-8497443a8972", "comment": "Malware payload", "value": "3b64eeacacb94d70d498988fe8c6dcc25b133bcaea37fb69dc6f0cc26bde9921", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233204, "uuid": "c1ae3892-3c33-471a-b59e-c91f0141cc6e", "comment": "Malware payload", "value": "db87d9043ce0375e42957ce1d2120921582798fb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233204, "uuid": "ffbe5b55-4577-493d-ba9e-4e701c221f88", "comment": "Malware payload", "value": "51c040bc5e481d8fd8e48389f81bec7746442d63ca3d73fa5080d08d9eee422f6f9d254bfc593663ba46e9564cb91817", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233204, "uuid": "5af3d8af-c25e-4198-a797-11e31536e237", "value": "T1FC17DF63F244699ACDE6A230F4E307D132260D514783A76A571FF136BDB31DD8E26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233204, "uuid": "98898bcc-c875-481f-a383-3e46ea7f871f", "value": "393216:BtWCCxnf64LQ88zXznUNMP5BObpIavaUuj0Bjib5MDr2i3F6vwi:wnfxKjkyepTa1jWj8MDVF6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233204, "uuid": "c19328a5-c998-46ac-89cf-d46f13c9c0a7", "value": 20287914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233204, "uuid": "fbe6020b-a1d8-4215-912f-1b296b3d7f47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233204, "uuid": "8ba5ca84-e2b6-4a07-a104-1887f9200856", "value": "i Mobile Lite (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea29095-4a8e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778211156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778211156, "uuid": "0abd8ae2-144d-453f-9af3-feb8bbe14e20", "comment": "Malware payload (AgentTesla)", "value": "392f092b229292d9e32c8934a7f520c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778211156, "uuid": "b2987c71-2b9e-4f80-8c3a-0896aee88be4", "comment": "Malware payload (AgentTesla)", "value": "3b96167959ddd108b31c16133b1806c4c8815e7be647b7589d85e293b537cfe6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778211156, "uuid": "4421b2de-d786-4987-9644-9b1b8571a6aa", "comment": "Malware payload (AgentTesla)", "value": "d16d145f089fd1c5c9c77e8a567d15b1bd7c816e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778211156, "uuid": "2c6fca7c-d1a5-4f36-b3f3-8cf27bf92ecd", "comment": "Malware payload (AgentTesla)", "value": "65ad6a9026937b641ec0f3e97359f17b7409828293c0d55fb61a57b35175a90f1704d0e6bf0c87958bc8878eebc9fd12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778211156, "uuid": "7cb83691-9f74-4de6-9fb1-14ecaf628fb7", "value": "T14A259DD486431B14C36E0275D16A6A1D93F0EF42A26BD31B3ED60AD45F83BF5E6832C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778211156, "uuid": "6e3fead4-5bb5-480b-9c31-4582520df3a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778211156, "uuid": "0242a610-2698-4dc3-917f-c7f4eab7420f", "value": "12288:EWrSFoET2+botpuJSOkH5ugthDBiwEzgbkNEQCvoGFvBGtYXY2:/SF/FvahDBiNHEQCvoGF4YI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778211156, "uuid": "22a82178-ea47-4b33-859d-2b19923b4aa0", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778211156, "uuid": "61d4fd38-c775-4d99-a4f9-fba8e6a7bf8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778211156, "uuid": "9a7b7688-ff4e-4953-a16a-c0b465202ddd", "value": "Comprobante de pago (PAGOS DE LA BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf4648d-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778236225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236225, "uuid": "120bf3ce-8a78-422c-b523-5de8ac45db96", "comment": "Malware payload (PhantomStealer)", "value": "bd7f8ccf2595d083075618bc5678e55e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236225, "uuid": "6dde320f-dc5d-4b1b-a80f-0b7db36e0189", "comment": "Malware payload (PhantomStealer)", "value": "3bb20c96cfe0ccb44a4ae87bd993bc7140367dbf1c72fa0bccb4bffbca289610", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236225, "uuid": "859c15a4-a265-46cc-8efc-a06c9d7f9461", "comment": "Malware payload (PhantomStealer)", "value": "4e3acbea32cf696449ab5c260fabfafccebcd2ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236225, "uuid": "40a589cd-6527-4604-882a-43acf79bdb47", "comment": "Malware payload (PhantomStealer)", "value": "bb2e67cc015e5bd561905f14c3f7a1c5582c4c494ee1d0aab6b81d310180d893d236ebb5dce340b98e31d53dee237f6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236225, "uuid": "23ffc059-4aa1-47c6-a740-923832a63761", "value": "T1EB73B8C839CAF4A6039270B7992BA057F1ED8C80B80CC555FDD5645DB8AC704EAB6B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236225, "uuid": "1fa26a67-1a8f-4c3c-9d0f-e9e04673f356", "value": "1536:xwjvr8P7k3vH9BctadF66wWYuGo1Njptpws7/qXbpESGoXwMvbCj5t:CjweQIFbYFo3ptpwESiSZzvbCj5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236225, "uuid": "12049cba-9a02-4c63-a77f-64fb63e4ff0d", "value": 78240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236225, "uuid": "99efeffb-f500-4db5-8e72-721ec1fde6c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236225, "uuid": "0e28a561-b17c-46fa-b03c-828b5cdb9e4e", "value": "NB26040104 TPL-TELEX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff6b6f3-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242592, "uuid": "6025e77b-f31c-4690-ba65-e172febef73c", "comment": "Malware payload", "value": "70f6ee30c0aeeebe03b6a8316c804df4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242592, "uuid": "32781ddb-2ea9-4b47-a3b5-48cc27ba426d", "comment": "Malware payload", "value": "3c2dac32bd15ee2968d88e3addb49eb3ea30e7d7714a60adef9a77521ca90c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242592, "uuid": "6bedf14d-ce48-491d-9652-88c7e58add9a", "comment": "Malware payload", "value": "f5fa79f98209e3ef846e3c4cd945cd52c2c330e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242592, "uuid": "8cf2f06b-159a-4d4a-8134-92e824058f94", "comment": "Malware payload", "value": "3bba72afe60b4ca5327a83168b84ee57e7b522b30e4a20584f57352976ec4c44baee53c66ac3f643558bfbf95546695b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242592, "uuid": "4afff995-9d4a-4bce-a0e5-19c4bb7573c7", "value": "T159C44316EA51A02FF49389B0797995467C292E321680EC5BF7801FA570B0ABBF1F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242592, "uuid": "aa3e19a4-6e85-4192-acf9-dd954b972f68", "value": "e7dfcf4720435244500531e9d97dd369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242592, "uuid": "4700a76c-9d92-491c-86d0-fb73dcf3dd3c", "value": "12288:uN5HFDP29RDxMNqNKDN/027Us0x1TLiRNn0QLVA57s6rMf45sAmw:yAN6W2Ys0x1XiR057s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242592, "uuid": "7ad62bc0-0f6d-42d7-af63-699295f4d9db", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242592, "uuid": "cf6120a5-4205-464e-80a8-259cb4838e2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242592, "uuid": "1aa2f0f6-8757-460b-bcf0-cdd001a98213", "value": "3c2dac32bd15ee2968d88e3addb49eb3ea30e7d7714a60adef9a77521ca90c05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a82ca03-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778243764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243764, "uuid": "15423590-52b7-428b-9de0-6ec5ffef18ea", "comment": "Malware payload (RemcosRAT)", "value": "07c40b62379f13383da4ed53115961c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243764, "uuid": "86e824ef-6405-4515-9b2c-884c7a25e675", "comment": "Malware payload (RemcosRAT)", "value": "3c365c6a258254175f409494c2c3fd1aa839ab38793440247f1cdb7625709143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243764, "uuid": "e6ca912c-d4cf-47fe-924c-74f46e008dba", "comment": "Malware payload (RemcosRAT)", "value": "cb3b44f302609fb9dc3ba5a04ce867d610db7618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243764, "uuid": "9928fe3d-5a34-4aab-b074-1938addc7907", "comment": "Malware payload (RemcosRAT)", "value": "f65ddae35af29acb82ba8cf7de528a292ee215ec9ef8d44afd2d0bcefd1cfc0aa286d7b33653a5a682e8ea7b04a53531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243764, "uuid": "fca325fb-4d7f-4c38-a180-a6da2accde54", "value": "T15365F1452317DC46D5A29BB00CE0D37007F65E89E422C2638EE63EDBBB7AB465AC4353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243764, "uuid": "a100d677-4c16-403e-a556-603a3b140b9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243764, "uuid": "7925b7dc-e6a0-4b3f-a895-71a6300b55d9", "value": "24576:89utSJJSHwGFky/MvGoV3P0YGzO4ajvI/LEzj1tw2n87J44SqxTYjml5EgM0vNa:WGqUwGFMGnO4aIE1tNo/Q06D0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243764, "uuid": "e55e5d2c-c5e4-4abc-8d89-ae473224f425", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243764, "uuid": "7947e001-a0b8-4fab-9ae5-6a145cb53a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243764, "uuid": "bd393242-9566-44a1-a062-c34fe2b5710f", "value": "3c365c6a258254175f409494c2c3fd1aa839ab38793440247f1cdb7625709143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642e9cec-4aa0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778218816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778218816, "uuid": "a325a971-f185-4225-a713-0af452ef8bdc", "comment": "Malware payload", "value": "91df9dd1024e2690c8191d492eb53368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778218816, "uuid": "2754fbe8-ecd6-4d5a-9cf6-350ee051e930", "comment": "Malware payload", "value": "3c5ffe548ea93622d11b67eead48d50f9ee39b09e1e813747883d1528569ffd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778218816, "uuid": "f11fe25d-6ca6-46e7-8906-3fa1f26de52e", "comment": "Malware payload", "value": "8a72bed1c9fada0ff33fbc241aa338f29661fdf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778218816, "uuid": "a0bb7407-cf13-413c-89da-ec6ee3a1e67e", "comment": "Malware payload", "value": "06589c82ab342baab8e49e24890eb9ad42edf23d31daf63409bdea7d3b99230c0300ca9f2a044519d83afa9ff4d76090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778218816, "uuid": "4a40682d-15e9-4613-87b4-fd8c56ce6378", "value": "T10E16F833A59145E4C2EED574C6256213BEE0389B273423DB7BD0A6E10B76FD4AA78370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778218816, "uuid": "2b1bf630-6af1-4a20-81aa-4580876c0ba6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQv:cqYUQuVDt0TZEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778218816, "uuid": "7312dc55-ce78-412c-a636-abdba83266ed", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778218816, "uuid": "5f86a83a-b85a-4400-ac03-8daff4372d35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778218816, "uuid": "a86ea7b7-c080-489b-bea1-93eca61f83ae", "value": "3c5ffe548ea93622d11b67eead48d50f9ee39b09e1e813747883d1528569ffd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ed479c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778244166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244166, "uuid": "2bfae320-2328-49c6-850b-1fd92e3b103d", "comment": "Malware payload (Mirai)", "value": "19478e6d11b4c830686f155f8b4e4eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244166, "uuid": "939f44b7-b571-420b-9316-1256d0a6696f", "comment": "Malware payload (Mirai)", "value": "3cb7eda2a5dbc995eaea055beed940f61dbd172d19acfe1821c39a3b3e12db50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244166, "uuid": "b8dd064a-ee07-404b-9795-a07599faa657", "comment": "Malware payload (Mirai)", "value": "780314c966021cb02df4e343b933030f8461b0bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244166, "uuid": "1f6ed758-aec1-4b66-b1f0-7f666f5101cd", "comment": "Malware payload (Mirai)", "value": "2a44de86a516e34183193a7ab17a7bd69ff641c88e248bd6b1d155cbf6fcc92e29b0bcc8cc4667488cb9861510588187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244166, "uuid": "c7b56d16-421e-4419-843a-61552a970c43", "value": "T16AE3F7C7F900E9F6F809E73748530806B230F7A248926A777257356EED7E1891477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244166, "uuid": "616bb80a-bfc7-4278-b351-cf75492d80c9", "value": "3072:0c824sWDctu+rhdP4VSFugH+eryYArd0Vp38p79O71wCoVxjbiCLIh4YljUem:y0H1yY6d0Vx8epwCgLKcem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244166, "uuid": "b9ae5f64-2bde-40b8-8721-f96f5bbdea4c", "value": 156824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244166, "uuid": "ccf857ee-7ad7-4cda-8fee-9a2576bb2031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244166, "uuid": "acc7f80e-0783-4998-a2c9-7ddfaadaf86a", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4979586a-4b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271599, "uuid": "a8188e17-ab43-40ed-b584-0cb8834664ac", "comment": "Malware payload", "value": "143a51ca7df8e6c60bf2a6777cdfc0fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271599, "uuid": "822675b2-f5f1-4ccb-b911-576ebc6241e5", "comment": "Malware payload", "value": "3ce4e7a802f232057068b0daac78cc72f810e53e7a1bfb2a825969b18650ca1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271599, "uuid": "4c2c1da8-2129-4b86-9fd6-269df16d111b", "comment": "Malware payload", "value": "8d303957dbc7e7d21b76e2c5cee77ca302a49099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271599, "uuid": "fe99fe71-510f-4091-80d8-a98868a932e3", "comment": "Malware payload", "value": "7488485a645bfd9aad161d1e76e5acc32b09a3734fafe51fdeab5a6cffb8f087638391675db1012fd247f50617fc0120", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271599, "uuid": "2bfa75ea-87b7-4d1d-af7d-a52795afbec3", "value": "T107E3E15DF844EA91C6E32C79F2590E1433930778E6F431019F2F6E68EFA315E4927A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271599, "uuid": "9e3dc902-ccba-4f55-8ec7-c760d22fa26c", "value": "3072:g8icHMgi9Qy9+/OSwYSAc1qjmr1s7UQloep9jK:lr5GQy9+/pRXc1x5s7UQZp9jK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271599, "uuid": "94b76c14-0489-407b-8546-0366d53fedcb", "value": 143858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271599, "uuid": "cd8dfb74-9a54-4925-9557-fe10ef1d10be", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271599, "uuid": "9cfe358d-ecc8-4703-9949-a190fe05e1cb", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bfd780-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778246068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246068, "uuid": "adc51464-b8e0-45b4-93df-16af2c75d13f", "comment": "Malware payload (a310Logger)", "value": "4efb43640db69da9727cb345e8ec68fe", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246068, "uuid": "9bc3b206-1bdd-445d-afdf-f54360204bbc", "comment": "Malware payload (a310Logger)", "value": "3d662b138b29a89660c77a1eab3ce74d4da2ab6016669e1a5209a4b745986862", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246068, "uuid": "b4b00f5c-356a-4ce2-b71a-74ca028bb286", "comment": "Malware payload (a310Logger)", "value": "1cd3923558c483b58c98c404109cb6f9983ac808", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246068, "uuid": "7ccae61f-6941-4a87-aac1-21d339d1113d", "comment": "Malware payload (a310Logger)", "value": "f5d933cda4d7bae09d3647c4220578d1bb56b45ab01de3fcb059e4dfb9d0a4703d050f7c47ead1436eebd78928d22b57", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246068, "uuid": "eb847c13-918d-410a-adcd-561497dbef17", "value": "T16A944A13EB60601EF1A389B0B9B6925A68267D351B98EC4BF3409F1A35715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246068, "uuid": "54ac58ea-2cf6-4dc4-ab5b-8cc463f0b4b9", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246068, "uuid": "22709358-5e37-4c66-942c-cc26273cfdbc", "value": "6144:jf8d1/w5KA81IJ8GpF6nuTmOOUiBUrj1td+ZIvadWFPK7PmwyHfcJLE:jUjYKkJj6GmZUiqrLzaHywyHf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246068, "uuid": "f693110f-3707-40fd-9913-ccb7eff89967", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246068, "uuid": "897eaffe-3b3d-43ef-9c15-7f5861eb3db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246068, "uuid": "5582aae4-4a14-4b39-90f0-87e859dc01f4", "value": "3d662b138b29a89660c77a1eab3ce74d4da2ab6016669e1a5209a4b745986862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85310560-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245929, "uuid": "4da9c467-155f-434c-abc5-25cef02053cd", "comment": "Malware payload (Formbook)", "value": "619f128866c2599d3e6f52797096e424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245929, "uuid": "6b79ef1b-fc74-4761-aba4-84241941dda5", "comment": "Malware payload (Formbook)", "value": "3e33a56a829dfa5136f57bababedac483a8e330ff7256116769c9a3e010f6382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245929, "uuid": "1acc4d96-3644-4c40-a38a-bdc26fe63546", "comment": "Malware payload (Formbook)", "value": "e4a79a28bc028682a92906e689b78ae4781d15f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245929, "uuid": "25299339-754c-472a-86b9-abe9319e450f", "comment": "Malware payload (Formbook)", "value": "b908bf942b7e376cc50b3bb8261a42ed01a4f516524c4be09031e7ee2688dea221c93b82bccd4e3cec9cad387addcb0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245929, "uuid": "bb09f9b2-dd69-4b5e-92af-425361da53a6", "value": "T16D352215A3A8DA16E47A0BF40871D27217B4AF9DE561C2474FD9BEEFB03E7802A45307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245929, "uuid": "f3cc9ddb-bae1-4121-a34e-87c324e107ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245929, "uuid": "2623fd9a-08bc-4404-b4ea-8fbe380eac19", "value": "24576:WhboRr6ibYzj1jYTSIwm7m2lRLJF7E29qmaXX:WhUR9Yx2SIwumOLXH9naX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245929, "uuid": "f29cfcc3-1375-409e-aab5-73354bde3665", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245929, "uuid": "3ec0374c-605a-4d0e-b959-4c4bf349c626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245929, "uuid": "cc2c6454-aa8d-4dfe-a05c-7f029234c9aa", "value": "3e33a56a829dfa5136f57bababedac483a8e330ff7256116769c9a3e010f6382", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ffbc77-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265129, "uuid": "b203c385-3c3b-487c-9187-89b42e5671fe", "comment": "Malware payload (Mirai)", "value": "69833e732a84d90ddbd7d44e2a8b2366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265129, "uuid": "ffaae0c7-d2f5-4c03-85e8-3981f0b02e74", "comment": "Malware payload (Mirai)", "value": "3e5e448c34a593f67e8970c8e103684d02021f580063e186eb98bbe05d483ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265129, "uuid": "16d773c4-3b87-434a-b42a-3c29479aee39", "comment": "Malware payload (Mirai)", "value": "5c458764e53d577b9ece0330e0e72190cb268040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265129, "uuid": "14200d80-e318-49e1-b82a-9dfba44326ee", "comment": "Malware payload (Mirai)", "value": "430088a809daf3186c56f803ee5bc11398f5c0699333e7686c295e6aa8cd5e483941126a2a216ee9b96f8dfff15d94b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265129, "uuid": "4d723270-8d95-46b0-bbc8-c7e42ca64cd4", "value": "T11904971E6E228F7DF6A9C73447B78E25975C23D627E1D644E1ACC2105E2038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265129, "uuid": "c922ccb7-6a9c-4bd2-b3ff-3e2d8f0444b3", "value": "3072:5LFJxJ5z5B+CYAJV3+nAFtvJ9SnCRMbKsmLouqIM64:VFJxJ5tB+CzfXZJ2qMb8LmIM64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265129, "uuid": "d6e0e08f-d56b-46e8-bfa3-e29ce5215f02", "value": 185996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265129, "uuid": "61262656-5bcf-4263-935b-7dbcb22c9f06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265129, "uuid": "6addb230-cb0c-46ea-8142-dabe5f76a1ca", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fbfff2-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246444, "uuid": "a507d651-5c3d-47fe-9fc6-5902a51c9a07", "comment": "Malware payload", "value": "f80ba9a55eb77a449ee9bdb510c44d8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246444, "uuid": "877d8baf-e412-4ac2-9bc8-403b649b28d0", "comment": "Malware payload", "value": "3e88a24b6652ca2b8f6cf55f1f940a27b7f0565c3caeaf3e0b7c16ba19d0f9e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246444, "uuid": "f535b0f7-c4f5-472a-9a2e-9862304807c1", "comment": "Malware payload", "value": "3af0acd7db6c87242b17a75ceb66e3e54220c15d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246444, "uuid": "e1c2b669-8dfc-46f3-b1ad-ed008270b078", "comment": "Malware payload", "value": "1bd7fa54299688d33a25d9af453260cd26233331f9e9f9a1d0f62b3cc1127a3661598363b553229082f7ec38323ef771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246444, "uuid": "d814cc53-898d-406a-80c5-460cf17e30af", "value": "T15F273A22F2648E36C0DE0B3A849B5710A731511A4F53A78712EC9ABDBD8D3912F7674F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246444, "uuid": "f0e640f6-a1ae-4aa8-b0a4-d28ac45a96d7", "value": "1b366092f7b29e3a3dd5fb5ca3943782", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246444, "uuid": "ad45366c-459b-41d7-ae76-41d95cd052c1", "value": "196608:mzsfAnq48y5gMd53x/OoTKYuCQS5SdsaCbGDVT/TD0RylYi:mzs4nq48y5gMHB/LKYuCQS5WsaHEIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246444, "uuid": "b6b7bc95-3e92-4786-8189-338e8281013c", "value": 21400400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246444, "uuid": "1008c81e-f533-402a-a767-2c5fffb80f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246444, "uuid": "1726ccf7-f539-47ce-a402-501853e2ef67", "value": "3e88a24b6652ca2b8f6cf55f1f940a27b7f0565c3caeaf3e0b7c16ba19d0f9e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175368f9-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244027, "uuid": "db597b98-5e6c-4d55-a475-1f774c652167", "comment": "Malware payload", "value": "755b98cfbd4fd1cb54c3a6476af484ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244027, "uuid": "87b81725-d660-4864-bbab-d0997a205079", "comment": "Malware payload", "value": "3fd59a676436603f134431b1fec78ba2d9227a6ce83bdbe18c1c4dbf91098765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244027, "uuid": "9f38a157-7703-4039-afb6-a07ab43a5b51", "comment": "Malware payload", "value": "0c55c656dd25be8750037a22c4dd3ed0b1dd1635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244027, "uuid": "c293143b-553d-4253-8022-9fd511602f8b", "comment": "Malware payload", "value": "43fea78d55d9e46575a65fd5869f99bedb2db4d71267c138797977242e232a71a3dc10bd0091549fdc6a9adcd7252093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244027, "uuid": "48a9dfab-f809-4236-9eac-b7088265578b", "value": "T12AE31211C7940A67F83F9D7C3FBA0A10C4B4D75A3A86DB570BF9655B4E3232056ABB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244027, "uuid": "eedc834c-f987-415e-9f26-6ca93919c96d", "value": "3072:juzq4LL3Avrmtujb2pgFUq4Dv0WjW6Ljbpyy99YtUJM:jYLyms5Uq4DxL5yy99Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244027, "uuid": "9bd7875e-9de2-4606-b21f-d59d4d5d966a", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244027, "uuid": "747f76f8-342c-40ba-a00c-8402a69f3626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244027, "uuid": "751f70db-d806-4755-af36-11acc68a522c", "value": "3fd59a676436603f134431b1fec78ba2d9227a6ce83bdbe18c1c4dbf91098765", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca34997-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236761, "uuid": "19eaaab3-6c75-438d-903a-e48bb561d73c", "comment": "Malware payload", "value": "8a8204df62bba6db459d1f22439d53b4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236761, "uuid": "ca991bc1-37b7-4510-9e49-d08f6bc50ce0", "comment": "Malware payload", "value": "40357c6a326f5e669b304295941308b83af1b7bdedb3c636a7128d28befcf85e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236761, "uuid": "2e36e23b-2989-4abc-aaee-ee8fbc06ef43", "comment": "Malware payload", "value": "efc1f6f51bf13e8b6b385cb562aae7f27ef43a13", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236761, "uuid": "f98b663c-5b45-48e6-a66b-40d4176fe308", "comment": "Malware payload", "value": "fda94f630a96022464c5f153ce51e14495dbb8a55b1d5bc5c7ca2a68b9ee9525942743a034d0eddef0bf5c84a941b709", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236761, "uuid": "f41e72d5-bf2d-464f-881a-80c388f53832", "value": "T169D21D1EDB0B9AA1EBE31893C1822ED39D078017E2B430A7B7571B423266D16DBF557C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236761, "uuid": "9907cbf0-5730-45e3-8781-f4238df594b2", "value": "384:YymZV4KDhhqSfQATnu1l0UFOSkLD+aecVp37wBP02b2:1mL4KlftTeuSkhVp37wB82b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236761, "uuid": "92522f7d-626f-41a7-a009-4e954d3adb58", "value": 30507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236761, "uuid": "f06383ef-a9b2-405a-97a0-12e0fe5db41b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236761, "uuid": "a17da1f6-c528-4a08-b957-27f0b44a987f", "value": "Scan_1_14_9_1524_05.05.2026.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f707df-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778245669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245669, "uuid": "feb9b0a6-8414-4883-9988-c3d1dd066e58", "comment": "Malware payload (Vidar)", "value": "a3e9ae7690c9d8681bbc72696df0709f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245669, "uuid": "65525923-3c58-4b6a-a21c-a4ef35d9f344", "comment": "Malware payload (Vidar)", "value": "40484d2ef6fe139567872b6611a3add15c7b29b7c6add29ac5f4eeb4e5d12282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245669, "uuid": "40d7aea7-ac0d-415e-9eea-93c5a3486170", "comment": "Malware payload (Vidar)", "value": "8834394dac5b89df69e3a989098be31c611cffda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245669, "uuid": "e4f51dab-8bac-4b4d-a2db-8bd1d20d1ab9", "comment": "Malware payload (Vidar)", "value": "16e25b5cd3ba1344d4453674957facebcab21aae713d458f7fde4c3b4218b1f08a93e8b6915600646e9adb4e1f83b763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245669, "uuid": "0c4721c3-78e8-4e0c-bd25-d9dd8b25ba1f", "value": "T13F051257B2A420F6F273837A81654106F3727876076526EF47A493353F2BAD09F3AB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245669, "uuid": "ae35ea1c-82c2-45a0-84a4-c678afc26f6c", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245669, "uuid": "49c8feb5-1edd-4a9c-b10e-68be0bfd88f8", "value": "24576:/eJH6cn0kwiMrzoH3XlyZCM8E3KZIdhx6:Vcu/riXlZM8vChk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245669, "uuid": "e07d1abc-fb03-4f9f-80c6-5a12f2febb7e", "value": 809618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245669, "uuid": "4c68e217-d073-4685-84e0-a47080a19af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245669, "uuid": "e91ef878-940a-4cab-829c-c3226e1a38bf", "value": "40484d2ef6fe139567872b6611a3add15c7b29b7c6add29ac5f4eeb4e5d12282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab70c46f-4acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778239122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239122, "uuid": "ef5b2534-67fe-4ace-b3e0-6619e3214af2", "comment": "Malware payload (Gafgyt)", "value": "54de70f85faaf72cfd708283f20333bb", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239122, "uuid": "a4795ecf-8e20-48fb-906e-42667e7326e0", "comment": "Malware payload (Gafgyt)", "value": "4052a7001455d6fb59a310b2c3ef62230a6ce36d13d1b49ea9f542eddf2590b0", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239122, "uuid": "84c00f01-913f-44e7-a639-7f5f0c081347", "comment": "Malware payload (Gafgyt)", "value": "045fde64aff581830ae45eb8c286fe789c45c1c5", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239122, "uuid": "8cce9cfc-54a0-4cb1-a87c-288e52e9dcc8", "comment": "Malware payload (Gafgyt)", "value": "a054251fa269d84bcf069594e2a2142b7b240362b89ba52389ebbbe967dc4a2dd09c11bfc9499f6ab94245635d7c871a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239122, "uuid": "0e9d9b0d-2277-430d-85f6-01e3f656a7fe", "value": "T1903161CE8491A06389AEEE0A7BB5E998A011C5D322DF2F5DDDCC2828C8DCD5DF125F04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239122, "uuid": "553f7725-9e6f-4350-9d2c-71c8ce9c026e", "value": "48:SptypHApQ15pYfpE7pwrpnuhpzYPpE3pR+py8spXOjpWUz:SCWUAYSGmiaXsmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778239122, "uuid": "1a6d2d53-c2e7-47ad-9de0-d5162525f5cb", "value": 1672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778239122, "uuid": "96448c84-62fe-4fbc-ab91-ba39a15b892a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239122, "uuid": "c88735e2-acb6-4802-bf27-7232938a5bea", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8506fdd1-4ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778242064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242064, "uuid": "e2c300ca-0a23-430e-ac4e-6b1485b579f6", "comment": "Malware payload (Mirai)", "value": "fb751c0e2689b2321c81f279ae22a3d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242064, "uuid": "cdf0b830-7ccf-4e4b-86ad-093627010a90", "comment": "Malware payload (Mirai)", "value": "411197314669d9d769e8acb399dc438e32b53ee3915b341512a37273218c9482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242064, "uuid": "3c332afd-c244-43f6-917e-f62d385b6db7", "comment": "Malware payload (Mirai)", "value": "15a2d55bb7966a743ab7fad5e8e9198d011861e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242064, "uuid": "5a6e3caf-12c4-4fc4-9569-90584a3a1ae0", "comment": "Malware payload (Mirai)", "value": "12779d9c5b32aa89aa34d3c7eb0b686da40e16c9d618ef523c06f07355011183cfd016e2c3666746d2d415e579dc1000", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242064, "uuid": "36a962b8-f1d8-4517-b817-9cdd1d7c4fda", "value": "T180045BA9BA0F6C41F2C2D3F9DE4C87E13E1735E3C7768971781212EDCAA39D95A90502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242064, "uuid": "57b22cf4-9817-418c-b315-3b96d11a12d2", "value": "3072:sN1nrb4BJ0SmTyNjUF9BH5+w67z/g3CVJi4MskdPoq:g1nr0BCSmTAAbBZ+57zoAi4XaPoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242064, "uuid": "15c413d2-cac2-403a-bc25-f5ca3e311bb0", "value": 186352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242064, "uuid": "344339d2-18d0-4ddc-84de-87aed43ac6b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242064, "uuid": "b5cdb589-7b62-4f28-a821-33f7c5738bc0", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c31987-4b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271598, "uuid": "a6cc5c99-d0c9-4b08-8daf-4e5ecd463150", "comment": "Malware payload", "value": "41f52cac088f046b846c5da25bea5c18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271598, "uuid": "f9249b0f-8c67-46f9-bcf7-c941746e4b11", "comment": "Malware payload", "value": "4118dfb58134d4148bf02249c3d7bc48a3ed24958b672e6233dfd27bef24cb17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271598, "uuid": "fa5c9a70-d4d5-4bfe-b47c-8f452f390a5e", "comment": "Malware payload", "value": "7513520f2e74cdda0da06283e2104b3deaafa864", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271598, "uuid": "8644b530-bd1e-4b43-9e0f-c2e678205dbb", "comment": "Malware payload", "value": "a86d2ce9c58f2476ed38c6da96d0fb2c2192a2f75013c930ebc38d2c5b41b462371e222be0df6f412d83f5022d5b8281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271598, "uuid": "18d3caf0-9d2d-4169-a140-a66b5996a79e", "value": "T12334FF56D5C50393F18C8530AD1B03D181CBB6A14DF66AF4016AA2B99FA97BF723F18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271598, "uuid": "00dd34bc-dae8-4d5e-8bc8-1519c1e24e62", "value": "3072:8Kayqyf0Xt0/GoeLcE1uwaB/jAgtc90aP+1wmxUq:8KadQoqveo3rUUc9rP+u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271598, "uuid": "825d90b3-0c51-44d7-a8de-cf45079a98b3", "value": 245142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271598, "uuid": "760de802-5e6b-4bbb-b864-5107818e5586", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271598, "uuid": "d622da2f-62ca-4090-82f7-9173b01464fa", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8b337c-4aaa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778223282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223282, "uuid": "9bace0c2-d789-43cc-92bc-7de7587f258e", "comment": "Malware payload (Mirai)", "value": "d298efe4aa8ec6026650cc546e0d122a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223282, "uuid": "ec93a1ef-2a32-44ce-ae48-c2b888ea9652", "comment": "Malware payload (Mirai)", "value": "41605196310ac197c72d9fdd9f345065378f1a69f86fab4e4dab1b168ee4582d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223282, "uuid": "d9a47a97-e4e6-4619-8c6e-feb2bbe2286e", "comment": "Malware payload (Mirai)", "value": "f2d9f61d4b8552a5e0f372c480b37b405ce7c8b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223282, "uuid": "de6aa0c6-b333-4b2a-812b-f77711f676ca", "comment": "Malware payload (Mirai)", "value": "e28d6dc1844f56b8ed393298437790e07afee135dd77514db52a746a3a5376d9aaa116b59c828b14c5259d025157dd21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223282, "uuid": "c80b4be6-ca55-4691-bf7a-d85813354af2", "value": "T11153123B1A68802DC434CA370F1CCCE187B641688B308657E66DBAAF2E41E09F550F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223282, "uuid": "24ce3186-60ad-4879-8a61-102f5648a5b0", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77SshPOm1AQE:cSn9jaBybw6E4yUu707bhPOFQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223282, "uuid": "801fb32f-b0df-43f0-a570-b7cad5153605", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223282, "uuid": "d2cd56f5-6ab8-4888-8417-7186e967398a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223282, "uuid": "054d0a81-f4e8-4513-b6d4-30a536af2b19", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfd0d6f-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (DonutLoader)", "timestamp": 1778243713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "36f5eccf-171b-4926-9cb7-bf1242372573", "comment": "Malware payload (DonutLoader)", "value": "7cc5226761b725e139dd14ae4d4fa4af", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "446f2069-b244-46db-97b2-453b4faac019", "comment": "Malware payload (DonutLoader)", "value": "42121d4c9fb3aa647c81e5c035fc5bd3836f9802a42c229573fedca524295b3c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "aaddb4e2-cab3-4a3f-9dbe-eb64fdecdae1", "comment": "Malware payload (DonutLoader)", "value": "f9d62a19240efba2abd25c8ff568d3097a8b3a37", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "bc2d6895-465b-4c0f-880d-5759de391f7e", "comment": "Malware payload (DonutLoader)", "value": "8b7d59b99575d548d7a3d3d29269ace76702f2faf52e879d6f6d58444fdc5f70fc2d2006e3242be842394a7742425658", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "Rooming-List", "colour": "#D77C34", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "d3a9133c-fc1f-4568-af02-b7d63de37f4e", "value": "T15EE3121CA95B251983780F7C963F5CF10DFC0CD337674AB6A662175AA3124CAC5C32BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "af9d85f9-63d8-4093-a82f-ffe9f12dfb01", "value": "3072:tK5kj9zEqDWDaEL4Upazq8eWo4CK+PedTfpidwwAqdlC3MgCK0HDl+ovj0:tK5kj9zDzEzhR8CK+2pYdDAolC7ul+WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243713, "uuid": "e2779de8-2090-4b72-9f0b-d4bea9fbc582", "value": 146503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243713, "uuid": "94d421cf-a8e8-425d-8eb7-f464037b2d5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "531ab081-398f-4e7a-b9ce-95602e1077f1", "value": "Rooming-List.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c77d581-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778243713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "e4909754-a548-4ea5-8d17-e46b7b809598", "comment": "Malware payload (DarkCloud)", "value": "c28e8dab2b7f4983b3e317d3b0fa1c99", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "875f676a-7aeb-4efe-a827-27f270593af5", "comment": "Malware payload (DarkCloud)", "value": "42200039878f1ad513423aa0f40ad3de528221c20aa6343917d2d032960fc8c2", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "281ccabf-10a4-4d09-97cc-248ce25598f3", "comment": "Malware payload (DarkCloud)", "value": "61b0387c21eb858f22eb7accadeea065025e05e1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243713, "uuid": "7d161516-6b5e-4902-a8ad-d8cfdc7d2821", "comment": "Malware payload (DarkCloud)", "value": "d83e27d9f86726d2ff1735ed93208d3e10a25f528ce46c13c95627706a64db9aa661328a4bf138af45da40ba74085a40", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "b5708afd-7aca-4744-8653-6295601ec396", "value": "T12C4501412255EF06C9B71BF41D70E3745BF59D85A422C3178EEA7EDBB93AB01A808783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "72d51f29-f415-49fa-9fbd-0853e80c83d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "81db959f-0536-44db-a132-9785cac46e61", "value": "24576:rSJJSHw2PomTNS9sX2xc+y4cWFiAG8mcVKpfrkZ:rqUw2zUOTZWF+8JVKhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243713, "uuid": "ee1fcc0b-19ac-41dc-a818-b866d320948b", "value": 1276416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243713, "uuid": "926c5b5f-81ad-4503-827d-86ec378b2ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243713, "uuid": "1256df5a-8e41-4b9b-9d56-c0512907fcb5", "value": "42200039878f1ad513423aa0f40ad3de528221c20aa6343917d2d032960fc8c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3aa550e-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246544, "uuid": "5bc9e5cf-8582-4704-9c7b-5a32e2b7edf4", "comment": "Malware payload (Formbook)", "value": "9130be610de0d99ea8028565e4ce7ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246544, "uuid": "38859b4c-821e-43a4-bb22-68b9af6dfb27", "comment": "Malware payload (Formbook)", "value": "422417f778a34bff725766b860c9fc4eba95c03919d428af795c48e34be20980", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246544, "uuid": "9c746c0d-a01d-478e-9e05-37d013b9e59d", "comment": "Malware payload (Formbook)", "value": "7f00b61b4fdb0413c05d94c16b79f64488c6c6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246544, "uuid": "44629194-5a02-4ee4-8294-ed6602938c09", "comment": "Malware payload (Formbook)", "value": "127112c11a55bad2293dc9f9dcef8428e537a02bf1f0110d29cd85ba5d359d7f404a493b12d7c6b7e779e9befefbed36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246544, "uuid": "db0c32f9-8e3e-48f5-8bcf-52334e2922d2", "value": "T15C542315672592D8CE648775EDCAAAE9FE5116640038EC0BBBDD4C9C573C3CB78F2601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246544, "uuid": "502eae50-1454-401f-bb1f-9306427a450f", "value": "6144:igbV1mYp3xxYAz1TKjrtR2JTzBkmWtizB/x5sB:i4yYp3x/ZmjDeRzB/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246544, "uuid": "e9d4538e-5acb-4f36-9253-25d6bece9069", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246544, "uuid": "dff50357-5d76-409d-af6c-7d68da06d25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246544, "uuid": "638958d5-a197-4a35-a2a1-66f7a9d908eb", "value": "422417f778a34bff725766b860c9fc4eba95c03919d428af795c48e34be20980", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6950cf-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244408, "uuid": "f4b0351e-288f-4a8a-bea4-a18550d854fb", "comment": "Malware payload", "value": "1fda5a4b75ebf709b71a593290067f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244408, "uuid": "e3017f0e-0ebc-4840-a578-4d51f68fffcc", "comment": "Malware payload", "value": "423f74b81ea9daa882d3e4852f16a8a92a91d0f14713c23d900b5fe13657f2d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244408, "uuid": "ccc4ea36-e50e-430d-833d-23c332b877db", "comment": "Malware payload", "value": "de44bf00657eed3ab9db97a85b1a8d3c6c819610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244408, "uuid": "67651030-ee32-4eb7-a6bf-cd3844c82335", "comment": "Malware payload", "value": "9864392b3e526da01bbbca6f8b5f13c58c5468bc2952a56ba5206f2fb1159d6c0113e7d1658c84191ed6a7346cd2badd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244408, "uuid": "51ae9efe-2d14-43cb-8524-c1550f9b021c", "value": "T1D1C44316EA11A42FF4938AB1797965967C293D321680EC5BF7801F993070AABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244408, "uuid": "ed3a774e-7994-4b4c-81e9-1c7fbbfb1add", "value": "f3df418b2e93748e46e1e51fb4792363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244408, "uuid": "15ef9434-9b83-4e21-a489-c8588528ff01", "value": "12288:8f14vhmMsS0pe26QoeyOwl42E68WBW5xZiDEcJqruDBnC8ryN:8fSF0g26u2daZiDyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244408, "uuid": "78e7944c-30fb-435a-8eed-9feece9e02da", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244408, "uuid": "cb1cbf4b-8cdb-4a66-9464-30322a17091b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244408, "uuid": "cf848a32-f2e3-489e-a9de-47900fc6b862", "value": "423f74b81ea9daa882d3e4852f16a8a92a91d0f14713c23d900b5fe13657f2d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88f18c0-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244271, "uuid": "112906d3-282a-4ff9-bb24-a28126d01bb9", "comment": "Malware payload (PhantomStealer)", "value": "948f9d53a3e2ed686295eefa976e68e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244271, "uuid": "53ad1fdc-cf26-41b4-97c6-3f4ca3952df0", "comment": "Malware payload (PhantomStealer)", "value": "426643e8f149ddb797b7c2982dea1d7900698308cfd4db42aa77e1266c1cb022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244271, "uuid": "eee17a72-0d46-42bf-bb8c-2fe043757a88", "comment": "Malware payload (PhantomStealer)", "value": "c4ad12d3b1cea2c0d9010ee2794d2f01a30a833a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244271, "uuid": "4e2b773f-e0c6-4630-8f61-f5cf659daf5c", "comment": "Malware payload (PhantomStealer)", "value": "e9af3cce64676070b50a908686efc9721e705e359ddbc5dddb4d62ed440d996e251d5552720d46fd5d9fb6c12ae96d7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244271, "uuid": "eaf45c53-ca12-4f65-a4ee-7dbcb33b1dcb", "value": "T1416522847B4DC401DAC60BB455E5E6750370AE4CE923D30B4FFCAEEBBD2AB666C44642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244271, "uuid": "7de2ded4-1c7a-4885-a6ec-fc613d724758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244271, "uuid": "e42f3bac-02ec-47d6-b488-bd5483382899", "value": "24576:tLJhNG3W8+v9WCZx/r0ZBJpKNDT2q9RRKM8zEQLX9kPuCrSRWeirc2QutPYaB4m:tLJh/vQCT/reH8Nb/RKrzEQz9yFSR/in", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244271, "uuid": "891644f3-4025-49b3-9bfc-6f2fa3098828", "value": 1542144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244271, "uuid": "57d78660-f969-4268-9759-6a555f3de14c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244271, "uuid": "90efce9d-6dfd-4db5-be0f-ee83bd4abfa2", "value": "426643e8f149ddb797b7c2982dea1d7900698308cfd4db42aa77e1266c1cb022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4144f352-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233789, "uuid": "3cbc404e-3e4f-4b47-8518-474e227df3a5", "comment": "Malware payload", "value": "d36c142760a15ce6423cfc54175e7639", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233789, "uuid": "c8939441-cf85-4fa4-8d27-6cfd6cd982b3", "comment": "Malware payload", "value": "42717ed47c5fcf81e6b905e4a4e0f34c472f1a134dbceade406e3e3bf8d21800", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233789, "uuid": "3a640dcb-f69f-4d7c-a7b8-7111e61ea993", "comment": "Malware payload", "value": "5446e20d58b00c036bbd73f803c7961509b56ad6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233789, "uuid": "9adad298-22f4-4695-b086-7743339ccca2", "comment": "Malware payload", "value": "cccf1535ccf5636e785dffe426ce039d09ae3e98aed809c063b2b5c4e3bc9eebccc0f40a32b814993c71815fefb90fb8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233789, "uuid": "21de45e2-c8a9-4147-9fa8-5bcf512e7f68", "value": "T19407CD23F6056996D9D6E235F1E7279132301E440393A279171FF02AFDF25CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233789, "uuid": "a6015c91-d5ed-457d-8fd3-26db05f64ed6", "value": "393216:sjYpbdiEwYkTI9bcjTfdyzYiB9n7fBk/Gqkx5E:7Mc9QXIXZZk/GPfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233789, "uuid": "b7fe131b-a237-4fd2-82d8-5bf38bd0065d", "value": 17647186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233789, "uuid": "b6821471-79f5-47f1-9ef0-50e15e33ffc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233789, "uuid": "e2884a94-fdd3-4fa7-9707-39fbf24d45c0", "value": "PNB ONE(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017d616f-4b01-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778260311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260311, "uuid": "0363a432-a4b3-4fe3-a3c4-3d13b321c939", "comment": "Malware payload", "value": "3f3ed331f7e105720955b7e759b6f145", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260311, "uuid": "bfc485f0-21fb-4072-a1b2-dc9f23698507", "comment": "Malware payload", "value": "434b4bd4fa61e03e74cb82fbeaa2e75b80c0bfb42a7ef916a71375267cd6a5c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260311, "uuid": "a4e9c8bf-a7f0-4b6d-bce9-b5f5e380dd63", "comment": "Malware payload", "value": "14f66ae00620c0ecd02e87abfcef11ce5248e9bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260311, "uuid": "11ec0f63-d261-4cae-9e36-394004302494", "comment": "Malware payload", "value": "8142387ae275de52662712c39bcde0f1d8dd45395654d53692a7d679f569718c8791168fb03be3904cb717daf96f19f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260311, "uuid": "d1b9a27a-ad54-4494-8e4c-169fb47ccd36", "value": "T16B75F657E89590F4C0EFE074C726A217B9A13499473437E36FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260311, "uuid": "a3b9166c-8a94-428d-b2c1-5eb782c3d04d", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+cleR8ddEG5T:c8nxDgC7g9rb/TBvO90dL3BmAFd4A642", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778260311, "uuid": "c93763c9-0765-4400-ae87-674c14472504", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778260311, "uuid": "24a11024-0892-4c3a-8647-d4b375b9499c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260311, "uuid": "d9dca657-02c3-4202-a10a-c01c72723913", "value": "434b4bd4fa61e03e74cb82fbeaa2e75b80c0bfb42a7ef916a71375267cd6a5c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeceabee-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236550, "uuid": "952a6b32-d101-4f27-8246-ac8e4d74d18d", "comment": "Malware payload", "value": "d57ead4fd57ed57bcb347f16a1e664bc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236550, "uuid": "aab011da-782e-414e-bd92-6c2350cebf95", "comment": "Malware payload", "value": "4363c7f5dd2fc3eb788ca4362899bfa58ced4701b6c80f512ec6c66c774b0a48", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236550, "uuid": "3ac67dc4-76fd-4ef6-b3ba-f83d29900b67", "comment": "Malware payload", "value": "d81a4c30a9d9726652268acfde65d80a1b723982", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236550, "uuid": "0fa07a53-50ba-4670-b34c-ef5642f751ee", "comment": "Malware payload", "value": "b51e39a47dc9e1d02170b8bda5df4187313ec355ef44c6edccfa183ef2e973528fda8aaf4e60ff80693757598b687b47", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236550, "uuid": "aceb6437-87a4-43e0-aa93-fb1f3c6e476c", "value": "T14241B46FE18FE1F618F382A6856B6C5CDB04139ADEB488603C45E9A52316C38C64D1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236550, "uuid": "f9232d9a-83b1-4235-a82b-9efa3945b6de", "value": "48:37bsqn+3mPKLtt17bxym5gox7FAOpjSX4eqaF/AlAOpVtK:P/PQlFJpj0AlJpVtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236550, "uuid": "19b99cac-69a6-447f-94cc-2ec060b38335", "value": 1950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236550, "uuid": "ce38abc0-da8d-4725-8b74-6d68ef3c3502", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236550, "uuid": "37459b92-6caa-492a-9176-425fa177c576", "value": "rvite_card.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783d6ba2-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243331, "uuid": "6ae6f34d-2f5f-4e56-8740-99ab908ea139", "comment": "Malware payload (GuLoader)", "value": "0ec510751776522f6597b676e0bc0568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243331, "uuid": "10bbf742-2644-45a0-8728-08b501ee92a9", "comment": "Malware payload (GuLoader)", "value": "4380373b480cf4834371137d7c734ed031631537602d5f91aa6c867cb5167ff3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243331, "uuid": "60964316-2f90-4668-9250-bf635417dbbb", "comment": "Malware payload (GuLoader)", "value": "8797fa5544c86d5f7d0e06a353f251c6087b01f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243331, "uuid": "e88f9819-e9ed-44ba-a262-715af941f9b8", "comment": "Malware payload (GuLoader)", "value": "8b2962dda44e5b7d1935b1a3d663ab3f3bc55d867b1ae7480f611ffc8caa39ab773d562a439261ae54b38383da781a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243331, "uuid": "2bc298b3-095c-4630-af8e-16a2d976e8fb", "value": "T17C54125322F4D663E473AB325F3EFA665D71BA0231A46B071B50AE9C3E356D18C0E790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243331, "uuid": "a0caaf1b-2659-431b-9563-f8edaf3e54a2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243331, "uuid": "1725c4c6-c9a2-4ba1-95ac-64434ad25f78", "value": "6144:9RlWosDljFxozORWRH741zL+cmUquW7dgLChJ/bbVAMcZQJw:XwDljwIYHoL+j4WZd/bRAMiQJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243331, "uuid": "c00b4576-6f04-4961-8f67-5ab90d7799ff", "value": 303296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243331, "uuid": "69fbdf7f-b448-4d2b-9c18-ab94cbd7b071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243331, "uuid": "c16c9084-982f-49b4-839b-2f666d6c943c", "value": "4380373b480cf4834371137d7c734ed031631537602d5f91aa6c867cb5167ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d030bd22-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243908, "uuid": "c52801d4-7e0d-40f8-9983-1db04fbefc7a", "comment": "Malware payload (AsyncRAT)", "value": "06c8f61c57f6f905b508b1b713545db6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243908, "uuid": "1d99b2a0-2853-4ede-913e-5e38b67c1a23", "comment": "Malware payload (AsyncRAT)", "value": "4420ab1a6c77a7cced82e7236481cd9309b61fac4725dc9ac6c28936484fd89b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243908, "uuid": "97103ef0-e5e4-404b-9ce9-85e1037880e8", "comment": "Malware payload (AsyncRAT)", "value": "2c79e1ea7a22d2b6cb269a7c774b02aaf96a9fe7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243908, "uuid": "3e1f5785-6112-44c1-96a6-96d7017b1d5e", "comment": "Malware payload (AsyncRAT)", "value": "d4964b444a4e632a33a2fc8523d9a158480bd7b984711a67b8c6d97632ee76555b43fd765f5bcdb175a55817b4ee6bfb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243908, "uuid": "ec873979-e3e1-4fc2-83be-3f065cc96947", "value": "T1B9F36A17B3A930F9E17BC674C5920605FB36787A4B61ABDF03644B661F222D09D39B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243908, "uuid": "7f91eb0d-5dc6-4361-bb50-ea564370f043", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243908, "uuid": "9575cbb8-4296-4f17-b748-283bbcaa0882", "value": "3072:u2Gs2uJl2cH33VUhktwWJ75q9nfsv55L7on6kOGSOCt36M6X4PLs:u2Gs/P33VU/WJ9q9yLPkOGSOCt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243908, "uuid": "91df4d49-4b42-400a-93bc-e80f3be503fd", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243908, "uuid": "56ec528d-b75e-4170-a1e2-e8088383c44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243908, "uuid": "769713ca-5076-4eca-85aa-d98bdc5c4d04", "value": "4420ab1a6c77a7cced82e7236481cd9309b61fac4725dc9ac6c28936484fd89b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315043e2-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778245789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245789, "uuid": "ffdd5468-c5fd-4ff1-809a-26c81b7a34d6", "comment": "Malware payload (AgentTesla)", "value": "dd008568fc3ca27ca38b14aa90377455", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245789, "uuid": "8ec9674d-2c60-4580-94b7-1a9ff3a2ea37", "comment": "Malware payload (AgentTesla)", "value": "446768b90ef97909bcf2541486c74d9a657bf52111b1f3b20d165e0a4637e6ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245789, "uuid": "356d09fb-ee1d-43f6-9f44-c285c91d756d", "comment": "Malware payload (AgentTesla)", "value": "e923544b5639c1f44b773a31836b55682aef76c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245789, "uuid": "74df1d6f-c773-41e8-b3b6-a94190e645e9", "comment": "Malware payload (AgentTesla)", "value": "68f84fc396060ba81eda476aab78e4bc7d1cb4c29ff8445ebca648dde58b3a5863c395fc6665116ad1b0b25d79531020", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245789, "uuid": "2cde70b6-e8f0-4c77-b5f2-5fd6dc01ff6a", "value": "T1B5340F027F88EB15E1A97E3782EF2C2453B2B4C71733C60B6F49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245789, "uuid": "e7382de1-ab5e-41a9-a8d8-4b2147ee73ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245789, "uuid": "d659c4f4-ce46-4646-aa1c-320de9a4edf7", "value": "3072:7SrKayCK3qwf6i+L+5IkGTHo9rG8KaG5jnThcSoufzz:MKayCKaoZBssq8KaWT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245789, "uuid": "d63c7990-6116-4d03-9d3f-7948f7e9e02c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245789, "uuid": "c66b7c73-0503-4aa1-8e30-7131cd27ed29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245789, "uuid": "183499b2-47c5-43b0-9243-a5691e4d1dec", "value": "446768b90ef97909bcf2541486c74d9a657bf52111b1f3b20d165e0a4637e6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccde04c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778244305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244305, "uuid": "155fb758-5545-47d7-b171-cee044067178", "comment": "Malware payload (VIPKeylogger)", "value": "a0fda5a06cbb4971c06ff1e32a48797b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244305, "uuid": "0df68429-ab1e-4642-8c5c-aada764d9778", "comment": "Malware payload (VIPKeylogger)", "value": "44bb604a92cdee7256c9c035aa3747702457d139fca7dd7ea034f141049d8c26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244305, "uuid": "32e48084-76fe-47eb-b535-4193b3384754", "comment": "Malware payload (VIPKeylogger)", "value": "0275adca53cde1509c49f5a771d14134ed8b12ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244305, "uuid": "18f6f593-2c2a-45c8-868f-d6049d924b2e", "comment": "Malware payload (VIPKeylogger)", "value": "4cdbd07994b9cbe1107b1b8b1b36a08c8044f91cd68c1a36324e6565817f347f332c73aa1f3e9598341d6dfd75e17409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244305, "uuid": "3367869c-2454-414e-a27a-70c2ff573722", "value": "T1DA849D85BB86ADD6C61582369C6B432C3739F2E10B829F070A29A5351D376F0FE4771B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244305, "uuid": "54a82212-5e44-4077-b49f-28f40d995bee", "value": "be445168aea972d960c4ac9bfd4c68a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244305, "uuid": "759f5168-9760-4efe-acb5-a53e3c2ecd1a", "value": "6144:g/4sjvkVkGE/mT69n8vyhJ9Iqm6ysBqis471JUwk0m4u3e4jnTlc7B0:g/hj8+GVe1GaJJm6JBNbZuR3NjnTlc7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244305, "uuid": "14586927-c16b-4ff6-bc11-3c5c0e2f3e96", "value": 383452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244305, "uuid": "2a327f7f-d1fa-4851-a3fc-e307bde4214c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244305, "uuid": "324ea04b-3a4e-4876-8072-b99ee82664f4", "value": "44bb604a92cdee7256c9c035aa3747702457d139fca7dd7ea034f141049d8c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c6d018-4ac5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234577, "uuid": "3957dacd-6b9b-401c-911a-7898a16c1124", "comment": "Malware payload", "value": "418a28c3df4d78980ed08b7d96b82fff", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234577, "uuid": "de355b58-d62f-47d0-a863-8a5c8f014adb", "comment": "Malware payload", "value": "44c68a4b47e80309bfd2ceb87ad3672cee1796da709a663b391c3678c29a0979", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234577, "uuid": "c4ede007-f5ee-4126-870a-10acd47ea2ce", "comment": "Malware payload", "value": "7804059c6e6c99ebc552141e24b6a699b0560e56", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234577, "uuid": "fe73f1cd-77a8-4ec7-be8a-ad2dcb5800fb", "comment": "Malware payload", "value": "427fcd36d3522b355b6b0cdb774bc475c1fc666e1179199edad6c5f13e79c1df7059c4c43d45313987f25ec186de339f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234577, "uuid": "cb5fb4af-84c9-4b9c-945a-6c4716dda685", "value": "T132C73346E34BE839F9E792321F3D26191546CED5C32766876C6032AC24BBBD04A91FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234577, "uuid": "9c59f042-f915-4f91-8fa3-60924942cdf7", "value": "1572864:OCz3azIFhyFnsquLjGBCLz9nDTWQAnXw30iA:OCzhOs7ukLBn6Xm0iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234577, "uuid": "e37c2751-b6d7-4aa8-a12e-499b09fe074a", "value": 55517390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234577, "uuid": "ac037e1e-b9e2-45c0-8ba3-114110ec745b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234577, "uuid": "05258c9e-1854-4e41-8d8c-e445c5d75386", "value": "Botim(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c88444-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234045, "uuid": "aed48c35-2c11-4a3c-8535-ed291c2f08ee", "comment": "Malware payload", "value": "dd1b93efe10d4952bbbe74bb8bcfebdd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234045, "uuid": "ce43a42f-818d-4860-a636-d4a2b0c12cbb", "comment": "Malware payload", "value": "458ba9976df1df2588d491c1a1fe4f017a56a966919597977ad99187ff070852", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234045, "uuid": "8ac6fc6e-eadf-41e0-9f89-54caa69929e2", "comment": "Malware payload", "value": "13db8af2732c1bbb1836bdc2f11614b44a143cfd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234045, "uuid": "4a8e5035-0d23-429b-ab35-0a31195e7fe6", "comment": "Malware payload", "value": "03b44208d3363d5282d696b71495e7e89d2ba1b2744092981033a0ceee452f027b9c95513d3112c09a66e4e336dba5ab", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234045, "uuid": "602d631c-6acd-4b33-a66d-49bd73b22acd", "value": "T19507CD23F5052996DDD6A234F1E7279533305A440393A279271FE026FDE26CECA77AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234045, "uuid": "1c4cfe30-61e2-45d4-b6f3-efa8c5e4296a", "value": "393216:eMWDMZT3jW01g1B58z918gsdjX7fpRiXLjTPYwXj:kM9jx1g1j851Tq77mXLnPLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234045, "uuid": "e79b8426-8967-41c3-9159-0f0b0fdce67d", "value": 16911856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234045, "uuid": "4433dc16-ad0d-46b9-9edc-3e3f64b5dcc2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234045, "uuid": "04b6e15c-59c3-4a7a-b635-9af1b758e7f1", "value": "iMobile Lite (58).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403b3a69-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778245814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245814, "uuid": "b79e81d8-371d-4ced-957c-6e77a7b1c9c8", "comment": "Malware payload (GuLoader)", "value": "67c620efd97ba554777c357882fa1c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245814, "uuid": "2090628b-d59d-4eba-9922-82f4b2543de7", "comment": "Malware payload (GuLoader)", "value": "45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245814, "uuid": "0ebbd8e2-a34a-47ab-a52d-82d50f97a3bc", "comment": "Malware payload (GuLoader)", "value": "0512e31f8b394e980b4d3031476781757753d43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245814, "uuid": "7f3462f6-b165-46b2-8836-869cb25dd630", "comment": "Malware payload (GuLoader)", "value": "6b96f028e2b1173b0fb15df7c95b342e68a91969c57f5b83ede885cb4d19ad5e8d9b99f9b16a1dee221606727dc26060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245814, "uuid": "064572b1-1b9b-4cd9-a7e9-7933e0b18c00", "value": "T16DE423013380EEF9F92687F76D71CE77A469B83C8255497773807F1ABCA18A11938297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245814, "uuid": "5a1faa5a-0a40-4815-8f3b-0465da8c8f9e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245814, "uuid": "0de6abff-2dda-4469-8791-a3f5f40e19c8", "value": "12288:0X4jwQq23qFUIEy0ldirKsMPnK1tlFbEnS47G8+hjKAyCx2a9xfaeqf/MA9IhJiX:u4jwQqoqFUndtnK1xbEv7LBhCcSx9qRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245814, "uuid": "7b12cd77-1b77-4626-889a-7160ccbd8c8e", "value": 662651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245814, "uuid": "aeed8b5c-a5c2-4a62-af40-674db72a0c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245814, "uuid": "08b64836-2b16-4c45-a087-7b7c7756ede6", "value": "45a470f4e0156015e0e7feeffdcaf87979bf9525d350d85bd97c223d9f007b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebb599e-4aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778225491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225491, "uuid": "8c336b23-0b28-45d8-ab0f-eb3063133b08", "comment": "Malware payload", "value": "38adf413bb50880bd53872af48d93855", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225491, "uuid": "bb3b05c4-23a8-4e43-a59f-78106c6481dd", "comment": "Malware payload", "value": "463b9ae6ae6b0048f5db5034bc6ac666c2b1043cf06d9aa68f6f39c9b5585e73", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225491, "uuid": "f07ff006-2385-4696-87bc-7e2dbf99769a", "comment": "Malware payload", "value": "3bc81f147fdf1f47e4f6c704c536e4ff307cc985", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225491, "uuid": "a29e0600-cc73-4191-a908-da12b493d2bf", "comment": "Malware payload", "value": "6b1b35486028bee0798c2861dfa87651d0b0763f353180b680aa0f2687df7786a007dd1d7d293eaf4b010c91c50f2b6a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225491, "uuid": "a2830b90-dce4-45c3-9a07-58441e0316c1", "value": "T1DFB0921128A4523ECF8FDE1AD296C2358C2A3402A2A582A17A218A297A445A9D257A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225491, "uuid": "a1a75e13-4a93-4885-8373-8d41582bf0d0", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFqic8MEn:s8GFGMFI1R3Ks8zsO0cK4kbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225491, "uuid": "80000820-c9df-4de2-afab-75affd50b2b6", "value": 119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225491, "uuid": "6fb4f5b4-2b5c-4845-bc3b-029d00162619", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225491, "uuid": "338584a0-74fa-432e-a5d7-1c9ce6c09bd9", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1600c97b-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265070, "uuid": "2177b7c3-fffd-4feb-aacd-1355e13501c4", "comment": "Malware payload (Mirai)", "value": "f325c2db67b83406cb85bcbd4a21cb61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265070, "uuid": "6787e0a1-fea9-4815-8c20-10ef312d6112", "comment": "Malware payload (Mirai)", "value": "464fbe0833d6b5f7671ebb91ecc99682a2021a63ca6f989616c33a0dc9ab06ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265070, "uuid": "30fc8d09-181c-4d25-9f98-e5c9f9896f62", "comment": "Malware payload (Mirai)", "value": "71c39137a3abbbd15b22c8d09eaa28487a32fa6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265070, "uuid": "7d508145-2864-4068-a592-5768aace5c4c", "comment": "Malware payload (Mirai)", "value": "7f851b9fe48cb759723bd8d962c2898a0b7376704fd53fdc9a8cd3256a32c5efa4d62f752e7b733cd1881ad231f0562f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265070, "uuid": "9a01e61d-d29f-4184-b876-c0c8c09411c8", "value": "T1B113F684B8869E06C6C0537BFA0E82DD3B2973D8E2DD7303DD156F513BDBA2A096B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265070, "uuid": "146f7bf6-b621-4cb0-ac51-50fb50f60171", "value": "768:boXgKS/E5do3soaHo8zwESkBxl3zhdQhLljkbsZV0w1Wbg5:EXgB0tUg7BXQ0bu/oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265070, "uuid": "bb991679-771a-49f7-b25c-5d4d919daa9d", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265070, "uuid": "afb90a64-968b-4af2-ba53-13c2ceaeb020", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265070, "uuid": "af4d76e8-33ca-4169-a973-a85bc9dab764", "value": "nexus.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152f4830-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256479, "uuid": "66c9f6d8-39b8-4f76-9349-e0d6618c6973", "comment": "Malware payload (Mirai)", "value": "b1ca9cc75cbd5a922c41e05cb8164155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256479, "uuid": "fd207ef1-d817-4cea-8ced-6aae8f30422b", "comment": "Malware payload (Mirai)", "value": "46aef52888e61d392b6e530179273b2033701b69a44cdefc4ca3243bbaeef0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256479, "uuid": "5aa528a3-9b87-416d-acb8-b5b511bb3f96", "comment": "Malware payload (Mirai)", "value": "c20dec1f945866e234ea4eb7dc7ccbc0977cafcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256479, "uuid": "0a792d39-5edf-47a8-9212-c51b49fc2a96", "comment": "Malware payload (Mirai)", "value": "188adfaf0dca8d628aa00331fe0eb850b8929656afc3856d667d5eb4997a2e1537ac9d24f7037ddbbf61e9e9b7c076ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256479, "uuid": "0be2f11b-627d-4359-bcb5-8a4cbf3c097c", "value": "T151C35BD2F8019EAFFC0BD7B6845A0909B5B0A3806FA3162AB7D77D97EC760D02C16D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256479, "uuid": "c05ab574-0b9f-4e3e-aa3e-95c05edab1dc", "value": "3072:ve+h30HpfLtnEW6ZBRGagKgrkby9ELeTBnHR:mbH1RGRGa9gKy9KeJHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256479, "uuid": "4fbe9789-8fdd-4726-a08a-d76a0aa200c4", "value": 124464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256479, "uuid": "3e17e13f-7df2-4a1d-8015-68f4f3ef1d57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256479, "uuid": "6110c86c-e5dc-4338-97a0-12a857712cbb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0c9fa9-4ae3-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778247795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247795, "uuid": "36ad3ef5-782b-4296-b2b2-ab7e504a8507", "comment": "Malware payload (Prometei)", "value": "cdf0f7ea792af51906642dc7d5673fa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247795, "uuid": "1e628a69-1f69-4649-8cb5-e375690871b4", "comment": "Malware payload (Prometei)", "value": "46b9226e2a3ee9e48dc5db7a946a0faff1114a8446d9868d929cc5512a8bbe29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247795, "uuid": "4d8e36f4-4132-4fa8-bc6a-166e5e582adc", "comment": "Malware payload (Prometei)", "value": "b646b1cfeba80282b65ce71e1dcd712342cddc76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247795, "uuid": "7f48c99d-cffd-4550-a14b-391f7af98da0", "comment": "Malware payload (Prometei)", "value": "1cddf0faea303e8b589283cfe8e10d26a59cb23c60f74824a00b74f67a6f5f171f88f3e4471e957bd4444731870fb82f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247795, "uuid": "df1051c2-2d52-4fc2-b7ce-a246bc80432f", "value": "T156A423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D632BF2CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247795, "uuid": "a2e141e3-8a82-497d-bd64-978a0bfb2313", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdM:Fs6pyCC/Ya2hpi6T6N4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778247795, "uuid": "0fb42c41-692d-448d-981e-9827c2c945b2", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778247795, "uuid": "9b11946f-d892-4681-b978-f5c59f157cd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247795, "uuid": "b2a02c2e-88bc-4d7b-ae68-88b468439fd3", "value": "46b9226e2a3ee9e48dc5db7a946a0faff1114a8446d9868d929cc5512a8bbe29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47744671-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243249, "uuid": "394a7dc5-53f1-43f5-ab2d-6788d3d4700a", "comment": "Malware payload (GuLoader)", "value": "8d17b06464f37338ce8b369ceffe5b65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243249, "uuid": "062dfd18-fee2-4565-b1ad-adc79ed5d34b", "comment": "Malware payload (GuLoader)", "value": "46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243249, "uuid": "5e9c3b43-4ac6-4a8f-ae0c-76796458bdc5", "comment": "Malware payload (GuLoader)", "value": "d2680a0f70a175ac37afe9d1d4c4824de0d3dad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243249, "uuid": "8108720c-ff03-4dfe-a978-e26cce6cc960", "comment": "Malware payload (GuLoader)", "value": "817d0097740e3a474eceb950ff58ae6a9e44399a848c999530cefe58b8844fe816d84ccaaf43be1293864e56d9288c79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243249, "uuid": "8ac57eaa-0668-4a9d-8cdf-5038e77d761b", "value": "T1DF341266B2E8CA67CB6F52704D3BA591BFE5E3110158174B4B5CBF98BD14E52022F883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243249, "uuid": "6cb76be2-8123-4027-b5b2-69e71088a672", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243249, "uuid": "212221a8-f944-4ece-af70-c55fbf0efbb6", "value": "6144:sqjIcRE6w/RSFHMR9aCXGa/NQNbhCkrvCWLN:pVRvw5N9/i/COvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243249, "uuid": "58c9e8be-6fd0-4baa-8ade-416f8cb5383f", "value": 241008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243249, "uuid": "dd61e497-87af-4a33-87fd-41b0fb87e2b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243249, "uuid": "afc76552-6619-42b1-be94-d2294d4eb7a6", "value": "46f9a60811fcd548da210c8e7bfe6989cc79412f6a2b245491f69c2f50b38042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffabc3d-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778243129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243129, "uuid": "66f4544c-93c9-43e4-975d-3818ca7b7b58", "comment": "Malware payload (DarkCloud)", "value": "a369d0fcf022ecb74ee69b295d6f477a", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243129, "uuid": "e65897cb-d641-442c-94c1-1aa18255431e", "comment": "Malware payload (DarkCloud)", "value": "47468b0ab04b736854cb6e5dd67f6da4b057743b0ed3409438f2a35c830df080", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243129, "uuid": "e6dadf33-b834-4d4c-8481-ece75e7c1f48", "comment": "Malware payload (DarkCloud)", "value": "f76b60b8ea0dd7345373e6531db0130610d5e439", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243129, "uuid": "1dd0f21c-7446-40db-9cf1-c5b6e7ad4df6", "comment": "Malware payload (DarkCloud)", "value": "c24d45ab9e16bf92a7193e24558fdaba0d74e708dd446b1519d111296eb052645564e4986c3ab6aae23b06f8ed8c30d2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243129, "uuid": "dffd3867-57d1-430d-9830-14ba03c6001d", "value": "T10755015533A8EB02C4AA5BF41870D37447F96D99A422E3178DE2BDEFBD39B106904393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243129, "uuid": "99385139-a2a8-47e2-a0c6-0d0a73b3478e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243129, "uuid": "58e89b1f-b00f-476e-82a9-a24c6fb5957a", "value": "24576:iKGxqSJJSHw5aSEG17nIgkN4ekB6bL1NhFbLHfsYVdf/z45uiKE4QRZ4F2PNpqty:ixxqqUwcSEiIgKRkob9F/Hfs6f745utW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243129, "uuid": "cfee6418-45f0-4bf8-b00a-202cef755c21", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243129, "uuid": "ebef2057-22ce-4427-b9d8-8525b1019e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243129, "uuid": "b7499072-0915-44fb-b883-7a5e566eadf6", "value": "47468b0ab04b736854cb6e5dd67f6da4b057743b0ed3409438f2a35c830df080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419663d5-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778242809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242809, "uuid": "16e87459-502c-4c5c-81a8-324fdfd19f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "3551f77e2a4546d61a2e873d8a2b58e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242809, "uuid": "3d5f11a0-5cdf-4736-9c4b-65e816b8cbbb", "comment": "Malware payload (SnakeKeylogger)", "value": "475134fd1bd6af31bbb8f76aaa1db2aa9eeb9bde747de1e8d04b399707f063f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242809, "uuid": "57f42aa9-1646-4fc9-938a-a2edde7c02d3", "comment": "Malware payload (SnakeKeylogger)", "value": "b3a4f38561ce0e977a0ef6782d0bc0812edd58fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242809, "uuid": "19d4bf19-7568-4fe4-b377-5763fb02d3a6", "comment": "Malware payload (SnakeKeylogger)", "value": "d56a81e7eb8dec73481404bc2368d5af2cf9172557fddb072383268145b0f33771572453ab9392e0ca548078d48b1454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242809, "uuid": "a73cf0e6-4680-45c0-84e4-e7874246795c", "value": "T15A358D0E7381B023FE96BD324A56E3114678691501E3AD1F1A782B7DB9713F30E3E666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242809, "uuid": "e1e807cd-e268-4e7f-9f97-d2c9e062dd70", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242809, "uuid": "aef86ce2-705a-49fd-9598-d37e9ea1eb9e", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXdagr6Gp5U:lPVt/LZeJbInQRa26Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242809, "uuid": "34df44ee-b0b9-4b30-9b04-de2374471f27", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242809, "uuid": "7bfae2bc-f870-420a-a65d-ba5182b3aab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242809, "uuid": "12fdd423-b149-4065-80e2-66cd14647df1", "value": "475134fd1bd6af31bbb8f76aaa1db2aa9eeb9bde747de1e8d04b399707f063f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d795ce-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243669, "uuid": "fcedb073-f82e-4bbd-b557-6a4c42de7c9d", "comment": "Malware payload", "value": "3aa9f505966c9358adcfc11243209864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243669, "uuid": "98ef9378-0a2a-4ab8-a167-b32eeeb901cc", "comment": "Malware payload", "value": "476fd54b105098bde1bfd85a2f55974d1d4c2e0c010ce2ffa522cbbca4184937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243669, "uuid": "203a377d-808f-40f6-9233-7ce45bc69fe4", "comment": "Malware payload", "value": "bc985f7d25b95dc930523f95f36bd5ef79844b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243669, "uuid": "24c6f599-e972-41f9-9ac1-b6d74cfe874b", "comment": "Malware payload", "value": "5f2474b84c2fb991f882254a70fa9a60629f715c23e0988ef479489e04988adc1099f5f818c95881db12db38b0eb04f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243669, "uuid": "fd49de28-57a0-4f15-a003-37db451cb832", "value": "T1BBE31294DF98C516DABF09B1B8B747203135E7C6DF22BB0977E0953D0613C893AE5A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243669, "uuid": "9f861cf9-e16d-4b02-84d2-a3654cf0c08b", "value": "3072:eE5QNBUbEWmgCgSxVPcT5KadlC90FlnVU1OLbZZcFTHtaUyafKwE0zE:y4EWmIe85KaS+VJJCFTHNyIKwE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243669, "uuid": "6b28ea46-7709-4507-9411-97c073276a48", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243669, "uuid": "c95f679c-f3d6-4f7a-a367-1be03705aba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243669, "uuid": "94d9e7f7-6dc1-41a8-b5cd-737117ca6174", "value": "476fd54b105098bde1bfd85a2f55974d1d4c2e0c010ce2ffa522cbbca4184937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e736d5-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244503, "uuid": "5e3dc53e-a3c9-45ba-905e-76669dd4a1b7", "comment": "Malware payload (AsyncRAT)", "value": "76f4a86de72c47124557a0058e4b9b67", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244503, "uuid": "fb72979b-9552-4972-99eb-1ac0a7a92e2c", "comment": "Malware payload (AsyncRAT)", "value": "47e562e883c3f67160cb4f8be4f4ba5cf83dbc39d29cb85eda03326b8d37a1c2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244503, "uuid": "80f1e796-bacf-4a1b-b4d5-e752c41ce1ae", "comment": "Malware payload (AsyncRAT)", "value": "84ba3ad2e6fb3105bc9c4f76047cbe408d14f469", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244503, "uuid": "9d0505d8-f26c-48a8-b8d8-cf90744a406c", "comment": "Malware payload (AsyncRAT)", "value": "84561f7b990aa3b21973efdc4dd78a9a3d52e7e179fa4eac37b6833f2f76a55336924b5377a9800a5258b476907ccf8a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244503, "uuid": "2cb98fca-6352-4b4f-a98a-520d4412221b", "value": "T1DBF40101A2B8DB1AE4BF9BF82DB1E03403B96C8EA521C64A4FD57EDFB535B100A45743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244503, "uuid": "663d0f48-e4b4-4bb6-8094-593c8b8614d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244503, "uuid": "cc6b86a8-03a4-46e5-8de3-cc0c3dd215c5", "value": "12288:2GGZw5e7lHeAW1gjuyKL7c2toTwQAroz+WbqZhBMFW+ZVLVwy4n2rSEqqwhbg:bGW0JpuyKLw230z+2FW+XVwyDSEqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244503, "uuid": "1de4864f-8d8a-4243-8004-b1a45ba2654a", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244503, "uuid": "3b01a674-2750-4a30-8990-d56c55efd1e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244503, "uuid": "436a1346-0e48-4593-a5e3-f7001d5d42c6", "value": "47e562e883c3f67160cb4f8be4f4ba5cf83dbc39d29cb85eda03326b8d37a1c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9487ca-4af3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778254689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254689, "uuid": "00624dbe-e9db-4814-8fdb-343e9de51af3", "comment": "Malware payload", "value": "76cd9e60c306fcd46958d592a448bc35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254689, "uuid": "c6772e4e-b007-448c-9847-099f4e17330a", "comment": "Malware payload", "value": "47ecd46c91d74a8d6467c7e4d6a038e9d5f959007b341e089c97589f31b25970", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254689, "uuid": "9ee3d45a-7e53-4bdf-af56-e84c731eade3", "comment": "Malware payload", "value": "a7609074f2a4af91982bf3510969e38384a82d47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254689, "uuid": "7d46e864-36f4-4d7a-925b-ee42124ced11", "comment": "Malware payload", "value": "ac0ebcd2dc8d766d83908f4a6fb7d6046414f47604772ea320631f2a6479061e0555291b65d8dd207ba8d1be3051d573", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254689, "uuid": "b9b3f56d-52f9-42ba-99e1-57f7348785de", "value": "T1D93516BA0CD14D9C03C5995A99AE16D05F54EB88E0EFD75CFA6ECDDBA1C1C0B82C86C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254689, "uuid": "2b9624f1-4a44-4d8c-bb5b-e1d79c2a988b", "value": "192:lqWvTyrjFOrk76iurmfYwgI8clonFexFy+W7stE7kBUP9MG5jFsuiXPFqq6Ns9FM:zVbFKWkhMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778254689, "uuid": "81905a82-e0a5-4af6-8a21-eca46f1d3362", "value": 1157849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778254689, "uuid": "700fd66f-30cd-458d-bff8-e308b93ee50e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254689, "uuid": "633073ef-04de-4456-8467-fccb5d2a987f", "value": "task.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b860ad54-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242579, "uuid": "fa3cd503-e58e-45a4-a683-3feaec7d934e", "comment": "Malware payload", "value": "52e7c69d71de4276e20d05fe9bd8e4bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242579, "uuid": "ec852b57-06ec-43d1-bb78-4678581e8c8e", "comment": "Malware payload", "value": "489d38ca89a1429efa69dec6418028ede0a09d1a38f9fb1503adf869aba1e932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242579, "uuid": "8a0a8bac-835b-473a-9b2f-57ccc83826ab", "comment": "Malware payload", "value": "6f7ef986583239ed93f81434cfda49641eddd660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242579, "uuid": "50e5b0c5-9574-49b6-a1a2-5a702f45ea8b", "comment": "Malware payload", "value": "f8963845278615f8c13a05fd297ebabd9cfd7d4fa855f196666cc09c4998de137b1ef1709214aa5bc78fc6d6e4880eb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242579, "uuid": "83df5a19-b11a-483c-b888-b885c0d12677", "value": "T15F95E00263E85E58F9BE6B384975942197F1F843E732EB9D7F48419E1C32B41CA52B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242579, "uuid": "fa722d25-6ebe-4ca1-9e72-c4368cd8808a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242579, "uuid": "2d77fbed-d32a-48fd-bd3e-0b666e92adf1", "value": "24576:i6mhEF4Am1UB2TKf+6uVgBpw0/eS9BrVXqI+JRgFkI:x422TE+DVgBpd/pVaIwaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242579, "uuid": "ab1cd445-57d5-4f3f-9de3-5c0635a4b18e", "value": 1874944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242579, "uuid": "602cbcb6-9115-418d-88bb-d7a5511fb6a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242579, "uuid": "2c960953-4ed8-46bd-b38f-7614e272be00", "value": "489d38ca89a1429efa69dec6418028ede0a09d1a38f9fb1503adf869aba1e932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ece60d6-4abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231692, "uuid": "bc686216-5e3f-4f77-897c-43cf64ee7272", "comment": "Malware payload", "value": "bbf26f8786c0e8d381cd6edafd14978b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231692, "uuid": "45533ab5-81c5-4f9f-9de1-7fda0a0176d9", "comment": "Malware payload", "value": "48a3b6c524705875ab2e74b1d5f6072f48fe7796ece88cb7f642f8f662c41242", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231692, "uuid": "dc643f25-ca5e-4483-ae73-d8545b2fbafd", "comment": "Malware payload", "value": "f6f359ed4165f6ffe19a30439b2208658ded6aa6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231692, "uuid": "8aefef58-e423-43fb-886e-8c62c74992c7", "comment": "Malware payload", "value": "e75213854bda151146f702992358fc59e7a8d1664b25dd95a0441933a1edb8f04192f98c741df2b5057d5b802f63415a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231692, "uuid": "d1a509b1-9e17-450e-91ae-7da0ccb94245", "value": "T177F6220BF308A86AD9F35335BD3A437765171D264F83C68B6860723DA9B36D04A6DBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231692, "uuid": "ecdb50b9-479e-4d56-aa3e-4ec62af5e88c", "value": "196608:adOwmtFLh2T2vdXeYTW3mzvhyw0UJPKgPSCtFtzd9ptTgwQRxBGwvPH8ILNbDtAl:vy8gwoCnzhdyzbLhftANGtfbox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231692, "uuid": "47dbcd4a-fd7d-4c67-9602-a252df7ce6a2", "value": 16274080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231692, "uuid": "d6412ed3-0928-4fe6-8622-c7eb9f076241", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231692, "uuid": "677f6180-2a77-480b-a1fb-c9056f1c68f9", "value": "iMobile Lite(10).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a790a96-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245884, "uuid": "7b588d5d-c6a7-4354-b3ca-ef753b473c05", "comment": "Malware payload (Formbook)", "value": "48658bb3866f1f0966c7877146b74264", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245884, "uuid": "f78f30dd-e86e-4f1b-bfad-21693198b4b5", "comment": "Malware payload (Formbook)", "value": "4938edddb2c111bd912e9c26199967959f34f148410585fafb985381f617bada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245884, "uuid": "a0e7ea99-fa76-4dc0-ae37-7d2198fe3925", "comment": "Malware payload (Formbook)", "value": "f4855da960d27501b8a9f5fcd45fc825ef18f1f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245884, "uuid": "a7379fbf-0ac4-4ca3-af67-08f34aaba6dd", "comment": "Malware payload (Formbook)", "value": "14fbd2fb18b0a497ba1db18ea66dc2bb7105c68891b60d520e6274137ce0884062656b5d1e33c9df035fb0d86e896caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245884, "uuid": "2d90d3c3-7ab1-4c5f-b049-40f05f2f287c", "value": "T112351228A268CA46C9FA0FF458A1D5B50378ADDEE531C60B9FDD7EEBB47A3021110717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245884, "uuid": "8538310c-a897-49f5-9e0e-a8ae36009e13", "value": "24576:AXIhHQjcDjdKzYv7nx7Zb3CPpqCV8EE9AkM7QNi3HVF94y:AsAcnksbx75OoCK7HwFGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245884, "uuid": "2d4c1cbf-4f13-49c2-b053-47f0ac5f1374", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245884, "uuid": "00a53d07-3ce0-4854-a824-5f3b9775dd0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245884, "uuid": "e22edde6-7dc2-4a34-8826-c8a2efbcaef8", "value": "4938edddb2c111bd912e9c26199967959f34f148410585fafb985381f617bada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8221d303-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778236475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236475, "uuid": "70763cbb-d8f0-4a89-a7c2-b34e13a176cc", "comment": "Malware payload (AgentTesla)", "value": "cff799c8553b4303d304c98dd4130873", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236475, "uuid": "5566981c-d1ac-42db-a068-d4800d4c890b", "comment": "Malware payload (AgentTesla)", "value": "49db8e3c17ce4c1f081ecb0e612bc9052a1d7acbd379d24f1d529a41d51702c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236475, "uuid": "158e5581-7403-4c16-901e-5d0f95070b25", "comment": "Malware payload (AgentTesla)", "value": "2eba4cce3362f00c82a520827d227763eec0a267", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236475, "uuid": "7f2123fa-69c0-4d5d-ad87-1d3ff653a31f", "comment": "Malware payload (AgentTesla)", "value": "89fe293237770b55f1934b31a883075b46dd0e0325597eb3633f0bd20834d5e2b047d5e4a118e8e3f17d0fb312f6549e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236475, "uuid": "91d28683-46fc-47df-b24e-8df58d4dfc77", "value": "T11C339474294C45DF2093EA74B088A7E3FE6C0A5C9FFD664F525487DA1A3EA8734C3981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236475, "uuid": "0fe3cf38-e8e1-4fe2-a1bd-918d8fa0d9f6", "value": "768:M27jdIKPJez6LUGly8nWP6a08a546apvW:LPdPhw6fWl0KVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236475, "uuid": "6403baa3-fb0e-4679-9eb1-51271c076107", "value": 51779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236475, "uuid": "aec1d233-8c4f-4895-a1a9-f463e2df0cb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236475, "uuid": "c68971ac-95ec-4905-a021-2e7018b1374e", "value": "Faktur Kiriman Mei dan April.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4fffed-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242561, "uuid": "51d488f2-4e72-4534-adc4-7e7b339c8205", "comment": "Malware payload (Formbook)", "value": "05fb48aed08adf27f4984e838a877c50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242561, "uuid": "690a4854-b4c9-4aa0-a21d-3c89b9c317a7", "comment": "Malware payload (Formbook)", "value": "49dbcebf20311c27740c47d12af55f531e585eaebee0c41098b8c9a2bed12f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242561, "uuid": "6deb7b5b-3f61-42f2-b301-b19840243698", "comment": "Malware payload (Formbook)", "value": "c206dd674c803e519b6d208b2a63f262679d6e8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242561, "uuid": "4784a2ef-1bfc-40fb-a572-4856e2c6bfb1", "comment": "Malware payload (Formbook)", "value": "52bbcc3208f33b60f87426fadbdb51d41e9ad9236c647394b687836162aed1f7b9eb6189938020fd63fa31ca0d98eef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242561, "uuid": "864ea5e2-5eab-4d1c-a87d-c4fabec61f32", "value": "T138350248220ADE0AD8966BF80C70E3F427B86DA8A520D3079FF9BDEF746D75159142D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242561, "uuid": "f56ea028-647e-4b0b-8f06-252e3b899bdc", "value": "24576:q7/gmtdF9KnjuZaOFpU1vUuKnFfoe+vKmfcABnCQOD:q7/gMV2aUOFu1vUuWftm0Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242561, "uuid": "aaa69b17-6a6c-4d37-aa2b-eb296b0203ec", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242561, "uuid": "15ce0810-d8d7-465f-acf2-f35c7f8f943d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242561, "uuid": "f0e0bd7f-899e-4d1a-b617-b038b9ce3791", "value": "49dbcebf20311c27740c47d12af55f531e585eaebee0c41098b8c9a2bed12f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e0a262-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230985, "uuid": "eb2bdb45-d1c6-4d71-855e-6e9bfcf4f8b3", "comment": "Malware payload", "value": "12b49cac05fead72732ded5b1101888c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230985, "uuid": "2e635bb7-7a83-466f-89ad-2a52c35217b2", "comment": "Malware payload", "value": "4abd5f4e1c9c80470bd5bb2dc132633d70d831d58d531cdde13094f563c5895f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230985, "uuid": "f6a6031a-e9bb-4415-be61-77102f620900", "comment": "Malware payload", "value": "bddbd8c14b40fe41b47e2212e8c5f55779c2cc58", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230985, "uuid": "0b0d8596-1429-4102-a948-4febdebdc564", "comment": "Malware payload", "value": "b13b43c76d6515c157d7a5e6457a098f5b23d8c78645cc5e0ddbcfee47aad9a7eca00bffd2a8cd13a07e1e299a33bb19", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230985, "uuid": "38b197d6-1654-4a75-aab2-a70e1e83e0fc", "value": "T1F6B612D6FBC8491AC4779072C96A52F1215B4D568B839F87B904360C38B7BD80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230985, "uuid": "e94ff6d7-02d5-4073-a052-a6417823028c", "value": "196608:uavXX2LthRaFOd7ZQokWZAvT1hR1dCbppXRVTJPW1Zn06mE:JotjaFOd7ZbRZyofTTJO3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230985, "uuid": "4bd6319d-7da2-4c3d-96e4-599ce6b4db5b", "value": 11352180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230985, "uuid": "34f6b1cb-5010-4d68-8184-ddf5c9d93b4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230985, "uuid": "62739c39-3c93-4fb9-9eb4-415a7b9309c1", "value": "Yes Bank (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93173139-4b0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778266139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266139, "uuid": "2fd1b78c-17fd-4c14-992c-ee91b352be7a", "comment": "Malware payload (Mirai)", "value": "1dbcbcbb64d81965ecaebbebcfb6a1df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266139, "uuid": "9225c633-cc1e-4bc1-8d22-3794e4233974", "comment": "Malware payload (Mirai)", "value": "4aca098bdfcd3ff9dc1ba3d15f6f461321c58a3dbb1d688ca731d95eac8e1ffa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266139, "uuid": "67f38dd5-087e-42be-86d1-96ce268b31df", "comment": "Malware payload (Mirai)", "value": "45818386c2be4a1d93cfacd8a22f69586ce92c0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266139, "uuid": "6d673ce4-1069-4391-8e91-960ada904868", "comment": "Malware payload (Mirai)", "value": "7522c9fff02fb2f24485c47237fc1f40450ba806bb6f2d51da32f3668dd36c2eec8d150e5d6c7dd0142a72533816e526", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266139, "uuid": "17f482fa-b0ee-4c02-888a-54dd0445dd72", "value": "T1B631D4CA0B12A5306DA2D91F7EA4C809F3D5ADCFACC1294594D878E894DCF49EA42A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266139, "uuid": "f263bca6-3f08-41f5-bf34-2317993ea5f2", "value": "24:It8uvuWCw8k4k3w8SBdoKOw8by8w8fP+w88BOBw8xOw8yHCw8qSCz:ihGWXcVwKjX+zNwrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778266139, "uuid": "91b00f05-ae87-48a0-9da4-f7dd80daf068", "value": 1560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778266139, "uuid": "cfe3fb03-4762-4f24-9deb-873930888452", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266139, "uuid": "eae30296-5047-43be-89dd-bd1dd64fc5e4", "value": "kla.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fecb0f-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246062, "uuid": "fe3d1664-e526-488f-b126-826461aa7401", "comment": "Malware payload", "value": "15f6aad9a8e8a91287df76fd621cbd0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246062, "uuid": "bbf20969-a436-4fcc-9af9-ce8f2fd270d2", "comment": "Malware payload", "value": "4aeeb6472c2a72563d4ec4ab86f55eb6b124b7940eac4b895832827728c968b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246062, "uuid": "b00cfc2a-0053-4fb7-8ca5-ca0f84587bc1", "comment": "Malware payload", "value": "4c77a0e0ef975949b2ace61cc532724fff3f585b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246062, "uuid": "8688f52c-c416-4020-a93b-86394c6e89be", "comment": "Malware payload", "value": "d0e97579e822a5e33be2698111dda7d89a4d50a156e143f66ddb8040e7098432c5643ac8847ef6929a0e3735bea411bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246062, "uuid": "7aac7153-19a9-44b9-adcc-3e4ea4c1cb61", "value": "T15F55DF154D831F68D63E0B38D176049C23F18D5BCE56DBEB2EEC96F0BAA2745D806163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246062, "uuid": "66648ef0-cf8b-4f5c-a0ec-5d53804231f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246062, "uuid": "de23a4ca-8b27-4e9c-88df-cc9355c75ce8", "value": "12288:aSH+ekWN5VtPfco3nvK/BeG+DaeZ6WdqUkzGdjPVI7aFEuLXrbIfxgYsqOawnKp/:N+elXX7C/AGMaCdHkadh5rciCPmqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246062, "uuid": "443ccbbd-d5bc-4836-8986-f75706c7decb", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246062, "uuid": "1de83b61-0610-4750-b8ba-587ed4b74227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246062, "uuid": "ece3b885-6063-4814-9990-82fbb548c4f1", "value": "4aeeb6472c2a72563d4ec4ab86f55eb6b124b7940eac4b895832827728c968b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90b3e62-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244781, "uuid": "3a6663d0-affb-496b-8ed2-54d8d7e384db", "comment": "Malware payload", "value": "270a7b6a5537113ddfd9e0adeddde622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244781, "uuid": "2393f517-6546-40c1-869a-e75d69276878", "comment": "Malware payload", "value": "4b9848cc63f03e6df8eb6b958e275f86864d8ff5f9aeb6e7f6589c25672e95f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244781, "uuid": "112d9331-90c0-45c4-9fe9-0e163555257b", "comment": "Malware payload", "value": "48b0637220b794e0c887f8f28911efef23478789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244781, "uuid": "6cf80789-39e7-4104-bd5a-4b2d3156c174", "comment": "Malware payload", "value": "ee38eae7d0e1a5f50cf17dfe427951bb718d5012ef6779fddee84aa31e02ac871f31ee096950074fa2d23314326097eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244781, "uuid": "da5c5e3d-167e-4489-b6f5-b75a1e7a21d6", "value": "T12FA7BE26B50CD8A9F6760AB1D91275AD48773FF06B135483FD9036AF2B37690E9381C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244781, "uuid": "8d1f0f93-6cd6-4174-943e-b4e18a98d01f", "value": "d7e432b31a2364cbf33d4eb1b92d3b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244781, "uuid": "4097d851-36c7-4fda-8607-3b4823794e3e", "value": "393216:BZvaas8kTidCfARxq9/Me5xglH8l6IHMRwzP2I3A/AkqV1eWrbcPLzv5zZU8gn94:6+hRxqqt2MRe+I841B/cPfIT9wX+UNnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244781, "uuid": "0fb9ee1d-9e72-46c1-bd5b-9cf3c04eec07", "value": 44614418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244781, "uuid": "78446864-493d-45d0-83c2-234266b63038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244781, "uuid": "8a5a1bfe-3949-4f96-a2b0-8185790868a6", "value": "b5611d7aba6fae579dcd7d6e66717597f30053092467f47cc12d879a8ea40c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5688c327-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232537, "uuid": "d12eab10-298f-4f3b-b05f-b67976c2c194", "comment": "Malware payload", "value": "b9a30443c9dc6a2403d9232dab100afb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232537, "uuid": "8b51d4cf-cebe-4e8b-931b-17ecdd0e1443", "comment": "Malware payload", "value": "4b9a92bc2ba87c302fa3fc5090d588d9c2dc86a35b3caf61bba460a81b65dc9a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232537, "uuid": "ffefb8ec-db0c-42cb-b717-b02b3fab0395", "comment": "Malware payload", "value": "722f3c363481f972fa58628f7f1f5856eef44ac7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232537, "uuid": "70de4e69-40d1-4d47-a9e7-90e6c142065f", "comment": "Malware payload", "value": "e4aae030481f895471d001e40a2bfd86c98045bc44cbd9a9bd9eb90a56b9b97a4d16ad569b57cb56d052b61338a54039", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232537, "uuid": "4130573b-592e-426d-9fca-4ce8a8d09c01", "value": "T1F4A512C11D2A8777F8AA9B3D0642411EE65DACE1FA0BDD6EC7E0FC48575A81B0D03636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232537, "uuid": "c055e847-c864-4976-8418-df4c7ae9250d", "value": "49152:mIviiYREG4q/8wrnmX3haOdthYiYJ3mkV9+4a2xn:mWo4K8AmnhaOdtKPv9+4a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232537, "uuid": "20742d05-1f56-4f63-a572-df66a37d1785", "value": 2062904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232537, "uuid": "9d8dd9f8-b656-4f24-a9f9-224ada0fce45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232537, "uuid": "e36968a8-0f10-477d-8727-08ac4e4f9ffd", "value": "Road24 Jarimalar Tekshirish (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60449b72-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244579, "uuid": "1aa16923-e301-422d-a586-154c180a42f5", "comment": "Malware payload (Formbook)", "value": "d240b209819d0a53c06697556d4c52fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244579, "uuid": "07739ff0-dbcc-4292-bb4c-36d6cfbaf80f", "comment": "Malware payload (Formbook)", "value": "4bca6bd300ef6c13ca953027277a9d7b330cbfe02e7003c2c6883d303c1ec388", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244579, "uuid": "097da4f8-5085-4027-a39e-68e765f1965a", "comment": "Malware payload (Formbook)", "value": "d3b074a8951085b7c82646e4e3aa93b687a6e1ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244579, "uuid": "dae2e554-aff5-4a7e-9c6e-16fd320e3ff0", "comment": "Malware payload (Formbook)", "value": "93c41756a070595eb609f9ff5c9142cb52e3a898e294d562692b28466ef85755c199e6c7f8bf392729f2cfeff98ce412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244579, "uuid": "8dc68080-d917-4937-a4bc-f6fd5179fdff", "value": "T1E6350208626FCD03D17B47B948E1D07813B4AD9DD522D28B6FC97EDBB63AB844992703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244579, "uuid": "36518c86-a498-4516-840a-7227957329d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244579, "uuid": "931efca1-dbf3-4067-82ed-9c47dcd8a0cf", "value": "24576:AP/X/zYSkoSDXk8OEf3YG6ldxj89btAMP5Jv0wE4:A3vkS7ADvYG6fxgAjL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244579, "uuid": "bc5a4385-8a33-4b20-9946-f16fab46b1d1", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244579, "uuid": "2dfdbb96-e629-498b-9b36-2b89085d9c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244579, "uuid": "440af2f6-437e-419f-a423-f773ce7b063a", "value": "4bca6bd300ef6c13ca953027277a9d7b330cbfe02e7003c2c6883d303c1ec388", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dad8e0-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778236240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236240, "uuid": "876f6c53-9473-4ad8-88c0-9600a763fbf4", "comment": "Malware payload (AgentTesla)", "value": "8713845503127184d11604072b5de0dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236240, "uuid": "9c10c1a2-4bb1-4478-95f4-6d2971b7eeca", "comment": "Malware payload (AgentTesla)", "value": "4c139287c612e99f08a0c68edeadc131f8f6fa592b1f68083de4f4abb4c511ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236240, "uuid": "246413da-90ad-4b6e-b130-f40d4f1f02e1", "comment": "Malware payload (AgentTesla)", "value": "5e6a687d4f8ccba5b518ded14d8187e26d12d077", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236240, "uuid": "e7ccbf80-7707-4844-b8fa-7d8bff158429", "comment": "Malware payload (AgentTesla)", "value": "6b13e86a2b8480af14169dd936c32e698d44037cae0ff639d4f359caa7f7fe9078456b0254dd30f16b796eaadeb76183", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236240, "uuid": "60acb5a0-0da7-4e34-bed5-691fe34dc515", "value": "T177F5294927DAA5337768EB9C8236ED30990E501314CADF28356EE238351DD57E31BAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236240, "uuid": "b076a56e-0ddc-4912-93df-fa78bf8963cb", "value": "98304:hTqmwrFs0CmgB12NWJ1vGUoKwSgQqbZ+5BLCGkXXrUMtPLiAeepLc9V2nWD1:1Os9hBoN0ToBSgQq1+nLCGkHAMtTiRe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236240, "uuid": "6a89fbd7-13d1-4187-8ecc-f0b1df033c4d", "value": 3472966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236240, "uuid": "465dcf33-f5c9-4069-8bab-b57438ea9c1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236240, "uuid": "f6392b17-9e8e-403a-94b6-01df75a43ef5", "value": "HGJO9876789.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf04cde-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778242936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242936, "uuid": "41efef56-d5b6-401c-9b5a-b042c4010236", "comment": "Malware payload (AgentTesla)", "value": "91a14334034dada53777a95c101b54e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242936, "uuid": "a17662b1-fc15-4a0f-8156-eadab036cbb0", "comment": "Malware payload (AgentTesla)", "value": "4c71fcd0f1afdcab34d9b9e8701b64c9fd8326eaf31d6e24bf6a828baabc91ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242936, "uuid": "c9e0efff-358d-406c-b97a-387b636756d3", "comment": "Malware payload (AgentTesla)", "value": "cadd34c503d587e46cc15c2892bf8f06f8dfa2e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242936, "uuid": "b5716e9a-0835-4617-82e5-a82a2d18892e", "comment": "Malware payload (AgentTesla)", "value": "5d4dbb0372d75a76904db3ee0d4223565c0d036c9977932cbd242b2d706c3205c69c9c837e11442d3f421bc6d3236113", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242936, "uuid": "7bd67031-5e28-407d-8339-1e693439d26c", "value": "T19E55BF0273D1C062FF9B92734F5AF6115ABC79260123A62F13981DBAF9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242936, "uuid": "410cb93c-6bbb-4127-b003-6607f1636df6", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242936, "uuid": "4cc3885e-8c72-441e-ba52-e3bf468e0631", "value": "24576:m5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKp6mGj/H3IGtpX8:mPVt/LZeJbInQRaK8RIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242936, "uuid": "747d6c4c-7960-451c-b41f-ddbd8a9b7720", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242936, "uuid": "f36e9c50-12fe-47e6-9256-737cd22c7d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242936, "uuid": "42d71e5b-c706-42c3-b4ed-b92819978d5e", "value": "4c71fcd0f1afdcab34d9b9e8701b64c9fd8326eaf31d6e24bf6a828baabc91ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a82b05-4aa9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778222625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222625, "uuid": "5cebbdea-76ba-4225-83ae-3f21fb83391b", "comment": "Malware payload (Mirai)", "value": "c74385655907b94bd43058b6c3b636d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222625, "uuid": "bbc9672c-0cf7-4d4d-b10a-1ce204d52212", "comment": "Malware payload (Mirai)", "value": "4cd2dcf30071b0caf1ab3325b16450f3e5676a36095e56fe6c189f8a071ffa11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222625, "uuid": "fe4938b9-9684-4f22-a95c-b16ed68fe734", "comment": "Malware payload (Mirai)", "value": "8f69fdd0d0831808e5e8d6dea6c25af868838919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222625, "uuid": "b6edcfb8-d632-4f98-b7b3-ce38aeb1ef40", "comment": "Malware payload (Mirai)", "value": "61f816a2b2cd63daeb0bf6d759de6aff461cc78513cc16fcc70ebf845da5a985e35345d5009e55ae32fc39364ce0b724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222625, "uuid": "861acc92-c098-40a4-abf7-4b7008790a2b", "value": "T16C148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222625, "uuid": "ae594860-b6e4-47f8-8df8-29b963637136", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCRTUKG:BcYFAJ9/hjzsdjyuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778222625, "uuid": "d6f50b65-2ca0-4a71-8415-a6f7bdd307b8", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778222625, "uuid": "d2e9425f-777f-42a1-a9da-f2f33e188923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222625, "uuid": "e772b6e5-f6b2-48ca-81e3-a694625fdce6", "value": "xnxnxnxnxnxnxnxnmicroblazexnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a82e7-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232578, "uuid": "93f2b55b-9757-4af4-abf2-8b4652601b66", "comment": "Malware payload", "value": "57f1e75bf06c92b9a5a6b19d5b8ea9ef", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232578, "uuid": "bc650d82-a683-4c1b-ac62-a03c44f10514", "comment": "Malware payload", "value": "4cf416efc71277c8a5e16e91aff941917d6e98ffd0ba88c06466325743ddfb80", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232578, "uuid": "e074d641-e2d1-4816-8c89-862dff96ac8b", "comment": "Malware payload", "value": "204ab1770da4462f1da2c246f6bf220eea10f63c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232578, "uuid": "5d9f59b5-9b7d-467f-8084-5e2d15dfb2be", "comment": "Malware payload", "value": "6dfb6448a7a94510e5cf47f32cfd6ffa83320da31169b1e584091f2e15c8dc8947c8db7bce0927b467868ea4b29e4970", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232578, "uuid": "3ce6309c-9168-4924-a6cc-744681bd0fd5", "value": "T1D307CD23F5196996CED6E135B5E7479532300D480793A229271FF026FEF21CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232578, "uuid": "34fe35f8-d851-4cb7-989c-4c7a151df8cf", "value": "393216:C+BA0WNvRx7QlguMIB4XIX6f+HLX0YVF8rFkz8xsVT:9A0OvnaguHAO60VIe8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232578, "uuid": "8f63ff0c-138a-4ff3-b290-218f71e2fa54", "value": 17888844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232578, "uuid": "8c249f96-7207-4610-b6b9-2783b4a6292a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232578, "uuid": "ce9c1a41-ec23-4d8b-a50f-403de858e975", "value": "iMobile Lite (42).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f78bc66-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246644, "uuid": "1846abeb-68bb-44f0-9202-80d287edff2b", "comment": "Malware payload", "value": "cac2cc77cb64c6f4678eb4120204ff1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246644, "uuid": "d4f02075-6ec2-41c3-aa2c-5003f7a03dfc", "comment": "Malware payload", "value": "4cfcfd6371eefa5e4207358c7b0a7eda677c0ec4f1c3cbcafb6690db2235206e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246644, "uuid": "f674c894-48cf-41e5-82e1-0f30d93d1653", "comment": "Malware payload", "value": "422e0afec9410b1286aea08500a47b3d06f42514", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246644, "uuid": "f0395c6d-539d-42bf-ad81-508a277e0c37", "comment": "Malware payload", "value": "eb4903e4ea705e122e4d717decebd304ae59d3579985d4a3b89755e1671ebaccdc88f1568ace1fee6f7e3b50ee9dd4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246644, "uuid": "a242acfe-af17-43c1-8bf9-1f0fd1d6310f", "value": "T187C4201AEA51A02FF49389B0797956877C292E361790EC5BB7801F9930709ABF0F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246644, "uuid": "c0d73a22-8a11-4d37-9e22-ee00612174e1", "value": "bd54b99df92e87a275cf25fc2dc8c34a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246644, "uuid": "e35da924-6f12-4584-92dc-9f386c301c02", "value": "12288:bm8aGR0leKztqlVujYXHRBx54X1EjRUIxPmgOyM:b7aGyeK5I3TG10Po1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246644, "uuid": "ddeba646-9c0b-4192-8be9-ddc370b3bd70", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246644, "uuid": "b6564a62-8efb-4070-8107-0fe3543ccb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246644, "uuid": "eb5715f0-525d-483d-b98a-3436a1020aad", "value": "4cfcfd6371eefa5e4207358c7b0a7eda677c0ec4f1c3cbcafb6690db2235206e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cd6fef-4ad1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778240045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240045, "uuid": "495593c3-d311-4ad5-9cb0-2b2d1de4fa0d", "comment": "Malware payload", "value": "11fbcd1927646c4d28a718538227dd23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240045, "uuid": "266687fa-70c0-4aa1-b725-fb74c1745951", "comment": "Malware payload", "value": "4d032e5a0cfeb2e499206e27207c710fd406ebdfb1e91efa3dd2fa23c5a19f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240045, "uuid": "505764b7-9f15-45e8-956b-f4b7e5a0ddab", "comment": "Malware payload", "value": "72889fb222cbd854f43ac4a301b7105ee8384fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240045, "uuid": "ee9ff201-87cc-446d-a63b-a5cdd0e13c92", "comment": "Malware payload", "value": "6f015b029809d2c9362c562d4afad91010757f39f027d24155b578f3554ea79bac080e73f1a3da2ae4c60b6379be5927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240045, "uuid": "3388ae69-b148-4561-bc69-ef0b3c4a956b", "value": "T13A183348F9D53835C2D5A975E8B1427B02CEB20AC5537A0CA33AB33F7259B93C5A46CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240045, "uuid": "2adbb446-22b9-4e65-b155-926b45ac446b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240045, "uuid": "6184ceff-bcc0-4fbe-8be0-3b3ef5e3c444", "value": "1572864:kBM2u7dc2ImFq6uCoOB8z3tZ1ti7tYjQqQmlTjFnbsYagEeUi0vwKO6:0MTJym7uCo+spti7qjQqQydnY0UiNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240045, "uuid": "24a6f0cb-f8ef-411d-af61-6dcbf73c5878", "value": 89298417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240045, "uuid": "e9f7c5cc-0d64-473f-923b-40b2fa8e0411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240045, "uuid": "1ca40a6e-be7c-4a55-a81e-0878c2fa8b5c", "value": "GateMixerV2-Setup-0.2.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5347b7f-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778246037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246037, "uuid": "1ffc50ef-d289-4764-9b1b-ead8cd5a6339", "comment": "Malware payload (GuLoader)", "value": "f8b10e6b401a75924e5aeae2424cb18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246037, "uuid": "d97771f4-15eb-4b7f-89e9-a539c151c256", "comment": "Malware payload (GuLoader)", "value": "4d3082109ebebeca832d45f658758d0eb8ef3fff5c707f9de7a1420bcc4ffbc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246037, "uuid": "6dda609b-ac2a-49cc-bcfe-1d05584e127d", "comment": "Malware payload (GuLoader)", "value": "bb9f0a46b7cf56f18712c54af974554c71c21635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246037, "uuid": "0d82aaf5-9f5e-49ed-9e05-31531a9b595b", "comment": "Malware payload (GuLoader)", "value": "11c7fd27b26fd1143cd7ed57ab0d8618abf4a8e6723929bbc7b9ec24e2d513713ab649a49a2c8d4df456e745fa6054e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246037, "uuid": "1dfc3593-671a-4b3f-aa70-20c8edfd0b00", "value": "T1EB94E0147BA4C917FB40153496A1E77D8BB0EFBC1A1AD313ABF82C9F76747A52C25202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246037, "uuid": "46f084bc-13bd-48fe-881b-120d215a9274", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246037, "uuid": "d89b6201-c5d9-4879-ab37-9c4d1bc348dc", "value": "6144:AQ606xnSmhEWvRhKwvS0Lg94+zkqFp11Z9Y/LTbbYDVUMXYv/A:YphfDg94+gQP18/neyHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246037, "uuid": "4c6132ec-22ae-4c69-a75d-0a17bf0ffc06", "value": 415152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246037, "uuid": "fae54753-705d-4978-b0b4-30608c57f073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246037, "uuid": "84381c80-8cd7-4b8b-9c6a-2fd1df7a1457", "value": "4d3082109ebebeca832d45f658758d0eb8ef3fff5c707f9de7a1420bcc4ffbc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af6e746-4b07-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1778263011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263011, "uuid": "517614e6-56d5-44eb-9d4d-d9739eb84a4c", "comment": "Malware payload (RustyStealer)", "value": "42f5faaa6d195c4cbd9574a038438d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263011, "uuid": "51f02690-7173-41d3-9f66-edbfe20dffcf", "comment": "Malware payload (RustyStealer)", "value": "4d6355f4a967e7e85ccef14a9390bf08d1112598f2ff574beb316c77d24d5aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263011, "uuid": "4f0a99b7-fa57-40e5-91c8-218a41853503", "comment": "Malware payload (RustyStealer)", "value": "dc87fbd1aadf395967bcad2a8e9116e2f2b414ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778263011, "uuid": "04b20944-cf45-4460-a9d8-3882cf7c3073", "comment": "Malware payload (RustyStealer)", "value": "6fcb229a080e95102e2be063e8b349338da50c0bb6b41a1cd1fc81fe81c54ac5b7de6d05fb7fa22407278956e806a620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263011, "uuid": "19a644d6-a30d-4c35-bd0f-8504a8c1047e", "value": "T1DDA66B43F2A291ECC02AC074935AA233FA72B889073576EB57D44B313E56FD05A3DB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263011, "uuid": "8e5374ad-9267-4453-89bf-c121196e0a9f", "value": "903d3ee30488eeba206d7857e8801f6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263011, "uuid": "6135e3df-84d0-4473-b3cd-95e6309dee58", "value": "98304:5cvTsWQ1PX5KP4tW4NKxy8Y121VwIxyDK5gvFe3iRybjzSH+e:gQuAtsY2w/K5aF4CooV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778263011, "uuid": "93cd4d57-e1a0-4390-9527-5e00e0128c07", "value": 9661440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778263011, "uuid": "2075fab7-49fa-4578-81d6-88b4df1efb2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778263011, "uuid": "30c12a19-fbcc-41ab-b0a3-7cfb521b5f47", "value": "zenmetrics-agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a44993-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778244541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244541, "uuid": "769bb22d-355a-4e02-adcb-75e1cf7db83c", "comment": "Malware payload (MassLogger)", "value": "917caadce37257cc5825de22d4195ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244541, "uuid": "06f86f2b-d711-4a2f-a834-3168ad638fac", "comment": "Malware payload (MassLogger)", "value": "4d9ed967ac61a84a5e804a56833832140f3638818fd5a88a0670fb1353bca262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244541, "uuid": "c9a5f171-6167-4271-aec8-1621db537cf6", "comment": "Malware payload (MassLogger)", "value": "526c1747a744591fe20ddaa2a03f82884011051b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244541, "uuid": "6bc43e63-0fb3-48d7-a1b1-432875d54bf4", "comment": "Malware payload (MassLogger)", "value": "b3425abcc782da8699d1c604607cf92f900080612e8736c60c4c5373f8cd978703db23357f52389799e2189a0b07e937", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244541, "uuid": "321f891b-8db4-44df-be74-ca566b091c38", "value": "T133251202BBD180B2D57229355AB686501A7C7C302F618ADF53E07DAE6F316D1D632FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244541, "uuid": "35664ad4-4fcd-4b4b-ae70-d12697fd0a4b", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244541, "uuid": "7bd1a774-27ed-4dd3-874a-16e5cde3711b", "value": "24576:iN/BUBb+tYjBFHk+/+qnOAb78X1zJ54D+qN5pu:CpUlRhkIZOU8X1zJ5w+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244541, "uuid": "1f213fb7-d9b9-416b-8fe0-c05984ee522f", "value": 1055080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244541, "uuid": "3fc82f58-fd1c-4532-b2e9-21b3d1e7e7e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244541, "uuid": "0b647157-6b1e-4245-b21f-019a6d2fa23a", "value": "4d9ed967ac61a84a5e804a56833832140f3638818fd5a88a0670fb1353bca262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4dcd98-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778245891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245891, "uuid": "5fd8fa92-cd70-40d2-a3ea-8ff694ab7dfb", "comment": "Malware payload (DarkCloud)", "value": "e4c3bf8e3da4831ffc485d28fa37dc27", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245891, "uuid": "c339c2a3-252d-4885-a460-b8351e7b372c", "comment": "Malware payload (DarkCloud)", "value": "4e3ff4348f84ceb1078c8a578da894365b1b6b4a67a04b59d9647b4bd617a8a8", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245891, "uuid": "5eee0061-8642-45e5-a12e-f62467fa05e7", "comment": "Malware payload (DarkCloud)", "value": "c336597dac32c9f7e62fc8d01cee353fecc1e9e7", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245891, "uuid": "815a88c6-43f4-4413-9f46-7096943ca9fb", "comment": "Malware payload (DarkCloud)", "value": "05796e89c4ebf4cac1b2bc56abef2df534defe5ec35100e55c02911f36f3d7f7092258e821880bad78403e03e7ca7987", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245891, "uuid": "e136fdb6-2329-430e-a345-6062d22382ca", "value": "T1F8452358339DCA21D4BA6BF92CB2C1B41735AD9DD511C6875FC83EEBB036B881A19343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245891, "uuid": "cbe2a094-9822-4b4b-9add-f26d935dfc40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245891, "uuid": "0ae45894-ed1f-4ec9-8b1d-7ff25fe48621", "value": "24576:TXGdmhj9EKqJDH0/z+6QyfXVuN/NhomNb4hp:TWY9OJj0/z+YfwNhZbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245891, "uuid": "3f259f5f-05ff-467c-92bd-23b69632bb0d", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245891, "uuid": "7335a4c2-3380-4fa6-851c-c510fc9d1472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245891, "uuid": "5cfcf19d-3659-42d4-b1cb-3babe75130bd", "value": "4e3ff4348f84ceb1078c8a578da894365b1b6b4a67a04b59d9647b4bd617a8a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7600c5d-4ad3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778240860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240860, "uuid": "38e591e1-2b72-493e-a730-a1ac3f98be8b", "comment": "Malware payload", "value": "dd012c4db19389386f76b82a55260db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240860, "uuid": "0321fbb5-8681-493d-b0c3-aa875222a3f2", "comment": "Malware payload", "value": "4f675107416cd512d3f6120c34a6ea2c765a471db9d3c0d8cb30a7469b619cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240860, "uuid": "aa93bae8-73db-495b-b1fd-e59ae768cd07", "comment": "Malware payload", "value": "3f5f6ca2793fe9ff69ecdd2386f0aee6ebf221ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240860, "uuid": "8c1a4d11-6492-4339-9317-b14675cc0bb0", "comment": "Malware payload", "value": "c75df44f72daa9ccc05bfaf02976f507cb5b4d9d531e29555a7ee4b830a3f45ef2ea2eab184c4c30845c21b3144e6b3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240860, "uuid": "1673bca0-b561-4816-84db-47c22180301b", "value": "T1B6D33A06B30C0947E1633EF43B3B27E193DFDA8125E4EA40651FAE8A9172D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240860, "uuid": "9765caf4-fd53-447b-86a6-8561128d5345", "value": "1536:hJGxHeaefC/6cP9muYPlWoz3eYRofF086OvAtYQyMLdQtIs4Mh5rSw8UXHdSqU19:hJGx+mTY2fEHtYhIJAtHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240860, "uuid": "1e20890b-f3cc-41d5-9215-69f6e8214db8", "value": 133820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240860, "uuid": "97310510-393a-422d-b61e-921aa552e396", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240860, "uuid": "972189b2-74e8-4996-954c-edb892fabe0e", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed9f01a-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778244120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "699d1e2b-69ba-42f7-b377-2df79b735e8d", "comment": "Malware payload (RemcosRAT)", "value": "44d38161833409ae904e4bfc1a66cd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "re", "colour": "#3B5D7D", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "f2d07e13-2f7b-45db-b0e1-92adceaba2c7", "comment": "Malware payload (RemcosRAT)", "value": "4fc420c653923ac1d4c4b218d9b09bfd904cf00430392f28bb8dfa11c7bdebc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "re", "colour": "#3B5D7D", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "ae32825e-f955-4e90-b91f-550dc500cd1e", "comment": "Malware payload (RemcosRAT)", "value": "5f8143572337f01a0048f2d84088dd187bc62f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "re", "colour": "#3B5D7D", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244120, "uuid": "df5ad646-9fa5-4fd9-8feb-f7d33785cdbb", "comment": "Malware payload (RemcosRAT)", "value": "cb59e3bb1b64136b3c8ba75bfd14409270e25052f8a57a8a08f33e1e910e853f8fc6151cbca0b14ffc8d2b88878bff4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "re", "colour": "#3B5D7D", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "24f4e783-4a59-40f4-bf42-b264249bce35", "value": "T13294AEE2E25098A5D82A533484339A3127779D6DADB58B4F175E7064BFF33C22067E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "1e4480cc-5eac-4672-9884-f1ed86d21840", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "383fe00d-48fa-47dc-b195-7377e73cf132", "value": "6144:C3hqLfyApabvBMFFFFFF+FFFvEPQiEnO2vhn5YmZYFr6szy94dSHSIQayrTeiVC2:C3eySeIfEnOChn5tyI6eoCI5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244120, "uuid": "d1cd881a-7226-45dc-83b5-0ef92242a5a0", "value": 431720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244120, "uuid": "ffdd206c-3083-41a9-962f-56133c229c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244120, "uuid": "11a15d20-bf42-409e-95b3-b786182b53a7", "value": "4fc420c653923ac1d4c4b218d9b09bfd904cf00430392f28bb8dfa11c7bdebc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693a78e6-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243305, "uuid": "f9cb553c-50fc-4510-b923-b8d31d466192", "comment": "Malware payload (Formbook)", "value": "2e39deac50d80271c52487689bae229e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243305, "uuid": "ae28e1a2-8ebd-4580-ad05-0031672782c5", "comment": "Malware payload (Formbook)", "value": "4fd43da6fed2ed8731e22c1ba6d933e96dbb6895e08c5c379ee1ee217389bdb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243305, "uuid": "e1030888-93e4-4d30-a8cd-c82d996bb3ef", "comment": "Malware payload (Formbook)", "value": "746b2b9002482b013ae32481fedbce5b7afca5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243305, "uuid": "90398946-c1ee-46ff-a03f-240bebda94a5", "comment": "Malware payload (Formbook)", "value": "fa65697b666ba98f8117f6558b9c39ca6d7dca752fed0585d0e13a1cc05711b1593d473bde917e8b47b566fe9d88f820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243305, "uuid": "092919be-a026-490b-ade0-db9d08661b91", "value": "T11645BF0273D1D062FFAB92334B56F6115BBC79260123AA1F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243305, "uuid": "b21724ec-ec63-4090-8c6a-3936a45b951d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243305, "uuid": "4468c4c9-8c4f-471e-bf36-d50b62c3ff5e", "value": "24576:T5EmXFtKaL4/oFe5T9yyXYfP1ijXdaWNHoDW0nVr3aKP:TPVt/LZeJbInQRaWB4vF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243305, "uuid": "39fdbf06-5166-4f84-a378-96dfcb6fe9a0", "value": 1245696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243305, "uuid": "ac7251b6-4f63-47c5-91c7-c35d52347c44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243305, "uuid": "e24f3b2b-f6b9-4f29-b235-e3dc1bcce24a", "value": "4fd43da6fed2ed8731e22c1ba6d933e96dbb6895e08c5c379ee1ee217389bdb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6126dedd-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244151, "uuid": "319749a0-4e43-4163-bc32-cd5115a74898", "comment": "Malware payload", "value": "d8bb222f662936f72664bf4ba63c7fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244151, "uuid": "b4c24a32-c919-4b10-8235-7a3fcdef8d3a", "comment": "Malware payload", "value": "5058ac8849ee18765d5878810e6db3889112e2d2e32850f9b698d323d1b35cb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244151, "uuid": "5cb40390-2224-413e-8e89-d7d8da246dfd", "comment": "Malware payload", "value": "a9781165eb07c94205ed99603a3d8c6caf1d782b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244151, "uuid": "48024b9b-1f68-4ce0-b614-47d42242474a", "comment": "Malware payload", "value": "b81bf5e2726c426c529b25db9c2bdbb8695249007d52b2bac78c5a1916cd3238a1bdbfbbb2ebcee3f80e69fb28f36192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244151, "uuid": "6ee5c7e8-cdf8-450f-9b58-67dc7e4a59d3", "value": "T12FE3124B3BE4F311CA6F8775B8730E0004F5FB494A169F6697A1E0578F37A1A1AC47A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244151, "uuid": "5f0458dd-438c-4072-89bb-aacf7591f1ba", "value": "3072:+VFn+CQ6sXoF2wM6y7wCHIu0rFzpXydvcWT+bANg4GZqGE3:wnQ6PFwt7n70xzpXyqW6bJ4GZqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244151, "uuid": "fa28b601-b02c-44c8-ae74-a0c2cbe4f499", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244151, "uuid": "d1b58b20-0737-4300-899e-17087945142c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244151, "uuid": "625de3b1-d994-4a4f-b1c9-6730da29425b", "value": "5058ac8849ee18765d5878810e6db3889112e2d2e32850f9b698d323d1b35cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d73a8a-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281097, "uuid": "1b3627ba-4c3e-46a2-8985-a598b5b6fc0b", "comment": "Malware payload (Mirai)", "value": "03f197b52e1483cff72ed9e02790ed17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281097, "uuid": "3d67b210-e1b5-4ae3-a858-f4ec9621f144", "comment": "Malware payload (Mirai)", "value": "51ab1b2d3817996dabfda08232c1f21b0f42545d365e3bcb55ca5cd750c33535", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281097, "uuid": "6f11174d-bc69-43a6-bd18-c4f8993c55ed", "comment": "Malware payload (Mirai)", "value": "d6734e49e716b66296d4301cb7e1bc4298c54743", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281097, "uuid": "ae1eb1ae-ef80-4a26-a4be-77764843f30d", "comment": "Malware payload (Mirai)", "value": "4a1daacf007fffff69220ee5d1fd7dde69f26af14e2e79ef0b0b4dcb96992d9c38fafbde130f82eac4cc479d18493ab2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281097, "uuid": "d1b4c8ff-f68f-41a7-bf2d-76272706ff5d", "value": "T1AA93AD33C52A6DD4D6559674E0F48AF81B63E50082671FBB19D8C5E95087EBCF20A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281097, "uuid": "dfa820c8-19cb-4bf8-8604-ab40a195fb0b", "value": "1536:CGKS0rFc8wtAGzd8qjeCckbJcNcnwCQQjCTFilbQqK+UAA7ULEKwvCpuJUEFW8Ig:CG70rFc89GBxjeCcEeWnDWYQt+mmEKwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281097, "uuid": "1a557130-4b7e-434d-b245-8de330ccdfa1", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281097, "uuid": "0d0e5540-a40d-4106-9570-32f8ba365e05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281097, "uuid": "3e49cdf9-09d3-4034-b006-168621520a84", "value": "nerv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4386722-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245659, "uuid": "25860adf-36a7-4724-82a7-4338bd6f4b5e", "comment": "Malware payload (Formbook)", "value": "ba01a66f53cb2d4c922034d67a13925c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245659, "uuid": "3ec3b3fa-0bdd-4d8f-b7e7-f7606f020202", "comment": "Malware payload (Formbook)", "value": "51ad3ddb123760ca4e3ab2a8eaaac285eed9ddc3bc27387388fd1d93c96fb967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245659, "uuid": "c4ee1d20-cef5-4c7b-afcc-27885da03169", "comment": "Malware payload (Formbook)", "value": "36037fe5966b8bd362ffa61e62ec9ab222c5c1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245659, "uuid": "87ba65e9-f179-41f6-977e-a3cbfe59b2bc", "comment": "Malware payload (Formbook)", "value": "027996dffeb9da0f6486d72a04f583a512980920df4219561265abd008160e9841b1301f8ce59881d728d9cae977ee02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245659, "uuid": "0faea9d5-2bf0-4258-8bf5-6deaa7d839ee", "value": "T1C92512A992A8C606E1A60F740936E07427B96CDDF620C20F9FCD7EDFB57A7100599353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245659, "uuid": "02851c02-b5bf-4c1b-a867-4072c2f1218f", "value": "24576:PUYXJULWxQlBYQBDo9QnMdd2cg9SJS0vXi:pyjnRpnMe+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245659, "uuid": "929ee8db-4950-4155-aa6b-3072c96957c5", "value": 1026048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245659, "uuid": "2a16b8c6-9adb-4cf0-b3be-ec47800507af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245659, "uuid": "7c0407fc-6edb-48a3-9673-98a2cc0f8a25", "value": "51ad3ddb123760ca4e3ab2a8eaaac285eed9ddc3bc27387388fd1d93c96fb967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e99040-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778236502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236502, "uuid": "2b146e4a-74aa-4de3-8043-eb175ffa5d3a", "comment": "Malware payload (AsyncRAT)", "value": "49cb9069b85abb848febad5884d61a5f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236502, "uuid": "b2b31b78-731a-4ced-b152-1abab1ad5c97", "comment": "Malware payload (AsyncRAT)", "value": "51cf4209be2c160f3182f2488e68eec40edd7e9f9f76224fa4b66d4ec74a35bd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236502, "uuid": "367d578a-bc5f-47c0-9469-fe5b6edda61a", "comment": "Malware payload (AsyncRAT)", "value": "fdd260f303aba9acd08772b397fa05d4820413b8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236502, "uuid": "4253f42f-615a-4579-9c64-46e539e81109", "comment": "Malware payload (AsyncRAT)", "value": "39776decaa3c93a274cdc23963b0294b9b83e8ccc09c632d1e06ed1425f39d22b147db9a39ba3e5bf3c2f0f9e260e12a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236502, "uuid": "dc2427a0-7363-4090-843a-ca924ac83ef0", "value": "T149D5AF315E84BAB0D3DB01E3F514D99DE5EE671B290DEEC9C1EA4D0523808F89CDD4AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236502, "uuid": "229600ae-42ed-4578-9770-f5eac9109e02", "value": "768:7uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuT:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236502, "uuid": "86b13cda-54fc-438a-917a-414779eb014b", "value": 2875612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236502, "uuid": "bb2beaaf-9af5-42db-9e4f-293a22b21202", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236502, "uuid": "90d2b77d-f051-494e-9696-196af7af9660", "value": "WhatsApp IMG 07-05-26 Payment advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb746275-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778242665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242665, "uuid": "99ddaf50-80aa-443b-b901-76ce5b3829f2", "comment": "Malware payload (DarkCloud)", "value": "e18dceb4199236f1daae26bf8189ced2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242665, "uuid": "b713d045-ac52-44c9-8251-185be2460c73", "comment": "Malware payload (DarkCloud)", "value": "51d23707b5682e7387015825411fd581f5e485befeffc766177fc28decb448c5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242665, "uuid": "bb4acad3-9ad7-44fe-ac9f-93d8ac41c67d", "comment": "Malware payload (DarkCloud)", "value": "1741a79bdad5b12ed5fabd245c95597b35363114", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242665, "uuid": "1c90b4f1-2803-425c-9582-e352460cdd29", "comment": "Malware payload (DarkCloud)", "value": "b0eacfdc513d2fd471a9c882416f78219f91a7e1cbd56478a9e6343e144d0983e20ca66a8ef93f8e31b79d41e1f47ac3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242665, "uuid": "171c9e59-03e0-4446-b393-2f58b7817fe2", "value": "T1B8845A23EA50B12EF1A3C9F1B9A5A25728263D3A5688EC57B3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242665, "uuid": "94e12d4d-0dca-4442-8ad3-bab255e51af9", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242665, "uuid": "4101930a-804f-4d0e-9ebc-767ef10add0f", "value": "6144:o8d1/w5KA81IJ8GpF6nuTmOOUWTmsiNE4EnvFEsvyF6GCyHxxB/7k:rjYKkJj6GmZUWiCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242665, "uuid": "86b954f1-d246-4c81-99bc-961327af8511", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242665, "uuid": "b23e7088-fbfe-43ad-8787-81f8e89541c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242665, "uuid": "97879df5-9e71-4d4c-809d-1b9b0b8c6079", "value": "51d23707b5682e7387015825411fd581f5e485befeffc766177fc28decb448c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a9d859-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778245709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245709, "uuid": "3d4721ac-59f1-4cb7-b549-d2194a9dae50", "comment": "Malware payload (DarkCloud)", "value": "5a159864a37d010a8cc62c1a3f7ea8cb", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245709, "uuid": "4e5c5e5b-9169-400c-b847-eb8e4a674d5b", "comment": "Malware payload (DarkCloud)", "value": "51ec6daf279d7b5c39fd85cd7da0b00d4b9cd29f57a56abbb42ae9d07997cba1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245709, "uuid": "437d4d81-e9b2-4637-8354-1446b6ff8d09", "comment": "Malware payload (DarkCloud)", "value": "8e9765f38a5c498e4dab37d61e934c40178aabaa", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245709, "uuid": "d4f483e0-ba50-4d69-9f89-088b961bc3b8", "comment": "Malware payload (DarkCloud)", "value": "7be49dd8b40062ea8171c5447602ccb75ca500ff5192346ebedd3436e3cdf12433429c55b020fb77f42f477c89bc0450", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245709, "uuid": "baf06faf-1e4c-41c1-9bf2-0a8f99c54fb6", "value": "T1904522286368C816D0A307B00DB2D2791B786E0DE922EB075FDE7DDFB0BD7585A59342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245709, "uuid": "c6d86425-b6e6-4e47-88c6-4a8a7f14a507", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245709, "uuid": "bfbafc86-7f9c-40dd-9618-f6afbbbd5fd9", "value": "24576:YXVp1oHwKzWBvdaYf9dZFrMHOp19ldX7RpV1Dth/da2h:YH15uklayT4HOpTBVthk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245709, "uuid": "b591cba9-70b8-42ec-b8f8-9119176dc6af", "value": 1184768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245709, "uuid": "153331eb-b755-4e9d-aae8-ed4820edd35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245709, "uuid": "4bcb248a-58bd-4a0e-b4c4-206cfac3e4e9", "value": "51ec6daf279d7b5c39fd85cd7da0b00d4b9cd29f57a56abbb42ae9d07997cba1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf500da-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236789, "uuid": "2aeca066-01fe-4778-82a4-e3b5ed1c7aad", "comment": "Malware payload", "value": "d8185b12b82221ca6bd4a1b808379e32", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236789, "uuid": "05bbc31d-7996-4f8f-abbb-dc7131e61d02", "comment": "Malware payload", "value": "523310a292fd3253ed7a21ff37761d1e7a427e619d0b81769ff6f822e3607b6a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236789, "uuid": "09c8520a-686d-44f2-97ba-db623a449a77", "comment": "Malware payload", "value": "d1f7789a30d1085d95fd9f6ace44f2cae7a3abf7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236789, "uuid": "f0ec74b5-39c6-4c59-8412-5ff97d4616c5", "comment": "Malware payload", "value": "9964449736ef084690d362f6c8918232c8ade806f9bcfc3376c8a54c90d3c30a43e458bdda96ee0c7a4df56a964311b3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236789, "uuid": "a1775443-aacb-4b45-b288-ae140e30bd8f", "value": "T13B21506C41862B31D2F58675A8D2B613B6327C53FEDA1F0D058743814D5B116B552E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236789, "uuid": "8be0c285-925e-4b2c-b23b-3af47324a09d", "value": "24:8+dsGk1KGNoYH7+NJkjsrUAbQXirL2veoo8ooDtDNM8kmu:88sG23Nt6kjqYgOnDNM8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236789, "uuid": "2404db16-c7ab-4932-893f-d4be0c39f1d7", "value": 1197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236789, "uuid": "6964399a-6834-4083-b978-8348b5c40442", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236789, "uuid": "49a3d8f1-1038-4175-9b7b-678927896248", "value": "00001000000724788166.cer.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0a406e-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1778244389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244389, "uuid": "10fe4bb7-b536-4ee5-9fbd-233d59fadaa0", "comment": "Malware payload (Amadey)", "value": "418dc866e5d2b86187641750dfb87dc0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244389, "uuid": "3fd1904c-d260-499f-9349-4a3cc21406eb", "comment": "Malware payload (Amadey)", "value": "5258a241f8c67e1666060e2c033d127dee8c2c50c7a8dfe0676264e9cb6762c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244389, "uuid": "dbd0ee1a-4c07-47f1-8612-1140870f4590", "comment": "Malware payload (Amadey)", "value": "5866d10ef49c2bbdd98f89face2eec470a5fce4a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244389, "uuid": "2c10efc0-cf0e-4fe8-8565-bd62ec42ea26", "comment": "Malware payload (Amadey)", "value": "d50a17bebf660cfb3d60322d8eb5182f7de69a753f64cd3e5588942bb9390a1ba7395f0b06155ddf9811926446049955", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244389, "uuid": "c0aa23aa-a7d8-44fa-86ca-0e4ff7e9c11e", "value": "T1FDB44A5AA25943FDE07BA17CD9535E42F639744703B18AEF039005772E532E2AF3AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244389, "uuid": "874520aa-6834-47c1-abed-9437e0401068", "value": "8db30f7f23140d78d7f34e827c0f7dbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244389, "uuid": "65cbdf41-e2ed-4411-b575-83d4821fbe11", "value": "6144:LyB4DWmxd3DH+SOe3I3qEQ1kRtFlHvNzubRDePTRBhUCaraPOlfj1ohwVL8On:Lyi5h+SU3VQ1kRDhv0ibRQno6VLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244389, "uuid": "8a6ca08b-f288-4143-8742-afd9b0b1c0ba", "value": 528896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244389, "uuid": "dbc8b48b-e8dd-4964-bd94-c6c3318e5f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244389, "uuid": "ae92e1cb-4b60-4b48-991a-53cef0a7405e", "value": "5258a241f8c67e1666060e2c033d127dee8c2c50c7a8dfe0676264e9cb6762c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00706bab-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236687, "uuid": "3d745fa5-f7f6-4c43-9718-f52a534c70f8", "comment": "Malware payload", "value": "6c5fc61c8a7afd43f40eac3b0e0b7f6f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236687, "uuid": "718af337-7fb2-4f93-97cf-0e1e1bb34593", "comment": "Malware payload", "value": "538f13368716967d93701e630a36a173b771bb7b185f6aa71cf343c06d172d07", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236687, "uuid": "c89fc303-5d90-43cb-a035-c5fc2d71faec", "comment": "Malware payload", "value": "762475b87317b7e3371e27e5f81a018b7d4b2693", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236687, "uuid": "84f9fc6c-756e-4921-b2ce-db33e742b1f3", "comment": "Malware payload", "value": "9cc74eaaeffb48b158c55b63a56b1b31dd9d33f15fa55f5bcd9f3e824da3621bacaca107a9d49dd48762650a11f4ad40", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236687, "uuid": "91051f76-8331-46c9-b67a-f6d388567e6e", "value": "T1D9C5C8F8794E156CC156ADF733875C3AE5743CBF38141A92297C2A9C0E5AEBCCA98314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236687, "uuid": "fcba7640-4652-4986-aee8-fe637584f486", "value": "768:HYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrYrC:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236687, "uuid": "e5c59b31-51df-4b60-af38-4ea425a14300", "value": 2715143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236687, "uuid": "9653dff5-c9ea-4b2c-846f-3e82d404dc74", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236687, "uuid": "44124dfb-deaa-43bb-9aa4-ed315edf6d5c", "value": "RFQ_Imagen_del_Producto_2026-05-06_jpg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eab0ff-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778244157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244157, "uuid": "574aa71d-490e-465a-b949-18931cfd3fd6", "comment": "Malware payload (GuLoader)", "value": "c84597aa4d5b05886c63028929a811bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244157, "uuid": "78afee90-5843-4555-b544-69b48372091e", "comment": "Malware payload (GuLoader)", "value": "53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244157, "uuid": "ece60d9e-c702-46da-9cc3-9ed827f19c86", "comment": "Malware payload (GuLoader)", "value": "9bba6cab2353e26957cbb60d34a9ac2d2cf02fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244157, "uuid": "2a0af483-d1a2-4519-a646-a206ea8679c8", "comment": "Malware payload (GuLoader)", "value": "1c8a23ba2940d4b7e0920e42749af607849f9be9fa8a87831d444fd87308c8e8de66e6eaad4650dbe5f0c6c5ecae80fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244157, "uuid": "409b5bc4-a6b2-4ea6-b9e2-35ba4637df13", "value": "T1F3B4F10377C1D6EBD839433199AB83566776FD125B822B073348B71C6DB22921A4B78E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244157, "uuid": "55ec8a09-ec78-4ff9-903c-4c8b2b9f44d3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244157, "uuid": "b1b6b66f-ea1c-4087-9d45-e38311cb17b9", "value": "12288:Mfr9Ji2eibUKo7/0Bslgxo8oO8tbV+1DL:Mfr9JVxHQgxoLZ+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244157, "uuid": "a95e6f59-98c5-47e1-bf65-f6d8f8dff1ec", "value": 497424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244157, "uuid": "668fac3a-47af-494b-8c31-6d7229fb5d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244157, "uuid": "d940c988-836c-4725-8610-9451f00fbea8", "value": "53c477c90fc19475857f50ad4ca3e4c678592414cd5c79139708e0b56480c564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c7e62b-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Jalapeno)", "timestamp": 1778242684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242684, "uuid": "82a431bd-e278-4152-82dd-e7a0be18ed88", "comment": "Malware payload (Jalapeno)", "value": "30f22cfe8ab91d3583e46a52f63f9407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242684, "uuid": "66ab6698-eb14-4883-a7d1-5cb9647cd928", "comment": "Malware payload (Jalapeno)", "value": "540d059bc4ebf981b73bdc0ea48d32a4f79154e009c5629f549abeb01c8944cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242684, "uuid": "c5855310-f1ec-4770-8001-768d7028efab", "comment": "Malware payload (Jalapeno)", "value": "d94158fef3b524c8988d08ca22bc8e37fc9d1f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242684, "uuid": "998cc77e-8d60-4fa4-966f-7b125a0c3cfa", "comment": "Malware payload (Jalapeno)", "value": "413e877663a70a703eb71c952fa7d517c0c024aab53a8ce5a74870d88e4109afb4837de44bcec78ad557b0576b737d45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242684, "uuid": "a2e94bf0-e1fa-4c7d-8f07-78a82d12d9f6", "value": "T1EA433A74DAC4ACC4C75BA371746AA3C603A75E076C3A078C5AEC39671B73390663937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242684, "uuid": "0059c5fe-f319-491a-9c2a-a8893792d12d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242684, "uuid": "ca00fdb8-2030-4437-9c5e-6fb73eb2608c", "value": "1536:vmb2mhVVAnjWhgMbyLYkdQ3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW:vmblUCgM4dZDud7r6GiX8QiQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242684, "uuid": "025d10d0-0d43-4e8e-9d32-1866387c74b5", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242684, "uuid": "4b69c252-3c4f-4a10-a583-8f4a795ed59e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242684, "uuid": "f5174bcf-b5d1-4285-9125-7e751e33426f", "value": "540d059bc4ebf981b73bdc0ea48d32a4f79154e009c5629f549abeb01c8944cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc80a6c-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1778244357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244357, "uuid": "71745b61-d905-4fe0-9f94-c928d8cca9c0", "comment": "Malware payload (OffLoader)", "value": "af560e5932dca81ab79078569423dc36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244357, "uuid": "6abb8b5b-a4a6-4e10-a217-c078b7a7b8ec", "comment": "Malware payload (OffLoader)", "value": "542be1d36c895eee95b91e241940dd2446cd4097c388b8c5e0e613214ebb8bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244357, "uuid": "9a7924ac-5a26-4f47-bb2a-24af10fbc5fc", "comment": "Malware payload (OffLoader)", "value": "6d327cf150e194ffbc577b8e817002319eef24ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244357, "uuid": "780667e2-bd2f-4e61-be1b-70eb2f47d4d5", "comment": "Malware payload (OffLoader)", "value": "929f85fa2e9d2f410f3cca38a09fbe2fc84acda0d8f0e99395f7f78f715466cac18e19b1439d23823881d78d1810ecb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244357, "uuid": "28eab267-199d-4bbf-b11a-3080e6befdb2", "value": "T1104602E3AE46733DE06A0A3779B2913C5D3B6E11651A8C4296E6FC4CCF3A0601D7E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244357, "uuid": "89a18f87-72a6-4242-bcdd-31bec8fc0cfe", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244357, "uuid": "14df650a-2b37-4056-b127-f21814c04883", "value": "98304:wN66oTIjw41EPb/lywfmlAq+jaMWicEogcn:koTIjw4uPbdywemqQaMlogc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244357, "uuid": "f5dd45b6-ffc4-4693-8c0c-656d3acb3d25", "value": 5627014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244357, "uuid": "3046f38b-4842-45bd-a45b-ebdec21437d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244357, "uuid": "b1372128-e9ca-4ec2-9fc7-6f755b65ca61", "value": "542be1d36c895eee95b91e241940dd2446cd4097c388b8c5e0e613214ebb8bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722499a5-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245897, "uuid": "fff4aad8-0ff3-4650-ae77-f826b33331ba", "comment": "Malware payload", "value": "2f38b044dec77e29dc9a53615fbc789d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245897, "uuid": "1f44bc98-1ab3-449a-be7c-b52554634ea5", "comment": "Malware payload", "value": "54ebd41eb2327ff2d31f44e20a916ff0ce32aefbecdc0ccd3e68ec039bc52222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245897, "uuid": "7aacbeac-caf3-4549-92eb-853dd49229cd", "comment": "Malware payload", "value": "a61b09dce56664f291b60064246a9e63186b3049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245897, "uuid": "78f25a27-6941-4d26-a5c3-7433e76f6a7a", "comment": "Malware payload", "value": "545205a0367ac1900740aae6570d049c479497cea16daf644170b91e33459d560778bce286fdfccaf42a7cf64968a572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245897, "uuid": "345dc18c-7864-458a-971d-374e6bc693f2", "value": "T1A6A52321316DD805C6C42A3148E9E03627A46F88B112CB87FEF57F8F7A7A7153A983D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245897, "uuid": "60a16c6f-a9fe-4dbb-a052-3bdea1a9e24d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245897, "uuid": "2b5573c0-2b1b-4b04-9b7e-54119d777be2", "value": "24576:FaXehUZPMzgyN3M0g8isyKKgIAawgTkeQO+xk3H22vdG2GlrNtXfX8lPvu:wMUrTs1gQeQOEl2vc2wnvXO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245897, "uuid": "0ee9e52e-95a1-4eb7-be07-e6c5cc1d74d3", "value": 2080776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245897, "uuid": "d1a63cac-d87b-4413-8d0e-ac84118f8807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245897, "uuid": "7ff47b8c-518d-47e2-ad6b-766e0a5a0299", "value": "54ebd41eb2327ff2d31f44e20a916ff0ce32aefbecdc0ccd3e68ec039bc52222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e73a368-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778236469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236469, "uuid": "48ed7944-6196-447d-9a34-e61e7887139a", "comment": "Malware payload (RemcosRAT)", "value": "3d988da1b349fd6431e2e249e540f07b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236469, "uuid": "3878ce55-3f91-4b84-8b7c-002bc3e14d52", "comment": "Malware payload (RemcosRAT)", "value": "551abc5859c53a93d1c7098ddbd6b351849fc01e1ed2994001652161eb6462a5", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236469, "uuid": "7b3f1a78-7ed1-4e7c-a18c-87c64a101da5", "comment": "Malware payload (RemcosRAT)", "value": "0585ffc50c91891af94e2fd84e07eb12d89e04d0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236469, "uuid": "c37b2138-6148-4094-ba5d-7774ca62a8bb", "comment": "Malware payload (RemcosRAT)", "value": "f4712baabffb219ea6a585838871b843eed01cc7acff96e2fcdc61683123f0705fafae94d226f31268496d7645bf2c9e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236469, "uuid": "1d8afbc7-eb68-4cfc-8abc-2336c1bf8187", "value": "T106D6C6A16B6C863656FBB3EECAFBC8084153DD8E3075926C46604C16BBD34EC25C5FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236469, "uuid": "7d84f1f3-10c4-4aed-bfea-1d62b7eabbae", "value": "384:2JW1EX8VScUFLJzZaGY1Y8niCQRLwvoZNRyrT0LeiRQPI+cZBZ6dAuxExkF+NdcC:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236469, "uuid": "e9bbb581-ab1f-4827-9204-9f36dc83d905", "value": 13789390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236469, "uuid": "e737abbe-fa2b-496a-8baf-593e03085d2c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236469, "uuid": "f2963a1f-f1e9-4d16-b8b1-b5e9708bb3df", "value": "PO#50426.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba5fae9-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246450, "uuid": "4d2a8142-24c6-41dc-a949-cdfcd08b2b48", "comment": "Malware payload", "value": "32d9b1d4c42db76aa9649411c8758a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246450, "uuid": "7b730988-3193-47c9-9ed5-c3d379db0ce2", "comment": "Malware payload", "value": "559fd0c22aa3bedb9cacc9cb8eca2ea4d0c3cc68f95bc46b3233bbab8e4c7e57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246450, "uuid": "298a3b46-b41d-4967-b795-3b7ce206f920", "comment": "Malware payload", "value": "88ad7158ca80fd6c28986f57ca182a7393907f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246450, "uuid": "f1fbdd2b-c6c7-442a-9a3c-ea22440dc6f9", "comment": "Malware payload", "value": "76260dba0427b66cac8173cb2f5ec8cb239990a0455923b2367807572fc4f0be00b3d0dbb0bb1b581aa8490f046008a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246450, "uuid": "b219cdc5-d4df-4c55-abf0-62bd2519721b", "value": "T122A2937DD5E5FCD0C76B22F078AAB7C301AADB177D2B1B6CF9C814411A24354AB78688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246450, "uuid": "1c184f2b-a6d5-48b1-be16-eac72ccf555c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246450, "uuid": "54496da8-24bd-4091-b185-7028bd6c0c9c", "value": "384:2z57Ngy0RmG84b1PkGSsjt9GjcTPSFhWPMyMc1XVf4V3/XFx82LX9+IELX4+9xJr:2z57Ngy0R73bFPvGYuXML63/VzR+hXD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246450, "uuid": "f9642391-4542-48ac-a5bc-ef65728cd8dd", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246450, "uuid": "e5bf1193-6e97-4c6f-b197-d17c5741c58b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246450, "uuid": "b154ca21-e439-4250-a388-e271173f932a", "value": "559fd0c22aa3bedb9cacc9cb8eca2ea4d0c3cc68f95bc46b3233bbab8e4c7e57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e894c2ab-4af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778255974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255974, "uuid": "2e131010-cd38-4fd4-be7c-2c2cfd188bf8", "comment": "Malware payload", "value": "8f785cb7955fb2d7b0914fc8e1e85e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255974, "uuid": "bf3304ce-ea60-49d0-a535-d9090dd40615", "comment": "Malware payload", "value": "55cc92328ebc4ece766dc058268bb0659a796d0b3e271b032f7186e94493d3a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255974, "uuid": "2a1808c7-793a-4682-8f4e-2748276dcba9", "comment": "Malware payload", "value": "598265455a9f1b06721d4c785460f0a4ca844849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255974, "uuid": "c6729175-5a19-4e28-856e-31285ec5bdcc", "comment": "Malware payload", "value": "1a1e9c961c0476b0659acafe5fdf7925f9f1d87fc5234aa9fe1709dd061c4007a3214999feba04fe4f476601642c17c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255974, "uuid": "bbf82ca7-e405-45be-bdf4-102a0458e70c", "value": "T132748CBAE25911E8E6ABC174D9920742E731B81D4735A2E7D67503423E33AD0CE7CB78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255974, "uuid": "60b842cc-3dc3-40b6-bc04-7fa087932407", "value": "a830c97b7498a71c0e88fd116c9c0d5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255974, "uuid": "c071b437-51dc-45b9-b443-80b80fd4c4cb", "value": "6144:qkjgTr8XJdA112RYyOamDWsRqF/we2aHcnEJFBP:qkjCr8XsCay9oWsRiz2/EHBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778255974, "uuid": "effbdd4e-9cf4-4f0d-b48c-33ad9bb57c6c", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778255974, "uuid": "0b916d5a-ab44-4d77-94dd-2315ec967709", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255974, "uuid": "331b3d5f-95ce-4ae4-bd7c-5e036aba9603", "value": "2026\u5e74\u7b2c2\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d87144-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244395, "uuid": "2827b6d3-d7c8-451c-b3a7-59653e3ff2b4", "comment": "Malware payload (a310Logger)", "value": "7e4f0692998890226e602b04b6042a0a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244395, "uuid": "c8ba9fd6-2c79-47fa-9bb7-467806d9ca6a", "comment": "Malware payload (a310Logger)", "value": "55ee3babece77478c86b3e782b3d8f5288f3af1563ada1d766bd8d91a7a13275", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244395, "uuid": "b3b6eba6-1b99-4437-b32f-9c93b18c8e1f", "comment": "Malware payload (a310Logger)", "value": "cf2ef4eed0b9eca8436a014549073e2d2a13f82c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244395, "uuid": "68265021-6bb1-4ff6-9c3b-5413a9f0354f", "comment": "Malware payload (a310Logger)", "value": "db52746e9b1c7ade2a4e35783b83b6b699ebf206f2aa58919abd114e2a2f2a760f37349b36ba1a3fa963f9236380f17a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244395, "uuid": "9d3c6ba5-5972-4744-a4d9-45e913acf664", "value": "T136451214A278CF15E0BB5FF90971D0780BB56D8EA825C2424FC67DDFBAB6B500A1A743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244395, "uuid": "f3df8c37-3052-430d-a6fc-1721a21d8671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244395, "uuid": "105925b6-7aa0-4a7c-a541-e49643badf49", "value": "24576:FGq4AemgwHpefu/3cIqi6RykimBNASRLHUjv8MTQ5X:UAe1upP/lt6R4KhNOv8MTQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244395, "uuid": "0e40f69b-ab06-491d-9ce6-6a76a8ba8cb2", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244395, "uuid": "34faba26-0480-4e56-9af4-2c604a2a50dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244395, "uuid": "72c7edfe-1e1b-4b7d-955a-6402059a5dd3", "value": "55ee3babece77478c86b3e782b3d8f5288f3af1563ada1d766bd8d91a7a13275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e04d99-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243268, "uuid": "e7629fea-161c-4914-842f-1c85efd382bc", "comment": "Malware payload", "value": "ec0d9bb2f7dc3f70f4da7fd87d224107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243268, "uuid": "f5c8e9e2-25c1-495a-85f3-70bcc09957d7", "comment": "Malware payload", "value": "55ef0647489204f24f77f80f0b2ea200965d0a719c2f30e5d1e3a8cd997b12c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243268, "uuid": "686fa833-9ca3-45d2-a4d5-4a80da578178", "comment": "Malware payload", "value": "367f5e090fdfea1c364026ecfe49b9fcd3ec967f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243268, "uuid": "068d5315-3a85-4db4-8052-e671cb352ede", "comment": "Malware payload", "value": "3f0971c6d9a93fc9f743681048f9eee6404471f3367b5595a9b53215463f88cc3145881844b24ef80be0766e0cffceaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243268, "uuid": "93a80d53-54dc-43cd-983b-5e196085a75d", "value": "T13F15AD4523E81F99F0BEAB38597015264BF5FD82E732EA4E7D9950DE0861F81CA12733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243268, "uuid": "8f56951c-b44c-42a2-bef2-c95c5b56c840", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243268, "uuid": "07e40890-2c09-49c3-9095-4d9e80bee63b", "value": "12288:0UbxnqLJzUnxYMBzGIE8QyZAWvtMrtKit6ruxSQfyPw:hbxnqVz78GIEJ68k86r7Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243268, "uuid": "3b0875f4-87fd-4fcd-b2cd-fe8394d07e23", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243268, "uuid": "681e7733-63c2-41e0-bd37-98b7b6e22883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243268, "uuid": "beeecb3e-017f-4f20-a46f-8a70d094d449", "value": "55ef0647489204f24f77f80f0b2ea200965d0a719c2f30e5d1e3a8cd997b12c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9e6c15-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242967, "uuid": "0ebe2f50-f27d-436b-b0f7-bfb799b12b91", "comment": "Malware payload (GuLoader)", "value": "9c5343cb910224eb7e1a6f70ad768a24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242967, "uuid": "95f98642-47af-48f3-a1ed-eb5c0606ed9b", "comment": "Malware payload (GuLoader)", "value": "5739469d7a01a0b0dd75577813fd52c5b1f6feb3671e024c537d8c28c35ca6b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242967, "uuid": "0696f50b-9bd1-4842-b9c7-8743c0f30dde", "comment": "Malware payload (GuLoader)", "value": "43cc6ce5cf45c316d5249ecce333184d135265ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242967, "uuid": "b101b00b-804c-4a3e-b51b-012a65081cc5", "comment": "Malware payload (GuLoader)", "value": "638357385a7bb42cdd70895e1bd63bf125687eab66c4fe5acb929eecb6dcb4fc6870bd6cc3980fdf9d584e16c598e581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242967, "uuid": "16b5c2c2-9ac6-4bfb-a611-ef7bf3150f28", "value": "T1866412127650C867D7D54A31B833E7B61F329C61A4612B0B1B98AE3DF932684BE3D335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242967, "uuid": "8cf18bc4-ab18-43d3-b2d0-4778b63b4039", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242967, "uuid": "c771847a-0de4-4606-ab5f-81b99c483b2a", "value": "6144:flHXelA33LfCaIe8huyJwlSUoK+3JeS5hb6Gos689A86Z:oluLGsO4jaJeS5hb6GonsX6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242967, "uuid": "0957e33d-8dd9-4ffd-9088-2d6599573cba", "value": 317040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242967, "uuid": "2385ed4f-0305-41d7-9d19-119ef59a0448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242967, "uuid": "b9c49aeb-e771-4941-9fe5-53000e3bb905", "value": "5739469d7a01a0b0dd75577813fd52c5b1f6feb3671e024c537d8c28c35ca6b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f3942d-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244258, "uuid": "4b8f0ddd-698f-452e-8c31-a5ffd88f2469", "comment": "Malware payload (Formbook)", "value": "eda362b9beb7cacd8fdb863f9b048376", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244258, "uuid": "7831e051-4373-4475-9f34-3cc117d079ad", "comment": "Malware payload (Formbook)", "value": "577035c7fd647c8b44cdaeb0251c0f44499e2d2371b5cc79616e0283ea5bcc6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244258, "uuid": "8fb4b0d7-3820-4095-a4fd-c804fdd6b486", "comment": "Malware payload (Formbook)", "value": "861063180bc60f902d74cadf6c0cd45ecfab5804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244258, "uuid": "2b7005a3-49c4-4ba0-8577-e80cb56f5db3", "comment": "Malware payload (Formbook)", "value": "1ea76137063f14d6938d7a490080e5f5fd4ed9154f8965b7977babb004b574589d57d4a64e670e7cfe53c203b9a66f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244258, "uuid": "0741e701-27d1-4c5b-9fa8-07e629eb84d8", "value": "T1C3551212B7C480B2C47225324AAAD721157D3D711F668A8F13D53DBEAB719C2D632FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244258, "uuid": "f6af90fc-3408-48a1-a568-81e2c9bb314e", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244258, "uuid": "27e4171c-7e78-4669-9768-46cb4d06f817", "value": "24576:hN/BUBb+tYjBFHL68A0AXXd+hGak2FCybOUpKXiM0hD6di/AKR:jpUlRhTF71pKXiM0hDTzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244258, "uuid": "0d961d4a-7ad4-412c-80bd-58dd41c0de4f", "value": 1299245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244258, "uuid": "f688678c-c2b2-4068-8a62-310db263581c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244258, "uuid": "7f054384-462e-4927-a02d-48d972ada24a", "value": "577035c7fd647c8b44cdaeb0251c0f44499e2d2371b5cc79616e0283ea5bcc6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154bf4dc-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265069, "uuid": "41e1335f-02c8-4f9c-9552-c20b6a0955e2", "comment": "Malware payload (Mirai)", "value": "c52c175b1ffbd4f5693c008310462ab7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265069, "uuid": "f294f5bc-221c-4cdf-8470-a77a67fe5a23", "comment": "Malware payload (Mirai)", "value": "5800d7f474986bf2e5ed76beb637fa3095c592c50504699d5c3160c9bb53da31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265069, "uuid": "bf6714df-1cc4-492f-83ad-5dcf50a95b04", "comment": "Malware payload (Mirai)", "value": "fc15a4ddd4dace750171a61904a30ea56260fbf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265069, "uuid": "151f4ced-6b27-400a-ab6b-4755785bdedf", "comment": "Malware payload (Mirai)", "value": "7f03e34f14c5f1664912114a5479f35fccbc1e77058e622321e56dee07c132b56545e620e4b61df3332a20e26bf5f8dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265069, "uuid": "42c3bb12-0377-4152-872e-d1be3eec65de", "value": "T13E43F172AA2421AEE0D2653184B21BF6BDB623E8909358CF7034F9B78FB655855C78C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265069, "uuid": "bfcf6223-2091-4c5b-8f41-ae6dd725f869", "value": "1536:YydPKUreqwvhlyZvGX/F1gPdRmmqznsAheZdoVJuY:YyIUeqQhlytI/sdXg8oVQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265069, "uuid": "68f59cfd-b039-4469-972e-f5303288b073", "value": 56232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265069, "uuid": "1f3a4da8-f509-4bcf-98aa-e1416ff54fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265069, "uuid": "dad38c13-0879-4ba9-9664-a3f3356c1a90", "value": "micro.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bd7096-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243090, "uuid": "ef47e87b-ee02-4f1c-b836-dad0b2026d91", "comment": "Malware payload (Formbook)", "value": "2a00591febb1534653ce4e8b838861de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243090, "uuid": "f8356ce6-3bff-4101-9a79-ef1492ed52c5", "comment": "Malware payload (Formbook)", "value": "584ce51e0e6d4b475444c7b95ac89a60dd06db231fd9eb308b6e547fb9db48a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243090, "uuid": "332aa23a-5c3d-4d2b-bb08-56dfdcbd4339", "comment": "Malware payload (Formbook)", "value": "8a6260469e7e15cf7cc01ff8454495a5c7de5ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243090, "uuid": "871be15d-415a-4d24-81c1-148b45401d1a", "comment": "Malware payload (Formbook)", "value": "ac3d6c40e02d36e6c54ec4faa5b471e529e1d3b09c8205a88ca50cbf8f1fdbd6318bb7b66b1e55f7ee895edc753cd2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243090, "uuid": "81e72774-9cb6-4acb-a16d-c6fd40b79db8", "value": "T1A745CF0273D1C062FFAB92334B5AF6115ABC79260123A62F13981D79FE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243090, "uuid": "28077c4a-e8a1-4b55-9b10-19064978fe3a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243090, "uuid": "96be302e-f9a2-4730-9ee6-30e4aed9043c", "value": "24576:i5EmXFtKaL4/oFe5T9yyXYfP1ijXdaKo/T0u4LrhN1M:iPVt/LZeJbInQRaKoruN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243090, "uuid": "d60f8c4e-d276-457b-abbf-cb11b8261cea", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243090, "uuid": "d2c18fc2-27cc-4242-9229-d95d092ebce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243090, "uuid": "2ee6f038-03d0-480d-8907-4782ffbe6b73", "value": "584ce51e0e6d4b475444c7b95ac89a60dd06db231fd9eb308b6e547fb9db48a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b298e141-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778242999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242999, "uuid": "38d4281c-8f30-4b38-9ee3-918c882b0bb3", "comment": "Malware payload (MassLogger)", "value": "db54863d3532e2cb497a8983e07af9c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242999, "uuid": "45d287c1-5f1d-4c17-98e0-0187ad2f5d08", "comment": "Malware payload (MassLogger)", "value": "58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242999, "uuid": "0a75a240-9d4b-478a-84fc-cb3ec37b9d5c", "comment": "Malware payload (MassLogger)", "value": "2aa2f94df25d83863d9bdf9ed2b9c8e89bfe2611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242999, "uuid": "1d3b4aa6-c5b2-4575-858f-da4cf659142c", "comment": "Malware payload (MassLogger)", "value": "11dcb66fc2726affa8f241c65788a14403468db5bb9a25649402cac37d52d7e18955d9fcbe5997e163f9bc8dcc53198f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242999, "uuid": "401747eb-4d8c-4ed3-a99b-094c5abb7897", "value": "T1F215F1442269D902D0A76FF40970E3B407B96D89A821D317CEF6BDDBBC3E795580A2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242999, "uuid": "3bb987d9-e740-4d5c-9ea3-6b81e3f5312f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242999, "uuid": "4ac3de11-eead-44ce-a457-f451c0da702b", "value": "12288:1JmKJhgFvLGwKXAaIVyw/9etzZMNtd9HSnTGeH0VbWm7sF82vcwALe0H39P1z8AV:1/wOASw/wtzZMNj9HSnvHDOLp9X9Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242999, "uuid": "b3a237b0-32c4-4421-bc70-19606aa33769", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242999, "uuid": "74c7524f-0af1-4d9b-9538-5da20b88adf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242999, "uuid": "a351f491-7283-486a-8c90-7ab0b1baddaa", "value": "58a5531bd59d978ac4da691ff92bc8e321a5e58200f66c10046b2e7c2edd07f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df59448-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778238643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238643, "uuid": "1fb7edbc-e911-4b1b-9682-b9300aa22696", "comment": "Malware payload", "value": "b2438c9163fedd167dfa6aaadb2e811d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238643, "uuid": "dfc3a914-b7b2-4cae-85ee-a11ba4ae1766", "comment": "Malware payload", "value": "58d4f87cac10996aae50a5ae764906f83106d31185016dde448dd7533cb334f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238643, "uuid": "491848a3-ac9c-4ff2-8b23-143ad8c02852", "comment": "Malware payload", "value": "27dc81bc854f4c3b1d7a733ea6756fa690e3670c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238643, "uuid": "4c146221-ef1c-4a29-99db-2ef59e0f981c", "comment": "Malware payload", "value": "904500f6bd53f767defb5df31c1aad3c74905bb02f20464e1d9a88f565db0981d8f3a71886b9c126fa5bec02196c4b40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238643, "uuid": "f3fcc199-e900-4609-b4d2-3634f078e989", "value": "T15E6733A63CD051ACC0D2C631E28E0BFDF1A939790DB5941BBFC61A112F32D57EDA6426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238643, "uuid": "ad654582-0050-46a5-8d7f-3bf0bc1e836e", "value": "968f4f9d5cdb1cf1aea02e620da8207e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238643, "uuid": "4880a522-d284-4cc6-a497-d5517a5857c4", "value": "786432:pN4EjPHK1tPpAhAJ9J+S8ZTWEmiK/lGbc5GuF4cJ1D44a9iK:pdjsHAs9J+xgEbKtGb4XF4c344C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238643, "uuid": "b4a8efe8-abe7-41dc-8f1a-f292e0a46f0e", "value": 31295488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238643, "uuid": "e8c5ad7c-46cf-4055-b0c3-a02054fae473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238643, "uuid": "91ce13d2-d6ec-41cb-8b67-1a3df36231bc", "value": "EthNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e770ed54-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1778244376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244376, "uuid": "0e040721-13ce-43f4-a5e3-ee7a3a9b544f", "comment": "Malware payload (OffLoader)", "value": "dfba0470724682ca3a4b4b1619e3161e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244376, "uuid": "409e49e5-f3b0-4fe5-85f8-d88146697d5c", "comment": "Malware payload (OffLoader)", "value": "58f954cade4cccca02a20cea96b5b82b430b414be9b7ffcfe2a6a0138d3e9c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244376, "uuid": "508a35dc-bd0f-4ec7-8274-b979e095e84d", "comment": "Malware payload (OffLoader)", "value": "da1467fa939b9eed32916cffbebdd8b8f4842aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244376, "uuid": "98ec51a1-6478-4e71-ac41-45da7219f9ec", "comment": "Malware payload (OffLoader)", "value": "14ee9f0a0f61bd3b3957fd28ef3435690f7e46edeeb7476ea2b98595cc4ba4fccc5aa52973abb4888abe2e61b16c90d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244376, "uuid": "38e86d85-a91b-4ff7-9c2e-686e20b8c542", "value": "T1FD460233B24A663DF06A0A3745B2B23099372E51650F8C82D6E87C5CDB3B1A13D7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244376, "uuid": "bdfbfed2-7c41-4df7-b8cf-83c28fd9bcdd", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244376, "uuid": "83afaf44-25e7-4f8c-8555-de797f8201ac", "value": "98304:eN661Jv9dOMqa7oqqcMuysovJNYnNKeplOIf+AkoyCHYQ:ebqaIpuyso8YeplOJAkoyC4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244376, "uuid": "77b151c7-bc80-47fb-a553-74dd357cda5f", "value": 5859229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244376, "uuid": "78ca13ea-9592-4882-a671-3a5d36f9b5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244376, "uuid": "57c15f1c-5a9b-4aed-91c0-3755d88fadf8", "value": "58f954cade4cccca02a20cea96b5b82b430b414be9b7ffcfe2a6a0138d3e9c5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a8e089-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238729, "uuid": "e4b191ca-bb1e-47d9-906e-2f40cf8f9929", "comment": "Malware payload (Mirai)", "value": "63a9ab7604aa4eee3b88c8647d7ecd58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238729, "uuid": "6ae97137-be88-4c23-86cf-3f21789e5b29", "comment": "Malware payload (Mirai)", "value": "59411fe427ac4fefb8dd0ce16a880cc698a81f97565b73ebb6391ec3411736a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238729, "uuid": "50660612-0b23-4ccf-ac99-5a6ae421198e", "comment": "Malware payload (Mirai)", "value": "471cfe06c8b433e9f824b089725fc9b2b97a6c59", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238729, "uuid": "c6044762-1c40-4f63-8f03-4fc69d92bbbc", "comment": "Malware payload (Mirai)", "value": "dd9acc668a304d876566363f81c012829b783166ccf2f1fcd4afb72df0e7d0d82cf143b233923ecf893deca156cd9600", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238729, "uuid": "1d3777e5-3bc2-430d-ab7d-a7085c244514", "value": "T1B2F01CD593B1F08388ECEF0CB4A2C861944866C7AD99152CECE87D1B5D81604B58BB4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238729, "uuid": "ae577d7e-db51-4eca-87fd-d8c39f43cce3", "value": "12:Ff89cxye6f89iOHGmZjZf89wmcf89TEf8996x5epf895dmf89cb:N89cIn89Tndp894890890m89DS89E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238729, "uuid": "f897c0fc-91dd-4eae-97f9-317e57245c9f", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238729, "uuid": "23665477-135e-46ca-8b8d-ba089b3fdb85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238729, "uuid": "6fe887b0-02b0-4eb9-a4b6-4fa29be792c1", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7644491-4aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778225505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225505, "uuid": "a4d9c5c3-971d-4531-89f9-47b8246455cb", "comment": "Malware payload", "value": "0ff09f65e0d5a50fca9f2afaebd69e4e", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225505, "uuid": "99b1ed47-e7bc-4b68-938d-196150d82a9e", "comment": "Malware payload", "value": "59ba286f17dec444b1f70d6dc4f6122db11d782c39330e7a0138a29db7a3a7be", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225505, "uuid": "76d2b979-adc3-4c05-94ef-f859247a59ee", "comment": "Malware payload", "value": "0fa2a4ace2ddcb90eb980f08bf13d646787d630f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225505, "uuid": "4b7dc6f3-b0a2-4866-ba32-6f31f882f4c1", "comment": "Malware payload", "value": "b8e3fa22f7d3ebe7d54bbbe6fcdcdafde4fc5e95bd11a8c572a00f9b3a4967240c812ec250fdfc9c9f612c8366dda6a9", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225505, "uuid": "d79edbbd-6b08-4922-844b-85d72c10a131", "value": "T154663336F17C1DC6D87BD8BEA0B22A918BE33209E143C836D56029D477E138E5ACD55B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225505, "uuid": "70f648aa-5afe-4aff-9438-e44a934020bc", "value": "196608:+ZftaOAWJ0uU+HB/OGUElH6XU8YYlbHXUj:+BbJrU+h/PUEl0U8YYlbEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225505, "uuid": "0c7d43cf-3d27-4dec-92c6-3fc91ba187e3", "value": 6600460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225505, "uuid": "f26c7f6f-0d81-438a-8a89-abe7ca029735", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225505, "uuid": "3754ef30-ec32-479e-976b-abefbdf2426a", "value": "clubcampestrededurango.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed135d3-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244201, "uuid": "a22a005d-4ad6-4506-bd01-621a166b9f52", "comment": "Malware payload (PhantomStealer)", "value": "c5d19dd5fb7f162c206ca78481bd1182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244201, "uuid": "fcc24f94-c4d6-4034-a68f-05a6ec34ba6c", "comment": "Malware payload (PhantomStealer)", "value": "59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244201, "uuid": "58516f36-afee-40dc-81bd-d50ac933292f", "comment": "Malware payload (PhantomStealer)", "value": "5455a36ad582b33e855e5aa7dedca07eca278302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244201, "uuid": "c1099758-c980-4b22-8de6-b01f8be75bf6", "comment": "Malware payload (PhantomStealer)", "value": "faf988ec869530f78dd111c0bd866d177b5810e5b28385ca04ab5e75577da78ed1a68b1b7c4e1ab10527e97925f5118c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244201, "uuid": "4cefbd47-571f-44f8-a700-e70223ec48bf", "value": "T1A8652214369CDA12E9A517F04AA5E77013B49C89A512C317CEFEBCFB7832B5A290C747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244201, "uuid": "e3c35acb-b208-4a8e-88c0-f6e3f4842eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244201, "uuid": "33543197-dec3-43ec-b40f-fc7ee802869e", "value": "24576:y8+v9jEXQ5oM+TDhi2s9MrXQVGLO941y2LxLA5UqGJN2J+gvcfkOUVAM:IvuXx51agQb4Y2LZA5U12Jv2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244201, "uuid": "3b5d375a-07be-4b51-931c-b7d690bd155e", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244201, "uuid": "02f51c6d-f9db-47c1-87bc-7996ae663ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244201, "uuid": "9d20c980-50c1-4140-b789-e188b9548830", "value": "59f27a81af2fcc95b2253835b2cb2341719fa850dcb158caf741b05ab4fa18e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07ebeed-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243103, "uuid": "e19b584b-cc44-4d93-b585-4ed9d1dff3ca", "comment": "Malware payload (GuLoader)", "value": "7abcf337c1c80ab2041481d5ae2617c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243103, "uuid": "08e8796c-6ad0-4bdf-a8e5-a59838b58a83", "comment": "Malware payload (GuLoader)", "value": "59fe088c225db51aa890774554a1df2045f466c8d135d212cd0f68ef1d71593f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243103, "uuid": "dba76fd0-3c61-4789-81fa-f56390d44e4b", "comment": "Malware payload (GuLoader)", "value": "c789abc78b4d226ce8435c155aad9a610954b908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243103, "uuid": "af52f37b-6ad8-4c1b-8c08-19cf75a27d09", "comment": "Malware payload (GuLoader)", "value": "3e37e09b893e3d9598fde7bab3450d51085bcde63d6b713acbeb3d7c8c00576425b6c630b66780774feeeb536c53f5fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243103, "uuid": "c3465eb6-c510-4247-b8ce-06339f6050c6", "value": "T12C5423093270E017E43A43B1BA314A539AB5FF1C35E8962B43546A5DBC227406F6F7EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243103, "uuid": "d35dbf3a-cf92-46e0-9212-af2ad1383588", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243103, "uuid": "622b49ad-22f8-4af1-b989-037a6317f58a", "value": "6144:7RlWosD1jFB6o+9fJDQAXDXjdikuTkvYbCsThOJq:9wD1jGoQfKAXDB8kVJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243103, "uuid": "1be898b6-dfd2-4292-9db6-1b569c3d6855", "value": 302344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243103, "uuid": "1c92c8a5-6f3e-4836-969c-931ad5be7af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243103, "uuid": "fdf17ff9-0914-4be3-b0ac-b8ed2cd8436a", "value": "59fe088c225db51aa890774554a1df2045f466c8d135d212cd0f68ef1d71593f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4104821a-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232930, "uuid": "b4177b2f-e40a-4999-8d5e-2347032afbf1", "comment": "Malware payload", "value": "9e9dfd410224885c4b1b94155f64c667", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232930, "uuid": "d38300d5-ef06-4d7a-a11d-5b2c7136031a", "comment": "Malware payload", "value": "5a0cd09adb09a79071a85edc931e02c8d565d6cb7cb58e5b0bffd866e6a2ffb4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232930, "uuid": "b8b3530f-1644-4ded-baa2-28aaf86d89af", "comment": "Malware payload", "value": "1dd2af3c6af766e55adc1ddfeb78942a7e70a9eb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232930, "uuid": "082df45b-a8a8-48e9-80ac-8ffaa9060221", "comment": "Malware payload", "value": "d5cce699fccf7a114df5f2f74136fd70867c8aff055a215fead9526703453a2a4baf4e7a90b7c84c8b89ede759d33d3c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232930, "uuid": "185b9a62-8db3-47be-9493-1d53eb64377a", "value": "T14D17DF63F244699ACDE6A230F4E703D132260D154783A76A571FF136BDB31DD8E26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232930, "uuid": "15f44dcd-b661-47be-b398-780b89c128e3", "value": "393216:kCGsAFjTxJtLhOAESbKUjf5tOBUUc/uenBN:3AdJ4A7bKUbHU8TBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232930, "uuid": "d56bc5e3-0257-47c7-9b40-c7ac306cfad9", "value": 20238745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232930, "uuid": "40587daa-e3d0-4b61-9253-d9b275889896", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232930, "uuid": "5aee1173-d575-49b2-aa09-d61c8cffa836", "value": "IDFC FIRST BANK (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9a1b08-4b05-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778262345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262345, "uuid": "8e6f0a35-2ed3-42b5-9454-ebd40a22be87", "comment": "Malware payload (QuasarRAT)", "value": "48708d9ad83bbf1f5388e14120ed8d66", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262345, "uuid": "3ab96a14-7fd2-439e-8915-e56f21e5ef61", "comment": "Malware payload (QuasarRAT)", "value": "5a0e7fd4d8cb6ad72c39b5c15803ed7ed4edb75aa91ee7ddd67c9b423792889f", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262345, "uuid": "7a5df77a-211c-489f-8641-03d7240cc6e9", "comment": "Malware payload (QuasarRAT)", "value": "7d981dcdeb4062277e6e058e7af4163cb251ccb9", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262345, "uuid": "a342f4e1-74cb-4722-850f-47334179c528", "comment": "Malware payload (QuasarRAT)", "value": "e9164e9cd4e5cd160aff57fd1b4af6b89ee0922c538ddc52f66440ad9d09f63eacbd6265f9d0207f4fe987e501484de8", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262345, "uuid": "e8674a44-453a-4807-8e3f-fe73766308d5", "value": "T141F54B0437F85F22E1BBE27395B0146667F0FC1AB3A3EB1B1191677E1C53B4189426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262345, "uuid": "a6120e1b-77e0-4f97-a778-4e5e7dc27c2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262345, "uuid": "6a28e4fb-7dda-4422-a1f1-a6e4faedc5c6", "value": "49152:kvNFM2eBaGlMJPFlUERb6HXqwx83kebDk/iO8oGdYTHHB72eh2NT:kvrM2eBaGlMJPFlUERGHXqwxqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778262345, "uuid": "b8302d37-7a60-45c0-b8f7-2f00efcdd8a2", "value": 3334144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778262345, "uuid": "736f501c-a849-4e37-be71-c9c66a761757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262345, "uuid": "9ed1319e-f62b-4aef-87b3-38bbb22c99ef", "value": "ChromeSetup (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35c6c54-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231511, "uuid": "a8e53f97-5b3e-47a0-9273-e62afba07489", "comment": "Malware payload", "value": "4d40f356bb210d5cbd70ce6af06222c8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231511, "uuid": "a9b1b047-2a59-49a4-8a92-4c6247dbc97a", "comment": "Malware payload", "value": "5a54f61f90f8fe1cd88698f9bc145083bb19998d79900eae770332baa48959b6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231511, "uuid": "b752e609-4415-418f-a5a9-5472a48421cf", "comment": "Malware payload", "value": "e09a730cd6fdce5ba2802910b7086de3e6fd1dc2", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231511, "uuid": "4469ccc1-a496-4345-b50d-92d638752d33", "comment": "Malware payload", "value": "de52bf42e44e8b97904d68646da9c50952034fc73eab9e59cd8ed84c033b005dd1afcc024d925ce80e2653d3ae093f47", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231511, "uuid": "fa699861-edd0-48b9-81d5-c14abe77e141", "value": "T1AC112F796E3DA141EBBA52CFE0E33F63220ED47C400663AC116D11081DD27F84B276AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231511, "uuid": "9a3f16da-44d7-4703-9d41-e6cb6c02c7e0", "value": "24:R6Fra9QgRVoPZlXpDzz3q78dZvUsBylbNpf9+/thAbL3E:w1a9lVoP7XpfrqmvU4yHplWtKL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231511, "uuid": "3a73cd7e-20a8-4b22-9cf5-ddf733a1a324", "value": 869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231511, "uuid": "10f419bb-10fc-4cf8-bcfe-995dbb7f9e32", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231511, "uuid": "8ee073b1-170f-4907-b7fe-90d6b6dd2cf1", "value": "script.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a698f6-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778231114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231114, "uuid": "255232b9-1891-4295-9cb0-3b4c0c0fbfd2", "comment": "Malware payload (VIPKeylogger)", "value": "13f11b7b351d56ccd174d4316007bdc5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231114, "uuid": "c970a024-eb6f-4bd9-8eff-9fca7dd8971e", "comment": "Malware payload (VIPKeylogger)", "value": "5a7e1c22fa71beffb565490a144f6c5fe1c90c17d4793bbacad529f26e883600", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231114, "uuid": "8f95d82e-720b-498e-82f5-364fef94a1b8", "comment": "Malware payload (VIPKeylogger)", "value": "12f0a45206cf9563bf37a9531fb6f0184bde6d4d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231114, "uuid": "e8295eaa-4df8-4df2-85fc-41d1a80dadc0", "comment": "Malware payload (VIPKeylogger)", "value": "8174dec0a31d5c331f66fab2853f44f36095097e960865ca2cb3d2df7b78b00e8bef7152ab4a8d33b2f57bb95508a3cd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231114, "uuid": "a71da91a-1845-48e0-95e0-85d9e7458699", "value": "T11F03A3D975E67260431234F32A2BA067E72D5C82B70C8124FDF4E8AEFC68768D575878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231114, "uuid": "f609fc94-76bf-43be-a265-c0d3904a6763", "value": "768:QCKPD6B6YhPcWY8FWzBg3tPU+s+RSkP+J5a:Q7YZLjFWzBg3tYI9P+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231114, "uuid": "258362e6-d8cb-40af-836d-56dd7c2a841a", "value": 38578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231114, "uuid": "a17f8140-9163-4dfa-9975-c2fe3e24e553", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231114, "uuid": "81688c6a-8773-4861-8ffb-36c689ed4b20", "value": "vdcpovzxsweqfbcmlihtllpoijkrgtewkgitgb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d667feb0-4af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778255944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255944, "uuid": "8c6af648-40c3-4cef-bfd8-ae26e56e29c5", "comment": "Malware payload", "value": "3de0cbb2b831fd430404cf08745800cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255944, "uuid": "7b1429af-ea1f-4844-8b92-0a3cbf8aee1f", "comment": "Malware payload", "value": "5b5a306e93a17a7edba89301717e304f72134cc5bfd900c4bf8fc2ea617fabdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255944, "uuid": "1749cd26-57c0-4293-b473-a855a7b171b1", "comment": "Malware payload", "value": "bee2a13c0d5bdb7ee4591247dc296dbf136865fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255944, "uuid": "785e60ce-a072-446c-bd80-78a0fc9c0fc0", "comment": "Malware payload", "value": "bc286387607f47eb36e9f49ccb0f4f0b8986a7e330c694fe4b1934d6e0c23487e24dfc81c2c3f75bb0ec7d95dd20de6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255944, "uuid": "fb34b39a-2eff-4936-afeb-36ce6b7b3d21", "value": "T1DA767B03FC9520E5C1ADDA318A729652BB217C495B2123C71BA0F7786F76BE0BDB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255944, "uuid": "207435e4-0048-42c0-9f89-881f2e0011ad", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255944, "uuid": "5c8f70fb-d445-4933-bdad-8b923e9e2c6d", "value": "49152:MYWSWM3if9Tnle2nArB5zv1VkdcNTy3GhHOs/5qf81mrViVTfAlAOKQK1KFNdcaB:MYnjy0usEfvAcCxiNOed0lxxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778255944, "uuid": "783633fd-8d84-4a21-9983-16fe6ea9ffde", "value": 7791104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778255944, "uuid": "72a0a2e2-b2bd-4adb-a028-2b0a5c60483a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255944, "uuid": "cb2e558d-2f4e-4b1d-bda5-2e213f31d25a", "value": "5B5A306E93A17A7EDBA89301717E304F72134CC5BFD900C4BF8FC2EA617FABDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c4ba02-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243618, "uuid": "cd108a7a-6980-4a64-8c21-5118f3813249", "comment": "Malware payload", "value": "35f702bf1f7bf371f86af676231087b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243618, "uuid": "1495e2bb-8f56-43c9-991f-2e230f7b8946", "comment": "Malware payload", "value": "5b95fac31ceabcc878af21555e96232f5baa47335134d358b7ed2d9a24a89556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243618, "uuid": "9f1929e8-63b2-4a1a-81bd-a3857b08b3bd", "comment": "Malware payload", "value": "65daa07c8080be043f2c9cb701bce7af68954702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243618, "uuid": "601f2e5a-d0d9-4506-af04-66231507e32a", "comment": "Malware payload", "value": "bc511cc3d693e44ff59108bbe2d88ccc03f7c13e7f9ba8a57f6126709e7698362ce1106cd105e4ec37aaedbc47833cc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243618, "uuid": "50cae38c-cb6e-4a35-8409-e400df241152", "value": "T1A55523317AD0C1F6C0B61A3445D68B35DE6E30324B2A91E7B2D927796E713D2A7372C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243618, "uuid": "08956854-71e7-4cb3-9b93-ebe6e2f3a978", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243618, "uuid": "08870632-a282-4a05-8b74-12db89c7f26c", "value": "24576:ak70TrcaKUfmzhpqHG8FDju/DmFMkl4+qS3//otfeZ1NdlX:akQTAaKamzhQHG8pYapFnQmN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243618, "uuid": "e637cba0-cbdc-450b-ada2-37f27e33d810", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243618, "uuid": "261ca928-396f-4aff-a8eb-bf9c7bdc1533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243618, "uuid": "eddbd75f-dc3a-4bcf-8e6c-4a3c0eec8187", "value": "5b95fac31ceabcc878af21555e96232f5baa47335134d358b7ed2d9a24a89556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335d9898-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246222, "uuid": "d82e7910-4c6e-47d9-8baf-5f382a2d97d9", "comment": "Malware payload", "value": "e38292b784e2cc9549c931f18d583cae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246222, "uuid": "1aff6c17-81c8-4acd-8cd7-120650c07d00", "comment": "Malware payload", "value": "5bc66b802b8f3c9600b6199e7d284c10e29a28450c166841944d7a4957b9696a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246222, "uuid": "f129ad05-58d2-4348-815e-ea1998f5789c", "comment": "Malware payload", "value": "ae2fb8f40f21fca951b9399bfcd241694a72705c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246222, "uuid": "0ae675d4-ed12-40cc-9864-3e78f3d9e0e5", "comment": "Malware payload", "value": "72bb79ac3386d180f9c3d75f55b59b3cfbab37902be26cced42df5d37c9eb882fc278496902993532b62c762bb15eac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246222, "uuid": "998e2103-5d17-4a6f-86d0-b581e3736062", "value": "T12DA2723CCAD6FCD0C79B63F038AAB7D6019A9B17A9171B5CF9DC14661A00398E77428C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246222, "uuid": "03f4fe8d-1717-4efd-8341-d640309c78cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246222, "uuid": "8070aa02-1c6b-46eb-b462-f096b8146eb7", "value": "384:Ez57Ngy0RmFD4b1PkSSsjXOpRHEdIqIrI4sC2FmQH471UvEvn7/LNVP5+5yGYsL7:Ez57Ngy0Rq0bFr7ObppItFmQH4nX3P8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246222, "uuid": "0a1c5403-7f40-464a-bff4-4d6a425db8cd", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246222, "uuid": "26e2f7ff-1096-45e6-82bf-6b37719d6208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246222, "uuid": "edea0f2a-e6b1-47bf-ab5a-5d08fa17b37e", "value": "5bc66b802b8f3c9600b6199e7d284c10e29a28450c166841944d7a4957b9696a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec95d818-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244814, "uuid": "953d1f5f-e5a3-46ad-939e-5cf6040c05d4", "comment": "Malware payload", "value": "c1b0a4f7f9a140a437a96970cdc8ade4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244814, "uuid": "b4fccc5d-ce84-4858-a0b5-da5ac93c153c", "comment": "Malware payload", "value": "5be267b83d9a55ba1f7a0687259cc2c4cda24eba59341ef264e4ad06d2283b6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244814, "uuid": "320aaa05-df43-4370-a38c-cbf7cc8c101c", "comment": "Malware payload", "value": "54261e661b48005aa1e61e40aa27647d1c7602cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244814, "uuid": "428b15ae-925e-4ffa-b92f-30616966753c", "comment": "Malware payload", "value": "7ed018ea9f77d011bec59821d4529e35ee2039f2674116561321727295dd304a87e6a9fd70335c7cd640e2a813eae54e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244814, "uuid": "c7c68f69-575d-4d6c-a92a-bdef88ea796b", "value": "T1EA051226633DC656E5671F780D70D0B413B86D8DE925DA0B8FC97EDBB0B970029887A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244814, "uuid": "f2b2623f-7dff-4853-a79e-3c99de9409d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244814, "uuid": "02f33cab-de85-46dc-b194-c6108da37f6e", "value": "12288:4hc0gV/E/377jGUParAQ9i3CUpmGPFFzZHykrrRkHsyy6/Sp5A9AqwhbgxtI:9jRE/HFPaiCU37gkrrRkt/KAGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244814, "uuid": "a99d8bc8-b40c-4c5d-bd94-505dc2545a39", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244814, "uuid": "bdd6aa48-958c-497f-823c-32fbba0414d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244814, "uuid": "7e03ee58-cfe2-4661-af25-21be5cbbb5dd", "value": "5be267b83d9a55ba1f7a0687259cc2c4cda24eba59341ef264e4ad06d2283b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a28cbde-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778246689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246689, "uuid": "89bfc4a5-fe8a-4592-870d-edb26ceeef43", "comment": "Malware payload (GuLoader)", "value": "530fa7cf76659139fd50a9dfe19a88b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246689, "uuid": "b20f178b-d249-45d6-bb9f-7a20bf2663a0", "comment": "Malware payload (GuLoader)", "value": "5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246689, "uuid": "4caec80f-87ff-4f8c-92a1-3445a4fdd432", "comment": "Malware payload (GuLoader)", "value": "51658f25522df4e2cdb94a54e3ffcc6c41d7e3d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246689, "uuid": "8a83b134-1f31-4e38-b328-3b0178f74764", "comment": "Malware payload (GuLoader)", "value": "6fa3c377057d010363586fa3a13d32e05c439cdb0e9dbd6c618813cc41b614ab9d84121fcdb4e1dce50f5271b0a17d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246689, "uuid": "9b896222-a87c-4f40-a0a0-2032ddf06dd3", "value": "T15C742212B340C456DAB142302CB785B1DEBE69AD52898B4B9760FF093FF1745AE5F2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246689, "uuid": "2bade5ed-a06b-4e81-bf8f-b62172baea6b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246689, "uuid": "30735345-fca4-44bc-b706-99a8a2f7497d", "value": "6144:ffY+onfH95NB2BKuIDFBG3oDF9OzqbwyQWl2iqZ193tvP5NR70aX1:ffYbH95NBs9Im3E9gq2Wl9qVN57TF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246689, "uuid": "7b7a7ee8-04bc-4c67-92ab-2c810e76ba37", "value": 340328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246689, "uuid": "93467c43-c947-440f-9f74-3e0ba82c840d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246689, "uuid": "7116d921-752c-4b9d-8260-81a4e964ed75", "value": "5c92f4a705d6be5dde09653d5402366ab69f4bd4a11435a1a8a65191e0a1ac96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e4b2ad-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243218, "uuid": "f5c8caf7-1f2e-40a7-85f4-ed2b4bd60e43", "comment": "Malware payload (AgentTesla)", "value": "077e3e205fa4d0f9aaa5aaa6f02c96e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243218, "uuid": "9c731f8c-795d-4101-afde-d5423e48161e", "comment": "Malware payload (AgentTesla)", "value": "5cb180fc0e45f841c9c5dd90746b288cee30a7b3c04a8dd1384e169ef509ba41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243218, "uuid": "552edb9a-ab2c-4b76-98f8-a7691cdbaaba", "comment": "Malware payload (AgentTesla)", "value": "b960366b1379e5195fadeece6dbfec513e4c96f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243218, "uuid": "a6496499-8154-410b-9dd7-616de052493c", "comment": "Malware payload (AgentTesla)", "value": "ae129955952ef342204a089ca08799a75aec471529d90b30b7d86628159fc2209d5e8e3d8a5e73103fa47563642c8ea0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243218, "uuid": "9fa187a1-35b5-417e-af6a-db017ad4203b", "value": "T1ED340F037E48EB15E1A87E3782EF2D2413B2B0C71733D60B6F49AAA518517825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243218, "uuid": "9e49d9a5-08c0-4b1d-81a4-d2148720bf41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243218, "uuid": "84175b9b-2f62-4c07-aeff-cdb1bd893ada", "value": "3072:r3ul7h+CuSWCWz/vgn2EITYU5+QqXc3xgPPfCU57lUqIHoH1d:bul7UCuSWCY/vgn2EITYU5U5PaKUq4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243218, "uuid": "84100068-4c60-48a0-8495-eb146fe20ece", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243218, "uuid": "f320b0f3-bfad-49de-a257-5a099426c94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243218, "uuid": "ab6c94d2-48bd-413c-afec-b9eadca2a783", "value": "5cb180fc0e45f841c9c5dd90746b288cee30a7b3c04a8dd1384e169ef509ba41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8230e6d4-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243777, "uuid": "684426fb-7b48-421c-b1db-c9712e8d0c73", "comment": "Malware payload", "value": "47b23e7ea8e677e33073d88d98de25a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243777, "uuid": "60007f56-9368-4538-8ea0-3af4428038d9", "comment": "Malware payload", "value": "5d316a2c8efef36005b313b6295525071f4138df1771ba5577651e235d327192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243777, "uuid": "dd70f200-dba7-4cf9-b0df-818955898b7f", "comment": "Malware payload", "value": "21f7c4358560c3e094c624e18667b6ab6150c97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243777, "uuid": "3a4ff2dc-5834-436f-b735-e1d70d24705c", "comment": "Malware payload", "value": "a18cb7145ee5a267903f24b0fd79583ea277c18b71171afa356e21a2ede1c3b6e2a902b499a81aefa034721dfde1714b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243777, "uuid": "6398169e-725f-4d3e-82e9-bcbdfdce3fd2", "value": "T119E3125B82EADB52D8FE0F3534FA016045FAFBA3BC074A9E0CC68585673BA4513547A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243777, "uuid": "d4a643de-f2c7-4906-bc1e-db35dc6b8bf9", "value": "3072:c7Wz9oIG1kRl/fldfEL7EAcMQ/7AJoZl63GhlveX/YIfPeq6tcvBXVQdfYOYu:nGkr/tdfQjFQEJglbWYI3AclVGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243777, "uuid": "9b948246-afdd-46ce-baab-e7a5ad896781", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243777, "uuid": "696a4785-ce93-49e6-9ae5-52776915e31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243777, "uuid": "f34e423d-b9f1-4d29-861f-51865bd6d0d1", "value": "5d316a2c8efef36005b313b6295525071f4138df1771ba5577651e235d327192", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c43f96a-4af7-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778256061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256061, "uuid": "4e7ca597-ca6a-40b6-babd-a0b9cbf7b53e", "comment": "Malware payload (AsyncRAT)", "value": "df9e6d95a09cca0dd0176514c8d1ec0a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256061, "uuid": "f530eace-f449-48e8-a801-06f07b4df05f", "comment": "Malware payload (AsyncRAT)", "value": "5d7888e08d93571502cf1a1373535296399b956b788cc6ff77982e42179971ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256061, "uuid": "7eac104b-9f79-43ba-8308-89eb00839e69", "comment": "Malware payload (AsyncRAT)", "value": "f232caf9c121bc9218c8f9e1fde02515b0e1bffb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256061, "uuid": "c2488bd6-4461-4bfa-bb52-7bb0ea2c1d68", "comment": "Malware payload (AsyncRAT)", "value": "59ff6aeb75f54334070cf84f78b9d1ab65d4ae86a7e3f61bc09adfedf972dc84d5d6127943c64dfdcaec86478f84dba8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256061, "uuid": "25e5fe0d-10ba-410a-a208-b5685d020d48", "value": "T127D3068026C48751D15C46B668AE79F002EDFD6E2101CDDF68F4F78A967B78FC60329A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256061, "uuid": "ca4a8e86-5348-494f-96b0-124ffc15e0a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256061, "uuid": "8143911d-bb31-41f3-9e04-8b2e2728483e", "value": "1536:6Q3ch1ywUZ94F4eLGbbXwbM7Ib/GeAvKJYU6VclN:6VhIwUZ9KGbbX4AgBIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256061, "uuid": "60a7a240-46d4-4cd5-9a6e-e89510ea59fd", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256061, "uuid": "66dacd2e-9ed9-4db7-8c6d-9db174eae3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256061, "uuid": "2260405f-8dc1-444a-99da-3180edc4a20b", "value": "ChromeSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe9273d-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778242753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242753, "uuid": "bc492d01-7c72-45ad-a0c6-725623e77f0c", "comment": "Malware payload (VIPKeylogger)", "value": "897da660ec6f0cc76a8101afed79630d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242753, "uuid": "786efbdf-e424-49b5-b3f7-2b1c6ff4d58c", "comment": "Malware payload (VIPKeylogger)", "value": "5d7a6c1086ee568d932e3022bafe14a14fa7622f8c25222dc3fe9932afad84ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242753, "uuid": "1749a533-1763-4416-b0a3-5325359dcb9b", "comment": "Malware payload (VIPKeylogger)", "value": "2ca73db8525a8dd20991d4f1352366d3007d2d84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242753, "uuid": "e6056d9d-17e1-4ef2-85ce-b398e030bc8d", "comment": "Malware payload (VIPKeylogger)", "value": "1c4466451ae1bec5d870765c29b78bc06669314279a79ac56a627533d40ef06cf6e2eaac58812b491700956d4d82dc49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242753, "uuid": "16719f33-36b9-41ca-9701-bd7e715b156d", "value": "T1783502592216E902D4D22F701E70E7B45BA89DC9B811D3139BFAFDEBF92D6172C041E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242753, "uuid": "f0166521-1673-49a2-9fe4-33b82713bb83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242753, "uuid": "03e33ca3-beee-48b6-b7e2-245d93859c57", "value": "24576:YSOASn46YC2fZSBv2AoI03xjyb3TqwsD1eCiwNB:YSFSsCISBvdot39yb+11JiwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242753, "uuid": "25f42e95-1b05-4b76-9482-462dc3de1ac4", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242753, "uuid": "dbb3abf9-81e7-404e-bb79-da7c19e5af14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242753, "uuid": "2270c595-49a0-411f-acdf-3401e34ce75f", "value": "5d7a6c1086ee568d932e3022bafe14a14fa7622f8c25222dc3fe9932afad84ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d1b2d1-4abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230500, "uuid": "ef2e7702-7e26-4fc2-a999-0be2b592e4b1", "comment": "Malware payload", "value": "b3574b6c9ff580eb3ad51b192a5da0fb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230500, "uuid": "0debd27c-5729-4250-a9e5-8ae53dfd429a", "comment": "Malware payload", "value": "5dad07b06415deca06f91629545af6cf5ef7852c315f44732d97541c0d07a0b5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230500, "uuid": "5356ea27-5cfb-48c1-a7d2-91fb5b1ce03c", "comment": "Malware payload", "value": "8bbe221126ff2852dc72fff1d0d62c324c60bcb6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230500, "uuid": "bff92ef4-3d38-4717-bea2-0459aac01345", "comment": "Malware payload", "value": "ab634c5b19d59b359d315f6911ef67f7de659c8b9cdb73d0e8dac60a0e45a846f25c462138c2dce2d5e70d4018425531", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230500, "uuid": "706bfe1d-062e-4701-ae1b-2d8313aba847", "value": "T19BB612D6F7C4492BC8778072C96952F1255B4D528B839F877904360C38BBAE84F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230500, "uuid": "9f1fccf6-4907-4b58-a098-40777b1c9e76", "value": "196608:uavXX2LthRaFOd7Zpg6Pn296MTBKWrM8vNS6XYdDTzCy7GmR:JotjaFOd7Zpg6+964ToqX0DfV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230500, "uuid": "56e7940d-e031-4fd7-9a35-936623e55a65", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230500, "uuid": "53b16d73-a2ce-4b72-a35a-7618743787a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230500, "uuid": "fa67c23c-3709-4486-ba13-97877a69e931", "value": "iMobile lite (29).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36fd062-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778244369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244369, "uuid": "13f165d3-673d-4c9c-b92c-18e9f996fd4a", "comment": "Malware payload (DarkCloud)", "value": "7921324a16d94268f49f7626e657e16d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244369, "uuid": "b97c5efc-1431-4369-a3fd-fe95a90bb140", "comment": "Malware payload (DarkCloud)", "value": "5e218017012d49b18f8dc509c3380e1bd75e2def38168daaeced9d0fe4f76e87", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244369, "uuid": "14d728e1-a1ac-4ce4-ac3d-2b6f3a09cc35", "comment": "Malware payload (DarkCloud)", "value": "cb1c31582612d0089c0b1d2ee22a1781b2015687", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244369, "uuid": "b7b7ea4b-a9a1-42bf-a9fc-96d227c72549", "comment": "Malware payload (DarkCloud)", "value": "b5682ca95b0570949b84a2999ddbcee7fae996125840134e1dac671d417451ac8a90ca2701da1a3e1841dc08445656b4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244369, "uuid": "1afb3510-4e86-4d74-85ab-2bef09f2da2e", "value": "T12B55F1531209CB02E43647F22D23D8701BB72E4EB511E1AE5DC26EDF7E76F250998A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244369, "uuid": "32469c20-1ffe-4728-955e-2af8dfca3e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244369, "uuid": "7ea801eb-b45c-4c73-87cf-8af29d88c1a2", "value": "24576:GF08jC9Ll7BitmDnbuM0KnYSUHeXP/Kplbnf36gHT/19OHWFZbUX:GF08jCNNE0nbuy4ef/KpBioj1kHWFZbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244369, "uuid": "ddeb470a-fbca-49a6-923f-53d9aea8e7de", "value": 1406464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244369, "uuid": "3e6d55c8-a740-434f-bef8-0b6087a72714", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244369, "uuid": "0a11ed10-5521-4675-859b-b3062e648909", "value": "5e218017012d49b18f8dc509c3380e1bd75e2def38168daaeced9d0fe4f76e87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f23736-4ad2-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1778240481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240481, "uuid": "e5fcfc93-32f0-4200-889b-28548339d2f3", "comment": "Malware payload (SilentNet)", "value": "64ea95b4ed5d918100308a6bf41ba636", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240481, "uuid": "74b4e974-3189-420e-8f61-0d6ff40fd697", "comment": "Malware payload (SilentNet)", "value": "5e2f6094556cee86b91909b7a29e0c9bd8a611c5f7cb5675d20f47a4de9387ba", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240481, "uuid": "913b6a6d-6de9-49cd-a43d-9fa6a858ef15", "comment": "Malware payload (SilentNet)", "value": "6b955e86f48710c98aac6370db69d84036b802de", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240481, "uuid": "83e0f23e-71b8-4edc-beca-e6b5284a1e93", "comment": "Malware payload (SilentNet)", "value": "74f373a24c0d72e94333e8b0f4e3135f7ba0bc14d6e07462bd9e51df49ca5cb33899e09ad155847a75f7329c0e2b987b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240481, "uuid": "89bc4bfb-a082-417f-8a46-a0f951b33270", "value": "T1D385338A810A94B8DBDC8F22A57F10F3CF5F2E3AF93101AF4995F4506BC855AE41C5DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240481, "uuid": "02cbbfc8-7509-47a4-858a-d62698e73803", "value": "49152:jVyGI7ffeX14HQD/1qJpeNSLrlgGFK8KA:jUGYeFG61ipJLpgIKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240481, "uuid": "067b6769-1a05-48bb-9186-14d9fccaed49", "value": 1817972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240481, "uuid": "8d71b369-2ec3-4fbd-80b6-cc822594cd39", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240481, "uuid": "bf13a5dd-b3b7-430e-b253-95a8d87bd885", "value": "wockyclient1.21.X.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251034f1-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778246198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246198, "uuid": "ad206b5a-7b74-4e22-95d5-448c1275fed8", "comment": "Malware payload (AgentTesla)", "value": "0df72482fc459312fc11580a608c1d34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246198, "uuid": "a264de57-8788-4be0-a262-b422c6fe6117", "comment": "Malware payload (AgentTesla)", "value": "5e8267e4935b9120c2e4eb894b6f8748abb94b87adbfc900ad9ccc921b015c86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246198, "uuid": "eab4c1eb-55e8-47d6-9657-fb11c2567efb", "comment": "Malware payload (AgentTesla)", "value": "304aa6bff5f7001453aff4059ba815e9e85281b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246198, "uuid": "d4ff6643-5d40-4739-a097-8754300a210b", "comment": "Malware payload (AgentTesla)", "value": "da9cd4104ba206441dd52b0eaadaaccabb6b2b14fab04397de4e8f95c92e73bf8c19bf4305b010a9f3cb8208b3dbbdf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246198, "uuid": "41fd987d-879b-4448-91c9-d89e8fd21599", "value": "T17505E031AE822A14E63A1F38C05225696BF8CC465286E71F6EEE31B54E737C5DF0F851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246198, "uuid": "9c316b22-1cf7-4db1-bd75-c8a15b83e6b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246198, "uuid": "740f1300-fa1f-4644-ba8c-a2004bd04113", "value": "12288:P7sGIInAUz9QNHiUpp85QQNmv5odwAKoGXa21LsrFm:P1G+9epkQaddwAKoGXaws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246198, "uuid": "acebb108-fe45-4235-9a41-807cd5ae5b33", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246198, "uuid": "5d281f28-e2b4-4f62-b3c8-59ecff40ee37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246198, "uuid": "6fe3becc-5fba-44c9-a3f9-91bef9a4d34c", "value": "5e8267e4935b9120c2e4eb894b6f8748abb94b87adbfc900ad9ccc921b015c86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc9a5d4-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265113, "uuid": "c163f773-bfc2-452c-a9fe-8fe865b75a17", "comment": "Malware payload (Mirai)", "value": "2d0c161727803ac6dd467070ee2e6e67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265113, "uuid": "50beb22a-d6e8-42d1-b308-98388fa12af4", "comment": "Malware payload (Mirai)", "value": "5e82a1542c9fb8e36da4bdcd16db6e5613d7df0de6c586c61334de5c2ecc49f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265113, "uuid": "680567bd-b2a6-4828-ab47-3a1773e0ea38", "comment": "Malware payload (Mirai)", "value": "e94330f730f7dad7be3cba74a518de6f4c89dfaf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265113, "uuid": "dca62f02-128c-40ad-afa0-b60c5116070f", "comment": "Malware payload (Mirai)", "value": "bccc30bd51d864f0aef110e3b2acf5f3cce042f757b2defbdbc852b27c6594b3c744ab8833bd8188157af045bd7f31a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265113, "uuid": "1e00a348-2a32-450a-92a9-d7c690d1a053", "value": "T1F423F891F881862BC5D023BAB57E968D3721A7F4D3DB7627DD610B203AC651B0D27F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265113, "uuid": "d6519397-34f7-4736-a62b-bf4b72ad1662", "value": "768:SRrQDmElQ+ZNVWV7xLFLHyUyI269UOmlK+D57oUBSY832DG/Ymdew:SsmEmVnHyC269LmlVoWSY+l/YmdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265113, "uuid": "d6f86bc4-4f61-41d3-abcb-ef96fa539bce", "value": 46936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265113, "uuid": "d3e12b27-41a0-4782-a896-4c717dbf4e41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265113, "uuid": "15e1996e-9b47-47d2-8938-e9312a506c58", "value": "micro.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0640bc1d-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233261, "uuid": "90e48beb-5ff0-405b-9c2f-594c184b6eee", "comment": "Malware payload", "value": "14bcaafb88b5991c4cf81ff89b75d73e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233261, "uuid": "d737d08b-3827-43de-b491-701bd8c99963", "comment": "Malware payload", "value": "5f09a31e28b755aab00fbf3669a7369d1205ac5dea85f0b328cb7cd76472e456", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233261, "uuid": "b5369d47-0c63-42be-a03c-c77375bcc2a7", "comment": "Malware payload", "value": "5ff781fe71028d14cc7f4458f0e8cde6eca98bca", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233261, "uuid": "3a32c7e3-f2ad-4d39-a3bf-c89c15e22e14", "comment": "Malware payload", "value": "27fee451349f6761717ba7d14636588d17540b383790221d817712f9146e10e612e15718b875c5a60c4568389714ceea", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233261, "uuid": "1f852d0b-0cb4-4490-8909-64dc8686b837", "value": "T17A27DF63F244699ACDE6A231F4E717D032220D114783A76A571FF136BDF31DD8A26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233261, "uuid": "7cea7ac7-937f-4579-abd5-691c1fe24d95", "value": "393216:jKcMDU5R3JouOkK74ezaySZluyGC44TmtO0bKJjLqBs:6U5R3eaQ4CSDyIT2jbJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233261, "uuid": "30f9d6eb-3875-4e38-95af-dde86398059c", "value": 20668826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233261, "uuid": "3fd78169-fd5d-43d6-bfe4-9fffaa187945", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233261, "uuid": "29ffeda4-2e29-423d-aaef-b737ad74d683", "value": "indemobile (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "857c3e5d-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Jalapeno)", "timestamp": 1778242923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242923, "uuid": "12a8356b-acc4-4a34-945a-f99becb5ec32", "comment": "Malware payload (Jalapeno)", "value": "49f806f99e6aa4c5bd2d1888500928ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242923, "uuid": "2c1f5368-6fa3-4119-9b21-4a72e4a6e63f", "comment": "Malware payload (Jalapeno)", "value": "5f5222ee17d9c60f53f82246c8331f07ffa4b32cc9b4e100c852fb6ad781d801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242923, "uuid": "7c87e9a1-d9b8-45b0-9d99-c316696aadc2", "comment": "Malware payload (Jalapeno)", "value": "b5391dac3a1a9c95945dac4c5c302cab0152ea14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242923, "uuid": "3a5bb197-e277-4e73-a01d-27a6e0cf30e4", "comment": "Malware payload (Jalapeno)", "value": "a147dded01dd4b959d2c038393a08ca04f6fc7e81f3a15b59af9ef86c898c8af8b03c1179eeffb2e0e204fc67ff5e514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jalapeno", "colour": "#A14FF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242923, "uuid": "5af88381-a12e-46ce-ad77-4ce8ef28ab19", "value": "T1A7B2853DD5E1ADD4C7AB22F07CBFB7C511AADB17A82A472CF9C814411A60264EF74648", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242923, "uuid": "3667a943-19a4-418f-b306-a22316b57f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242923, "uuid": "421e35e6-86e2-4d2c-922b-09da4af294da", "value": "384:Kz57Ngy0RmnJ4b1PkS1qujsvnyVnFcY+lVexucEdr7KN4hH5IU0z5BdIg0oUzcJN:Kz57Ngy0RGKbFpovyVnFqmEsChHQxIgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242923, "uuid": "a03ead93-9c64-43a5-aa1f-8973e3c669fd", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242923, "uuid": "9b865d28-a2fb-4dfb-810c-5d7cd56a0d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242923, "uuid": "89442e23-c69d-4234-9184-d952741a18a0", "value": "5f5222ee17d9c60f53f82246c8331f07ffa4b32cc9b4e100c852fb6ad781d801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891e8855-4b10-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778266981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266981, "uuid": "6b0ad09e-ad25-4928-91aa-f128e61ee249", "comment": "Malware payload", "value": "5972536632746f5cc34a20175dac485b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266981, "uuid": "7b662346-f2c0-4923-bf1c-38747087268d", "comment": "Malware payload", "value": "5f5b7effe65576eeb6e4007a2f0f5034bee0d7db295f0b3d6a9e1dd0f59d093b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266981, "uuid": "fc76f2b1-3ce6-4abe-9e5d-a9bae8d707eb", "comment": "Malware payload", "value": "6fb34a72c616259b7b7693299be0bbbe69a39a9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778266981, "uuid": "428bda8f-60dd-4b1d-bd53-2f74a88a68ec", "comment": "Malware payload", "value": "af97c9558e1789c2abab6b8f4c92c1c3697b23198c3ee0789e8deb3f643f70a21b40609dc1d83bcc787e40dafde90822", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266981, "uuid": "f44fc909-81cb-4fa6-9776-cb63d0a2c49e", "value": "T1F5137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C496DCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266981, "uuid": "5477f4f0-9b1e-49c2-8657-535e01469b72", "value": "768:bc+09GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bc+5co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778266981, "uuid": "31ec0dc3-6c44-4f8c-8b3e-b23729ef77e6", "value": 45408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778266981, "uuid": "a5793b74-4a15-494d-a1fd-625b147de554", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778266981, "uuid": "7de6c318-3cba-42ae-899a-398575ec92ef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0e2b2c-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243012, "uuid": "c4bb8690-128f-4081-824d-3cded993750b", "comment": "Malware payload", "value": "a6dca26b108a9ab491c433243fb9f476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243012, "uuid": "7f9064e8-0310-42b4-982e-66a0557226d8", "comment": "Malware payload", "value": "5f6414cac3ec05a2e4e5db5c7fd5a1fbbede7f9e1f2f81c37cf3fc368cfb7a85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243012, "uuid": "35582d59-a162-4c9c-9e19-18baf60cb15e", "comment": "Malware payload", "value": "306f23b672d93f7958146250d8ff971c954e1ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243012, "uuid": "d168bc9b-b539-4d6e-8221-d5de552cc7e3", "comment": "Malware payload", "value": "5fa8550298feadf47e55c85c9a62066eddfccf9639bccfbe5a0353ab34be5be88c0a291f057afa8d0546035b72aa1e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243012, "uuid": "667b198c-d147-437b-b567-fcc4b2a19abf", "value": "T1BEB2757CD6E4ADC4C76B12F134ABF7C111ABAB17BC3A5B2CB8C814451E20754EB78698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243012, "uuid": "36534a6d-b80e-454a-848f-1bc6b57d3e5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243012, "uuid": "dda0dfbd-d4b0-42a4-b46f-30cb7fb42ba5", "value": "384:Iz57Ngy0RmCs4b1PkcmLExslBELoaKpwp1+YcGatCfk0Z+jtc9xCLDvlk06AhjN4:Iz57Ngy0RbnbFVoaKpEcGa4M0IyCLDvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243012, "uuid": "c169f429-e8c8-4d7a-8cd6-9a03204391f4", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243012, "uuid": "8b02d8fb-f50c-4ae5-8877-2af45bf3f4c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243012, "uuid": "3921e976-939b-4f38-b111-d152840a072e", "value": "5f6414cac3ec05a2e4e5db5c7fd5a1fbbede7f9e1f2f81c37cf3fc368cfb7a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c2d15f-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236236, "uuid": "d46e7341-3225-4001-8891-d965b20438b6", "comment": "Malware payload", "value": "c073145a5157fc9a9692fd4f1557ce08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236236, "uuid": "aad7237d-8c19-467a-a990-2d63f2f6f52a", "comment": "Malware payload", "value": "5f9091b65d6c4aec09549b33a350492a797c1258856b05bfea6ed54f579f78ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236236, "uuid": "e4937b33-25fd-40c1-af2d-985c4bafbecc", "comment": "Malware payload", "value": "d47257f229756531941b7bd0c461993ef7d70176", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236236, "uuid": "faa0181b-5dbe-4ccd-adc7-26b0aa5c2262", "comment": "Malware payload", "value": "31ae057800e7781a3ddcf9f784e220b6e6030ce681ac3f86f6208435b64c42402ceca49389d1905529664abbd8811689", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236236, "uuid": "342d7cf0-ec1c-4495-9e23-601c1a5e1354", "value": "T15A848DD87086B6BDABA346E4507F510AB13E1E15A40D8450F13CECBA3A79447A17BFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236236, "uuid": "22c44ea3-256e-41c8-a16c-dc9ed05c9202", "value": "6144:UycSwGs92YNdiU+I4v9RX5Tpji6R94GxhVO7BA:UmmdiU+3v9RLjn4GF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236236, "uuid": "c207423b-8573-4a6f-9250-43c739c90d75", "value": 371801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236236, "uuid": "1e992088-87a2-40b8-b1cb-beb07cd43d00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236236, "uuid": "b4cd8974-14ce-4d6a-a5bf-535ad3b730cc", "value": "index-BlsTEt89.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d1a01f-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243939, "uuid": "57812097-bde7-45fd-833d-35e9f4678a09", "comment": "Malware payload (GuLoader)", "value": "2ee30f0f81d0ca00c01e4fa3a5e6744f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243939, "uuid": "4537c789-1c84-430a-93d7-cc62b898f3fb", "comment": "Malware payload (GuLoader)", "value": "5fa4671e8518c58505393972907b6f845f6184ea64eb547d62693959bd26ea7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243939, "uuid": "6f994a34-e1f5-4c6c-9494-043126cd320e", "comment": "Malware payload (GuLoader)", "value": "57fe790715e99f2f3feb719de68ccb4c611ec0eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243939, "uuid": "bb8be6f2-1078-4fd0-94b0-adbd4393dcc8", "comment": "Malware payload (GuLoader)", "value": "0571f11f316d203b0b1b895b896e7094ddc84ed012e389b1b6474a8d1d0cb9a4909f6a926f60db02dea668543e6d1fb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243939, "uuid": "b41e228f-3af9-4c2d-8625-90028ef55f9a", "value": "T165C4BE72E103A686D91838F9C9279DD534C4AC5AD1E0E4A9B4AF3B3DC0F1B51858FA1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243939, "uuid": "7395f6d9-9664-455c-9124-6b52f00114cc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243939, "uuid": "1e75ab9c-c0f8-4e01-b132-8d07eebcfc81", "value": "6144:fmOPM7+Tke5cUOWoSFr7uDiuWTKcEcp3gcyfe1x9DfOQMuvk/fFWAXCb7cfo:hnoSFnuDEvEcpwm9Hnvk1Wy07f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243939, "uuid": "fdf049ee-dee3-4a25-be17-56e32645c63a", "value": 577576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243939, "uuid": "6526e36d-580d-46f5-b87a-12685f6fb9e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243939, "uuid": "36ad829f-a884-4d54-b3aa-356a3f1987a4", "value": "5fa4671e8518c58505393972907b6f845f6184ea64eb547d62693959bd26ea7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d035b9fc-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243049, "uuid": "24ad9e50-969d-45a8-9e7d-004f3cdb71b7", "comment": "Malware payload (Formbook)", "value": "94d3d050716c4286c1b210433ea589f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243049, "uuid": "a2fc805e-40e9-4f33-95be-11e37cdf8a15", "comment": "Malware payload (Formbook)", "value": "5fb5cfe8cfcf61abbd5584bdea0375b1c8deacc55379efd9d4e3bfb8a27c5149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243049, "uuid": "dfbd636f-0461-4207-8ebd-a6eeafc5de49", "comment": "Malware payload (Formbook)", "value": "ea6aeab1fbf1de02c0f335be48549d4729835bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243049, "uuid": "b244ac84-01d6-47c9-8c68-85d0fb25a870", "comment": "Malware payload (Formbook)", "value": "039a74fd5820ccde5fccf7cf5d05f210cf599c916cfb0243f4855baf4d9cfabbe6fed05c91608967ae53f4d0feeb0874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243049, "uuid": "3e3fb8f0-aa6b-47fc-8f78-213723339fb1", "value": "T1A9450244261ADA02D4925FF00970E7B447B85E8AA452D313DFFA7EEBFD3A7463D04292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243049, "uuid": "4afaae85-2f7e-4c2a-9793-07b376ac358c", "value": "24576:NSJJSHwApOC6W0TSGrWDa/PlZtvos5I2sPHJ2dNFZadDbB:NqUwim3WGrWDcPl0r2sPJ6ZaRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243049, "uuid": "64808d7f-7a44-4d69-88eb-b3998f72102f", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243049, "uuid": "ed5a81a1-3239-41c1-9217-6abaabc6c15d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243049, "uuid": "774f7377-bea4-4bc9-9e86-db85f8616073", "value": "5fb5cfe8cfcf61abbd5584bdea0375b1c8deacc55379efd9d4e3bfb8a27c5149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6442a50-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246092, "uuid": "38c3cc35-eaaa-4921-9285-d5a0ca8884fd", "comment": "Malware payload (Formbook)", "value": "f7395eb0e4690380add92f7afd6c031a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246092, "uuid": "14558085-df14-443f-b08b-e7405f3a42c5", "comment": "Malware payload (Formbook)", "value": "5fd1e3d2ee543d349fada17d54ef9d673c23c4945bcd83e1d9e893e7da18d289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246092, "uuid": "ac1e2bfe-db8a-47cc-b136-929e98d9ea8e", "comment": "Malware payload (Formbook)", "value": "3abbd7a91b7b602bc604c5c636a2d66c028307e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246092, "uuid": "0b3525f5-93ca-4e5f-882d-7c97bccae14d", "comment": "Malware payload (Formbook)", "value": "0b31a3d368a1576d1052b1e48c95421e458918cd7101e273a1e1db99c15320aed31748e4834cd38c2589a4a7103d14c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246092, "uuid": "6edd1569-ee15-4209-a52f-1c00683b458d", "value": "T158352229656DDE06C4AF5B742C22E2B01378AD9CF521C5478FCABEEFF03A254456930B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246092, "uuid": "24b05f34-0f55-4016-9cbc-db250dd67af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246092, "uuid": "deda91cc-2d63-405b-bdd7-4973c27950ac", "value": "24576:G5hvQ2DsdjEkLFb/fF47KQPfbdNRkwy/xr2JCX:G5h4GaFb+7VHty/Is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246092, "uuid": "28968e13-c0e2-4afb-8be5-a67c7b060068", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246092, "uuid": "543cd8c6-667c-4c2d-be74-b0ac94141ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246092, "uuid": "b77a2f4c-0823-46f3-9788-3da166f26bb0", "value": "5fd1e3d2ee543d349fada17d54ef9d673c23c4945bcd83e1d9e893e7da18d289", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c150c2-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256476, "uuid": "e5ca8c80-e24e-49c3-80d5-0dcb6d7188f8", "comment": "Malware payload (Mirai)", "value": "4439d57df540ecad6b711bbcabaf570c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256476, "uuid": "c60153ea-a166-4ff2-92b6-29fc3aa3b340", "comment": "Malware payload (Mirai)", "value": "5fd9f9a475ed90f464b37a86b1fbe50b3efddfa10578716315380a6ec74672d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256476, "uuid": "4fb6c337-7205-4b9c-9b4c-58d4e7e562b7", "comment": "Malware payload (Mirai)", "value": "2d1c0f9b4f3aef95e1dfc121fce610d323b95648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256476, "uuid": "5afb1fb3-db8f-454e-aba0-8b32bc1e497b", "comment": "Malware payload (Mirai)", "value": "b26a60ce704c716c95bbcb60cb6ca9f5d89fcfe04541f724a5ce3dd38c34069e3bd1d7b1e01e997de5b9e7fa8793f752", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256476, "uuid": "6bf60c53-13a9-47ff-99fb-ea0dfaf62a95", "value": "T1A9B33A46FC829B12C6C613B7FA6E418C371913F8D3EE32039D126F21778A85B0E67995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256476, "uuid": "19c2f463-ef5b-43c0-82c3-90d86e973ff6", "value": "3072:h2u78uJzKmaAhMI8O57Ni6Vax53wbZnN:h2uA2KkhJ8O57Q6m53wRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256476, "uuid": "6f266ffe-d704-48df-be1d-d224fe72fc8c", "value": 116268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256476, "uuid": "4d973b55-e921-4aef-9ff5-7e5fc4faa60a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256476, "uuid": "fb9630ab-f10e-448b-a6df-081dda110204", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b3f1c3-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243694, "uuid": "422bbba6-0dcb-417c-88da-b673bea9accd", "comment": "Malware payload", "value": "5a1f57fd6a6ddc111f0cd64a4542f384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243694, "uuid": "c722e824-c766-4d0b-a968-44f696dcd906", "comment": "Malware payload", "value": "601d1587b242071cd384523d6548167020703c6b12020d312f5c9acadf919017", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243694, "uuid": "d73fcaf6-b003-459b-b172-339cfe28ae31", "comment": "Malware payload", "value": "d6e62314ba3024f0054476ed0b4e32e51c01d40f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243694, "uuid": "78f8045a-dbd6-4e56-a716-ab71cbef761d", "comment": "Malware payload", "value": "d4af1bd9e43fca02a39dc464276e4d9f6614b1249fc5b78229601b493c368118d659a43f49c6ea02ce645458f6af1284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243694, "uuid": "0fc787df-1899-4d49-ad81-ec30faf7a47d", "value": "T143E312CD97808E23C83C8E78F6395CA115F5CB9A4D02E30F1EE5C8D51A7BA445AD3BA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243694, "uuid": "37f8431b-cdf6-4a8d-a5de-84331d4ef855", "value": "3072:upibHr0Hea6Qw8GHkctS8+3YgUVKjNW7vSzXLKwFzWHKnGeJlV:ux+a6QwPl+ZUYBW2bz+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243694, "uuid": "b9b1b517-2e04-4929-aca2-5a6851e35236", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243694, "uuid": "30e030bd-371b-4b07-99af-a08415f4bd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243694, "uuid": "7e11e91a-f4a1-4aab-85cc-9edf496493a1", "value": "601d1587b242071cd384523d6548167020703c6b12020d312f5c9acadf919017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1628d1f-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778233521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233521, "uuid": "a8b4a2d3-8dab-42e9-a313-0c8c6c2b4f06", "comment": "Malware payload (RemcosRAT)", "value": "15c632a5bb99baed87837075929d0e6a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233521, "uuid": "c40dec81-e48a-454a-a34d-0ea3543920d0", "comment": "Malware payload (RemcosRAT)", "value": "604017830c520afed1e339fec58286d09494b7f63243d4aab8acbcd30fc34cf0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233521, "uuid": "4589c653-ca17-4bf3-86c3-b7ba7fd36324", "comment": "Malware payload (RemcosRAT)", "value": "6a33847ae0a957925e2b012623120cde4b6ef356", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233521, "uuid": "089c7c17-6f0f-475c-944b-188b77509279", "comment": "Malware payload (RemcosRAT)", "value": "d3629dcb60a619930b47564433b718b7bebda718eecb25558bc8bb9e085bd01f7848679203472b1985b781960c5eb7b9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233521, "uuid": "19818fa0-6ec5-43bf-8b31-e8a644117b4e", "value": "T124150211F941E22AEA110F314FD6C1DA823ABCF2DE16CE473A41731F3EB2BA16D96554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233521, "uuid": "0d328e57-00cf-4e9b-bc81-fcee55bbaf51", "value": "24576:B+EpoY5bNghsiH5IwsTz8UeeLLLLLLLLLLLLLLLLLLLL/M:NpPgH5IPz8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233521, "uuid": "adfa3fd4-8d54-4794-ac49-dfbd2ba8b8ef", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233521, "uuid": "2321abdd-35f9-40fd-a21b-9228c372e8fa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233521, "uuid": "32d135d6-4bcf-4334-bbfe-877a0b52f434", "value": "Supply_RFQ with specifications & requirement_2026050213.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2790469-4ab2-11f1-a769-42010a9c0008", "comment": "Malware payload (BabylonRAT)", "timestamp": 1778226785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226785, "uuid": "faf66565-e0ff-47bc-b342-dbc98682feba", "comment": "Malware payload (BabylonRAT)", "value": "c35e5936814a357332e903cf4683217d", "object_relation": "md5", "Tag": [ { "name": "babylon", "colour": "#E5ADB7", "exportable": true, "hide_tag": false }, { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226785, "uuid": "11cfef4f-6445-4b61-9ff2-6eb7f0191862", "comment": "Malware payload (BabylonRAT)", "value": "60afdd784796754f4c91bdd26b72157cc62692fa7134bc91bee694fbb2b0e057", "object_relation": "sha256", "Tag": [ { "name": "babylon", "colour": "#E5ADB7", "exportable": true, "hide_tag": false }, { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226785, "uuid": "d37d73c5-496f-4fb1-8d55-2364b4194657", "comment": "Malware payload (BabylonRAT)", "value": "19bd3ac8c23869c6124e17dad4006fc05e999d30", "object_relation": "sha1", "Tag": [ { "name": "babylon", "colour": "#E5ADB7", "exportable": true, "hide_tag": false }, { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226785, "uuid": "bc0bfde1-8fac-4595-9423-1514bd02e0db", "comment": "Malware payload (BabylonRAT)", "value": "a9fa797f8511185a3c9917f6688ed90a1e660f0929a2f775132c8047b271c8704bb5cf493f9745d7ec27aae03dd5bf0b", "object_relation": "sha3-384", "Tag": [ { "name": "babylon", "colour": "#E5ADB7", "exportable": true, "hide_tag": false }, { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226785, "uuid": "df5eca0f-5d90-486f-b093-b6a1dff119c1", "value": "T1CF74232248DA161BC8A79AF844046ACCCC6F095F00DD9BE5CB917AF7705FEF195509F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226785, "uuid": "3512efd7-7c85-4274-9166-830c4dc44f2a", "value": "18aee7cc80e48017bb06b13550617d1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226785, "uuid": "312eea4a-a085-479c-a754-20171268fe42", "value": "6144:lL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQTUoKVY4qf87iJwP:lLdcfxaeM6fy/KaVUtgKkTZ73coU5C/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778226785, "uuid": "9e420a59-404b-411e-9835-dded3fb0538c", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778226785, "uuid": "dafa5039-a00c-471f-a367-636fe336e885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226785, "uuid": "566bcf3f-d04c-44fa-bd41-9a81e6562a5c", "value": "services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc92cc5-4af0-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1778253324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778253324, "uuid": "30c750d8-8185-4770-b559-3debe9aca982", "comment": "Malware payload (Joker)", "value": "25ad59a36055bbc6ed393bf91b95d966", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778253324, "uuid": "50d432cf-48b0-434f-a25c-9d8d64a8b417", "comment": "Malware payload (Joker)", "value": "60de738b66d228b20839788846733aac30899dee9fdd33f026f29450e96a13b5", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778253324, "uuid": "446039a3-6e48-4aa8-93fb-f7602ae0d754", "comment": "Malware payload (Joker)", "value": "eca4868b8fb429b7b838feecdb5fae96eda68854", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778253324, "uuid": "ba09d56e-6721-4672-a383-9202a55246d8", "comment": "Malware payload (Joker)", "value": "82532edd0474052314f5a127b17761f2991821290cd6fe8ee0028c507d244b0e56b01da6de46c9fd658185f749bd1b37", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778253324, "uuid": "31186320-283c-4ddd-9e17-728f8ac4fd46", "value": "T16166BE0B6A565F3BEC7E433C2CB64B4427326586F66343477444E2A8BF236E137992D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778253324, "uuid": "81189d86-3e67-4821-9079-4df8a539f83c", "value": "49152:UDv4wMHb1ALOiXNvnA38P9W424XbYO0SW5BwnDVJBV08pdXoqBGBHpmaTUCF/9LX:dVim8xeSABwNRwdAKLtMlNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778253324, "uuid": "e4fafb41-7c72-476a-ab3c-40b005260f1b", "value": 6774434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778253324, "uuid": "1ffc5f0f-5e10-4c8f-b61f-956f0700a83f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778253324, "uuid": "4dd15c54-694b-44c1-a3d1-964287c3807b", "value": "com.phoenixbrand.cleaner_1.0.4.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514a2b7e-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232528, "uuid": "1d9ec38b-704a-4cb5-92d1-379bb244ec34", "comment": "Malware payload", "value": "1ff2856b51f53adce26a0a5c1d1711e7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232528, "uuid": "91af324b-797f-4f2e-b65c-8a5381675904", "comment": "Malware payload", "value": "60ea90fc34bc72f59840ed78a3cc7f8b1c39f5bb0569b848ac74137020a0afc7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232528, "uuid": "e33a3580-4343-4bb2-b3d4-eda6d7e40a04", "comment": "Malware payload", "value": "9da6690e3acc52fc521d545511fc028393169112", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232528, "uuid": "2cd9ee54-e686-4d8f-ad53-bdc249dfb0c5", "comment": "Malware payload", "value": "0a0ccfbb3970e47e0b5336f4ffd6bcdebfaaa4e7f59f7ec104d3ed696d631f8e678f33371a457165074d61fb4a5dc536", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232528, "uuid": "3e7d807f-70d0-4fca-8732-ddcf2d1ad772", "value": "T1874293476381237705730556BA5D70E5E72A807C633BC664B86D863E2BC0C38A6FBADC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232528, "uuid": "8f1d8c56-03a3-417f-a1e5-4f53fd0ee94c", "value": "192:23LQC1TpBxWc1iiX2MB7GdlywfKkAlhNd0SC3ejLtvjmVK9uoWXCRSyEBX3yb:Wb1f92MxwfPAlhPCOjL1mVKIaRsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232528, "uuid": "43cdc47f-42a3-4408-81a7-6045daac710e", "value": 12415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232528, "uuid": "3da27457-1e09-4ca8-aa0c-65b039d2c494", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232528, "uuid": "77ae62db-99cb-45dd-8921-285f59fa7f25", "value": "BSD9_632461.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd76014-4ad3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778240981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240981, "uuid": "5f2abf27-f68b-4e2e-8d89-af672dca8be0", "comment": "Malware payload (Mirai)", "value": "7df04758c1a9f37eede82c2e50cc0816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240981, "uuid": "2ab84397-4b12-40ed-afce-b87d69ee4775", "comment": "Malware payload (Mirai)", "value": "61050514ff65c96dec60f67e8a0aa2820dfe78701957465f9e031e25674286af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240981, "uuid": "963964a2-a621-4170-9eb9-c38b77d46ad4", "comment": "Malware payload (Mirai)", "value": "0c2c4bd75691db3c6a2626e23501d37ca349a89c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240981, "uuid": "295731bb-bbb2-44e4-aeb6-b4719d62a724", "comment": "Malware payload (Mirai)", "value": "6bbd7b2af6370d5a8544f59dfb91d5d2f067b85c794f8039998b4741df6678221c36074aa3f2c4adadc15f526d6c1439", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240981, "uuid": "683fe52b-c4b1-47e7-91bd-7b44a45e39a9", "value": "T1E3C3F845FD504B17CAC266BBFB4E438D7B2A1758D3EE720399256F30378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240981, "uuid": "6c5474cd-5f3e-437e-a94f-fda0b3abf9eb", "value": "1536:Ypr0hMmaQLhOY2NsneLF7wfodT5XM8zGyxxvOllKkpSIf7pPlorwyw8t67h89wNE:EKaQ9OY2NsilwiFXM8RxQB8IT39sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240981, "uuid": "24296a66-2d07-4b80-8759-a9315bb5dd0a", "value": 129592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240981, "uuid": "568762e7-e0ec-4f03-8aae-7dc245608d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240981, "uuid": "21616113-28a6-49ee-b18e-951712a349b6", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ca8a59-4a99-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778216030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216030, "uuid": "7e9e67c6-3405-4468-aebc-6f7786155b5c", "comment": "Malware payload (Mirai)", "value": "63dd3701f460a1029c58b77381932a6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216030, "uuid": "bbbffcd7-6022-465f-a8bc-578f9114f477", "comment": "Malware payload (Mirai)", "value": "61ffedae361262676d55fa789e65bce2abcd8490d19b4cf0669c23ad41da0017", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216030, "uuid": "d70dfd80-8ae4-4e61-afd0-1e13694b3f1f", "comment": "Malware payload (Mirai)", "value": "41cbf325f7737f2fe03c23b61880d28801239ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216030, "uuid": "5ab05b1e-86cc-4e41-bd2a-607840d65de1", "comment": "Malware payload (Mirai)", "value": "7b739ef516218c5c02dce956734f806355eb4e66aac04b7c27e631aa51f72fe4e299f3bb79a319ea1d082145509bb424", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216030, "uuid": "8b428cc1-e353-4de5-982e-1ffe755292a3", "value": "T176D3B021E4006DD1EC2129F578BA96BC0350EE700BDE1586EFFDE95E747BD98386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216030, "uuid": "8ea6cba6-8995-43f3-8061-3e34a0c367e4", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xG:PCdny+hovsmzbisJf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778216030, "uuid": "53c09f5a-0f3e-41d0-9529-d51c82bf9c5f", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778216030, "uuid": "fc6f9703-be38-4b13-9cfb-0af5ca92bc0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216030, "uuid": "0b027ca1-7b58-42b0-a6c5-8ec24dd39604", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77356da-4b2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778278280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278280, "uuid": "24aa738f-65a5-4d13-90ed-d36b23f7b092", "comment": "Malware payload", "value": "b885d433ed26f23fc52093616a01b65f", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278280, "uuid": "e3e3ebfa-08c9-4932-84b1-00cc5524e6b0", "comment": "Malware payload", "value": "6210caacd4c7a3219ad6327b714c53d286443104ba06e3c4270f7e9a5d25ecee", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278280, "uuid": "ca1737b4-6491-4488-9677-e1704fa7cf8c", "comment": "Malware payload", "value": "162ddb4b04320914aa4a0f5e9640dac78220086f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778278280, "uuid": "14a63fd8-621d-424c-86df-d50e6615458c", "comment": "Malware payload", "value": "a8ace5bf510aa0e45f2d8229c8f248805378b34f8c7232c2d15008bd29b271f046c5a65d9b4fbdf1cca4639eccad1205", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278280, "uuid": "0a954688-7e47-4be0-b825-cfd552f7422e", "value": "T114867C82BC0D25E2C6CEB5755F6602947239BC444F82CB276A14BB7DBDF2794CF121A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278280, "uuid": "d5c59e46-0dfa-49e4-bb5a-8656bd311ea8", "value": "3de4accde96db241dde5859ae8f94797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278280, "uuid": "ab6ebf57-8330-4519-a9b9-137507e07b34", "value": "98304:jx7J4DoAStPpUmSMkCYgRrrLpPAaNPZ4SAKER:jx73tPpnYATJAaNPZ4dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778278280, "uuid": "e0c791cd-d7d9-47f0-b2a8-52f04faf5b26", "value": 8011784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778278280, "uuid": "0fd397eb-c8a7-4093-b500-aed5146c51aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778278280, "uuid": "97038cd6-141d-442d-a2da-2d025839f77c", "value": "6210caacd4c7a3219ad6327b714c53d286443104ba06e3c4270f7e9a5d25ecee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f14c62-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244671, "uuid": "a99755e0-4932-4c90-8204-2210662c26bb", "comment": "Malware payload (a310Logger)", "value": "25d7c69f2656bdd9d6e435f4fbf2881f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244671, "uuid": "130f0041-c83a-44f9-8e9a-aac6a07a004c", "comment": "Malware payload (a310Logger)", "value": "623d20dfeb747ce10c77c544f9dea4622bdd3177a490cefa7b0fc350dd59841c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244671, "uuid": "0049eebf-2354-4298-8762-7bbe8265d460", "comment": "Malware payload (a310Logger)", "value": "5ee8a4de7bd8ed006eee4e4882d6aa6a70c08ef1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244671, "uuid": "b6a6f406-76be-4b20-ac9e-0e74da45ae5e", "comment": "Malware payload (a310Logger)", "value": "189737f664b5042c61c54ef83f19bcf1619091331e77345edbe7ca29eabd0e8af8a136ef78fbf4d135534cb5702e1963", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244671, "uuid": "863c107a-1a03-4d3b-985e-1b61bad7be07", "value": "T12F944A13EB60611EF2A389F1A8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244671, "uuid": "362bd709-725e-44a5-88bc-35c18edbcf4c", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244671, "uuid": "faf1b858-a413-410a-bae3-aabfca25e864", "value": "6144:bp8d1/w5KA81IJ8GpF6nuTmOOUiBUrjLWXDVeuntS+tGYGwLLySvhYG75:byjYKkJj6GmZUiqr0RtNhLySvSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244671, "uuid": "7db8f84f-51f7-41f6-8531-dbabaa67aed6", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244671, "uuid": "c5898808-2792-4437-8d88-e04d79dcb089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244671, "uuid": "11d1243e-5adf-4c86-99a2-9f1364516d68", "value": "623d20dfeb747ce10c77c544f9dea4622bdd3177a490cefa7b0fc350dd59841c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09bde8ad-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246581, "uuid": "38e13178-4f04-4d10-b28a-631c1c410a30", "comment": "Malware payload (RemcosRAT)", "value": "1a099af9fdd61de700e48d8c06c13e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246581, "uuid": "e25fb2ff-054e-4f8e-9d60-c6cc4e36b1af", "comment": "Malware payload (RemcosRAT)", "value": "62aab8c2de238a9c9d0ff53575cac53b1a237bb0cba118404688308db799c87b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246581, "uuid": "9c685e72-8429-4f95-ba79-ade471dcd934", "comment": "Malware payload (RemcosRAT)", "value": "3980b0591caecfc65ba280e72e75f4498c09c806", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246581, "uuid": "7924efdc-9a2a-431c-84f1-1040c366047c", "comment": "Malware payload (RemcosRAT)", "value": "06ad54f0fd7847120f23a0466792f0cb68a8dca37023f5c92814e0e6c02b23ed000305c555c9b9a6fb423bf2cc9c183d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246581, "uuid": "56ab12a7-e2d2-4238-810b-01753e8f0f22", "value": "T13C94F0147BA8C907E7901634D5A1E77D8A74EFF82D0AD3139BFD2C9E7269B652C28301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246581, "uuid": "b0b3e9c2-98ef-41ef-a7e7-168678e23583", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246581, "uuid": "7ede2a56-fe5a-4573-b20f-e1c8ce126899", "value": "6144:bQ606xnSmhEWFK+aFN4x6FUJD4QxmQDxHl/j50LnEEfTbbYDVUMXYv/q:tMzFSx1JDLxpDxdj50jEELeyHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246581, "uuid": "ea088100-bfb3-4e4b-80f3-fb3ee1734deb", "value": 426576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246581, "uuid": "25ab7fbe-f49a-4e3d-9b37-40c7fd4e3a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246581, "uuid": "899caa91-9263-4dfd-b74d-72cb5f149e1c", "value": "62aab8c2de238a9c9d0ff53575cac53b1a237bb0cba118404688308db799c87b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1624cad1-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246172, "uuid": "ae6288e4-2590-450c-966a-90fa54f702a3", "comment": "Malware payload (RemcosRAT)", "value": "2feac754d4a22f15c3f6b6b2338ba808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246172, "uuid": "74c45deb-76ec-4451-9ecc-4fbd1ac37635", "comment": "Malware payload (RemcosRAT)", "value": "62e6975a18935a9ea1a7df19ec7d2d5bed90136d196581d63b112c3f6f6c5bd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246172, "uuid": "b12f3932-7aeb-47ad-865b-7f505ed5edfc", "comment": "Malware payload (RemcosRAT)", "value": "e81145ef625aafb7c01a032f50f6d2cee5f1aae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246172, "uuid": "b0906863-da21-45f7-8bb3-566cca4c1e0a", "comment": "Malware payload (RemcosRAT)", "value": "c85f46d8139e95a267e0c2e6434eb41c0a8765f6311cf97c4747de7c88fde397f00fb63545e39c4034fb690342f57720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246172, "uuid": "8e592ea1-1c98-46f3-970f-aceb5f5fe5ff", "value": "T1E2F43A516670E7AEE6761A39B4CAC36D65547C30AD06038FF1B07FA807B2EAC5F82351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246172, "uuid": "13afd36f-4b45-4ba4-9df3-40225eb6a191", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246172, "uuid": "9879e18a-242b-4570-97c8-7eeb8a222163", "value": "12288:TSW9MrpT34uxqhxw3LCv9SC21ZU7ee0AXh5fLh7:TSW9MrpT3kbw3LiM7U7ee0AXh5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246172, "uuid": "29834e08-ebeb-48b3-a0e4-3064e5590245", "value": 727080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246172, "uuid": "0fb2079b-e33e-4d3d-8642-7e1a46d1c1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246172, "uuid": "91354fe9-0a2d-4a7d-a7c5-1a86b06d37f8", "value": "62e6975a18935a9ea1a7df19ec7d2d5bed90136d196581d63b112c3f6f6c5bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1335ffa4-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243161, "uuid": "e76c34b9-e80a-411b-b9f0-3f1b60e06fc9", "comment": "Malware payload (AgentTesla)", "value": "a6a8c94c94c29bef4d0282c63e1626e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243161, "uuid": "42ad4d52-d05e-47eb-96f8-c41d3c5bd5f5", "comment": "Malware payload (AgentTesla)", "value": "63730a04620bca56f24de059c6b02a375f7d7a86e6cd299b9886a130a74cbf5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243161, "uuid": "3ad85cd6-bae8-4d68-9d10-71e46cf67744", "comment": "Malware payload (AgentTesla)", "value": "4d9f9693531be8a649bac2d7b2dc745bba33e62d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243161, "uuid": "fdd5c626-96ea-4c79-bb31-53f92d44c74e", "comment": "Malware payload (AgentTesla)", "value": "61999219448d2288cb6dca56fe9d18b3e0a8b84e706ff531bce585a7016975358371ff91815187b1add027c3e543ca34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243161, "uuid": "d7f27575-6bfb-4674-b432-59a518fafd00", "value": "T1DA340F027F88E715E1A93E3782EF2C2453B2B4C71733C60BAF49AB6514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243161, "uuid": "baf937e7-0933-4e85-a0ee-d85407258e87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243161, "uuid": "496989e4-f1f7-4063-bb62-a30ffb0f98b9", "value": "3072:do56iyqadl0aDUOE0pnTHo9rG8KaG5jnTh0q8ufzz:e6iyqabxuQsq8KaWTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243161, "uuid": "57829685-ed73-414b-931b-4a707b386025", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243161, "uuid": "8987a751-0998-4ce1-828f-c0630fe8e364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243161, "uuid": "4b00fff6-0bba-454c-b34f-fde65310f79d", "value": "63730a04620bca56f24de059c6b02a375f7d7a86e6cd299b9886a130a74cbf5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc32d125-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236251, "uuid": "e7738baf-c8c1-46bb-92a8-2303045135c1", "comment": "Malware payload", "value": "f9880494681c3e764f282d367ae5c20c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236251, "uuid": "c76437da-d791-41a8-9600-39ed23f82974", "comment": "Malware payload", "value": "6408d238d4280c79b78009b4e08a0a0131e26075a06d05d349749eb34a741c1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236251, "uuid": "3be45f9e-beda-42ec-9d32-c86f4d47b860", "comment": "Malware payload", "value": "73a571a998c22c897978402151e34b28095ab192", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236251, "uuid": "dc39cb2e-c75c-44c9-8959-3c1129a6ecd6", "comment": "Malware payload", "value": "36bea7bdddd52957c9031d3fd1d1484486b92d8bb67977703eb27dba8f897e92311a9b7d1fc6498b731b24b9345362ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236251, "uuid": "6ceefa63-2de8-4166-91ab-081e43792f0d", "value": "T15973085172BA293893A8D19B30796F82B3B0545DB414845CF9ADDCFEF90EC83107AB76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236251, "uuid": "678a27ff-d311-4502-9a08-b1c5ff4d36d0", "value": "1536:Uzlq08jpCugTTvncUX1nSPe4nJ0KC40ygAhnrH7x1vc+cxLhmh2:UzlQATTcUX1nSwKC40HAhHx1vvsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236251, "uuid": "50f8e3ff-dc0c-4a3e-87b4-01081c741fd0", "value": 79981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236251, "uuid": "e66276c8-d18e-41a8-af66-782ec0db01f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236251, "uuid": "0330d45f-386a-4e51-977e-c6bb7f7d253c", "value": "inject.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f9da77-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243493, "uuid": "e87da0fb-438d-48af-85fd-97019ffd8b88", "comment": "Malware payload", "value": "ac3ab413142dbbe8395db5539bd87106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243493, "uuid": "57e992ce-4260-434f-95d6-f112ebcc834e", "comment": "Malware payload", "value": "642eace2e18aeddec6152b6010a6af7977ae80a273c1914e213bb7819fa7e9c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243493, "uuid": "ed2eafd3-e145-403b-8a32-9cd10cc2ce32", "comment": "Malware payload", "value": "9d0804908fcc35566af7391e2e0f5d59508805f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243493, "uuid": "6d82372e-f557-4011-9514-a8ea6762fff9", "comment": "Malware payload", "value": "a08464f084841571ee6e4f8eaed4599809879ffab678cba7e0a4c69d387f89fcd08d48e62422d23121efab334752cce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243493, "uuid": "bd7fd638-f114-49f9-9d9d-de97e4061cb7", "value": "T1E13502443299DE02D9A75FB40E60D3B417B45DD96422E317CEEA7EEBB9797012C082D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243493, "uuid": "b37c00c6-85ca-43dd-9937-70a98ab3abad", "value": "24576:IodIT4q1uHcz0eWJAFSpX6nkEMB9GUgX7uAmj+xZJlXTIa7SJJSHw:Ionq1uHcoRRpqAB9GUodZjF7qUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243493, "uuid": "8ba4b928-5fd5-427b-a0a7-f01a3b5649cf", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243493, "uuid": "2300a7e8-8a6a-43ce-937a-a4d2daee6684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243493, "uuid": "037b82c7-5f8b-4948-8aab-8ab449fb6682", "value": "642eace2e18aeddec6152b6010a6af7977ae80a273c1914e213bb7819fa7e9c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e0a4bb-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236701, "uuid": "a915cdb7-1692-4385-84be-d4b2884fdb01", "comment": "Malware payload", "value": "e3dca889ebffac29b373ad21c2510238", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236701, "uuid": "fa97171f-9f4c-41f7-990d-5613318290be", "comment": "Malware payload", "value": "647f3b7f4d3412c18fb9c34b26f904bcfedc1fc950746be29f33ceeea94671b8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236701, "uuid": "1d94dd0b-ef19-4a0c-a007-59a181f7d275", "comment": "Malware payload", "value": "387ef1121f24b87f83803f6de5697213bc38877c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236701, "uuid": "2e3286d2-5790-41d0-9736-670ccda384be", "comment": "Malware payload", "value": "bc6f1008906bad2a2e5eb6edfa16bf99753cdd644a594e257224f65259bc0c250494ebf7aa0d5e71f86368ae44ba7167", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236701, "uuid": "7323ceec-f220-441d-bd38-4d5b4e84f7ac", "value": "T108220EF08A1A745F175441D63FDC540C6805E8A6A81C2EA2FD0EF31A975F62498F379F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236701, "uuid": "ad35d471-e1ef-4992-9efa-78ff4c2474f3", "value": "96:KDAxqY7MbQvkitUrm1E9bAjRC2L4E6xioTHVbebrX6NxzY5fkKt7n7isb/F:KExqvbQtHSwToTVeiNtMkKt7nWsb/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236701, "uuid": "dbc8e5e2-c6e5-4bc8-8d02-3e325fd910e8", "value": 10232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236701, "uuid": "a6e2ab03-15c5-4ff6-96cf-98c6e399e1eb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236701, "uuid": "facfd760-314d-4b03-9129-fdc12b6f3c2c", "value": "698f2dd6-cd78-4aea-a4de-3dd4d.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcebcbc6-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246130, "uuid": "e74ca492-4f8e-4528-9a0e-833d1d7db60c", "comment": "Malware payload", "value": "b7b189c83b01c19e0f2d73504546905a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246130, "uuid": "459a6701-3fbe-4c4b-ab4f-828cf558fd12", "comment": "Malware payload", "value": "64c737c167999efa76730c4bc524a6ae98b9fac4d01be97db0b544c17c6c3b98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246130, "uuid": "ae3b9295-c1d4-43e0-9deb-e8d165ee90d3", "comment": "Malware payload", "value": "e522d03770d4cbd047670b8fcff07916998d073a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246130, "uuid": "f6f3f16a-d765-46b5-a789-39d57a25d9ad", "comment": "Malware payload", "value": "c7ce9c2334a11373d76d9859b791b4fb4eab40c0718e053bd2497cd8864f2bf141b178c26c9ca4320fadedf416ba881f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246130, "uuid": "e3711eb0-ae7c-466b-81fa-5553ac08d47b", "value": "T1FA45CF1A17D45F68F0BF9738A2B814680FF2BD0BCF21DB9E68585AEC6921F419552333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246130, "uuid": "ac49c7e6-24d2-4173-820e-6a340b845c80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246130, "uuid": "f2cebc2e-60c5-4319-ada5-be9b5c660179", "value": "12288:lCu52LOIznvK/BeG+DaeO4XnE2Ye4PJMF/hPmIL01W75SB5VnysjuPKp:152LOIzC/AGMa8EMHLKa5SD5ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246130, "uuid": "97c328f2-b8d6-4c4c-8c79-60d4ec0513c8", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246130, "uuid": "341b80c6-4644-4012-983c-8ff076220619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246130, "uuid": "748635d1-8906-431b-a8b7-e11cee4d4422", "value": "64c737c167999efa76730c4bc524a6ae98b9fac4d01be97db0b544c17c6c3b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4acd9f-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231415, "uuid": "7e785c33-88c6-4be4-b344-eaf132245926", "comment": "Malware payload", "value": "24bc3e0679b2c6c14b72279210959059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231415, "uuid": "184b9484-68ae-4197-b4f6-3e62a4aff7e9", "comment": "Malware payload", "value": "64d93ceb3286438b0b7339f5ad544c21591bbdd667fbd794c1cea3f09aab99f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231415, "uuid": "58314d85-ebc5-46ea-9bdb-cde16c201d03", "comment": "Malware payload", "value": "3bfd72b9e03bf6a5be81b9d1cb772c9f224776bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231415, "uuid": "eac817fc-372e-4fd8-bee8-23953e977940", "comment": "Malware payload", "value": "e749888ca4965d358280a4da0f23eead6973f5f0c76a500b7e32832ce7eb2da57138386883ab4c6fca887ad925196d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231415, "uuid": "f139edea-b0d6-4317-8e8a-df3831d17648", "value": "T190B404CB2E4142B7C74CE57080B7773D03AB98BE3BE39E4DA64B3E950B7225C9946644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231415, "uuid": "43f80697-c197-476b-b798-2efcd9550678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231415, "uuid": "09a1c384-2d6e-4a5b-998c-5667ef137f23", "value": "12288:CZDLWX0m6XqD0TgVZxVZoLG+h7pC0h9JWCEY0:CFm0X7T2zXor7M0NWCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231415, "uuid": "44858885-cb04-4331-bdae-7794b6a2dcc3", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231415, "uuid": "a4eaf5cd-e724-46a8-8904-ae4bde3d2bd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231415, "uuid": "5a858063-8979-436d-bf49-baa70e19fb14", "value": "24bc3e0679b2c6c14b72279210959059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b30d8b0-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233028, "uuid": "a522397c-0768-45a2-aebe-9794adff7078", "comment": "Malware payload", "value": "94d41b8d14809751b5518c85a7140d23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233028, "uuid": "565d8774-878e-4def-b35e-8d65c570caa0", "comment": "Malware payload", "value": "6537c644a1ce34f24826e67370eccf1cf91779fad3fd75031aa91b24d0e9214c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233028, "uuid": "238fed5a-b857-4c57-a391-41adeca9c8fc", "comment": "Malware payload", "value": "eb8d67bfe6007b39244223e470a668701d82733d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233028, "uuid": "efd1a9b1-20f5-4ea2-9498-06281f053d75", "comment": "Malware payload", "value": "bf7f9f1cd5e16437389f0ef8e82cadb60c8313782133253d75b1bf35b8b058eba5924bfb21667436ce8dc0ef689a4976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233028, "uuid": "d2444417-2069-48e4-8177-1311a09e4600", "value": "T121546B1AB7640CF9EE6BC23DC9524905DB72BC5657A1E7CF03A04A961F236E08E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233028, "uuid": "e28c7ace-0d8d-4c46-bfe4-1cefbca474b1", "value": "15a1d73feee1088bf3b4d4acfa589482", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233028, "uuid": "f9decb6c-3541-4b0f-abe7-dcfc6654f276", "value": "6144:jQEaoT5RIRJ0y4vAaXmn/hfLY4yISLzdc:jQDoTIRW9zXKhfUmSL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233028, "uuid": "7904ee9c-3d73-44ca-92a4-1f546751cd45", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233028, "uuid": "5ece7b07-ee7e-4665-ab0a-722e194bebfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233028, "uuid": "0c6c53d2-f12e-4d17-b70f-ea23a06e5a3f", "value": "94d41b8d14809751b5518c85a7140d23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40628efb-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778236365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236365, "uuid": "c5d2abf4-40e3-46b3-8307-bac402f1edd8", "comment": "Malware payload (AsyncRAT)", "value": "b5c0025dfc1972ca77e7e27d23656cb7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236365, "uuid": "d01c1c2b-d996-4128-928e-a910db8f445e", "comment": "Malware payload (AsyncRAT)", "value": "658f5cc5e02a443f795602a24cfb423f3aacae57ff0eca07f38fcdf1a6a27ff2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236365, "uuid": "db4425dd-f15c-4cfb-b535-8d9e489ce578", "comment": "Malware payload (AsyncRAT)", "value": "71e5fecdb0be0fcd9825862ebf102743bfbc6a1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236365, "uuid": "3e8d6ba6-4cea-4584-bfc7-aa51bf0715e3", "comment": "Malware payload (AsyncRAT)", "value": "5cb09d1686ce56a0ee1d5b9298f612ed525d65ae86b2776a0e705223c9e0d729a160664d2d38cbb6fead1974bc535449", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236365, "uuid": "d3424a71-5062-4aa3-8983-1265839873b9", "value": "T166C52252BDCABC1269FF7B31CD23CC614B088293AB0E896ED08F1A459E6FD471195C97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236365, "uuid": "acfe723f-b056-471d-97b9-825b51199fe5", "value": "768:oynynynynynynynynynynynynynynynynynynynynynynynynynynynynynynyn9:Me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236365, "uuid": "6701a8ae-67ce-4b92-bd1e-b74d77322bc1", "value": 2720299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236365, "uuid": "74c9bbd3-44c0-4ae0-b9cc-bb6f16353e32", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236365, "uuid": "91eb221f-fa0c-4304-92a5-9fc455df4215", "value": "WhatsApp image New PO 38359257N0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0bc9df-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246098, "uuid": "82dd7958-e565-499a-9cfb-abd59ce08067", "comment": "Malware payload", "value": "032bb2ebbd53d3f1e42686f684721c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246098, "uuid": "20b825a4-1c1d-4082-8279-1830ecdcc47e", "comment": "Malware payload", "value": "65c952bade82c4f820e5c38785372828cf413f34e05556fcc77e70400b087067", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246098, "uuid": "dc5e1d79-3697-4f09-9b2b-1c04175178b1", "comment": "Malware payload", "value": "5de2e38f6a03b3b944e6ec36ebef4b0a56a1bdb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246098, "uuid": "495df1b9-fe29-48e4-af91-8bd298116315", "comment": "Malware payload", "value": "1e8aad8035a1fdb927d178ecb24967b390284063338e93f9acf8e7c807f8f6cd512079ff9fc07c2eb82828a2c1e34e20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246098, "uuid": "e8a535c7-f305-4c29-9a68-c1620609bb32", "value": "T154C46416EA11A02FF45389B0797996967D283E365A80EC57F7801F6930B09ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246098, "uuid": "8b67d314-7a75-4191-a65b-7517f3e88442", "value": "7f309f3c2c7e2da484585ae1c223c839", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246098, "uuid": "c0eeac2f-8567-4f45-9b25-78f9604b8022", "value": "6144:JXdJ+8yrsnyGEPz23mpKXzl7ij+5pbnBdL8Y5OLOXhWPPvPv+S5XA/dV/MachzRy:ZHynOvh5SY5Oy5mRogor6vk7ACOHEzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246098, "uuid": "890c636c-205e-4d79-8be2-a7500f950952", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246098, "uuid": "eb04dee6-74cd-4267-978d-5b237b5a95b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246098, "uuid": "87bdb1de-04b1-4336-b6a2-007270470de8", "value": "65c952bade82c4f820e5c38785372828cf413f34e05556fcc77e70400b087067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ead073-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233475, "uuid": "9a4d889e-e60b-484d-894f-3f2940788f18", "comment": "Malware payload", "value": "8c9a75a67d79f9f44055e32bed68ff86", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233475, "uuid": "ed99d831-7845-4b17-ab32-2040c8d5d0ce", "comment": "Malware payload", "value": "65e64e65678f849871257dca43fccf8941ee0ee35fe6b72e86a34fe84e752e68", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233475, "uuid": "3225fa36-9713-443b-9f2f-1798dceda641", "comment": "Malware payload", "value": "0f98fea5836bcb3d3b70113433b99b8281859de6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233475, "uuid": "d8d31e12-e830-4b48-94fb-2231c7ad3ec5", "comment": "Malware payload", "value": "a0bb4b6391e41361d39c2c1ea684e6afaed97fbb3204c7952a50b653c29ccd2a3608a62faba8a30f62cfb584076c4a02", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233475, "uuid": "f34cd810-a4a7-4d6d-817f-24d448e90cfb", "value": "T1D607CD23F5056996CED6A131F5E3579136340D480793A22D271FF02AFEF25CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233475, "uuid": "1c4efbb5-4954-49ff-a7af-f0c67908f3d4", "value": "196608:i5sqBmD+G3TSpMUbW7VCufu9MCv4lhRSSuHBEqnMRmPaigxF3ZY/6x7ewv0EB:4sqBmyOsM5fKEwEqYiQ9yu6Q/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233475, "uuid": "83c5c5ac-532e-448b-9bf8-194bbfb75815", "value": 17749583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233475, "uuid": "fa636fe1-84e8-4cde-82af-31eef83f0210", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233475, "uuid": "40a91b6c-3ff0-49aa-aaad-6836a37259ea", "value": "PNB ONE.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba178cc-4aaa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778223043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223043, "uuid": "52b443ba-a371-4f76-82bc-40be88db3bc9", "comment": "Malware payload (Mirai)", "value": "0f0d15b53ce9221a37f168b437b88df5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223043, "uuid": "de143b46-3568-48c8-9274-b68cc84a5cea", "comment": "Malware payload (Mirai)", "value": "660324bfe99f25e3dec86988b6ed4d8b666e0343eb4aed0542e7d9a50a33655f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223043, "uuid": "fbb85b2a-3672-4d87-9b0e-95b5d337b90e", "comment": "Malware payload (Mirai)", "value": "448c93a34773516877dddbcd0e9767f89b69e05e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223043, "uuid": "bf6160ad-685b-40ad-ab50-ca07ce2d5423", "comment": "Malware payload (Mirai)", "value": "f0716fb74ed7a08fd57f430786c8c5627c74e5777266f9e080919c232bf40cc67d8b8ded43f0430f9e96294049c08062", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223043, "uuid": "c461b747-43b3-482a-ae00-e5880d7f7906", "value": "T154146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223043, "uuid": "a0d2433f-600b-4cb1-9fc4-973cee526884", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtW:XgLnLzt0ll7I7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223043, "uuid": "fd78cda1-e2d7-4e6a-abef-bbcaaff34f1e", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223043, "uuid": "c122ecd0-f678-4afb-b350-861a8d9cb2f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223043, "uuid": "836fef43-f81a-4f62-9595-879d8a64d088", "value": "xnxnxnxnxnxnxnxnloongarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496c9066-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778242823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242823, "uuid": "40b554b4-ad72-42a6-a20f-80ab631ea887", "comment": "Malware payload (a310Logger)", "value": "d5a38b07a998414a8f5b03d51dfb6922", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242823, "uuid": "512dd885-62e9-4ca3-bfdc-0c900b12d614", "comment": "Malware payload (a310Logger)", "value": "665987b9904957dd663155d375b077782d4f65468408d6ad2bb9f0f135be675b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242823, "uuid": "eeb34744-e172-4e1e-a2e6-adf45d7b7a83", "comment": "Malware payload (a310Logger)", "value": "7db01e742f7628e5bbc0354624c2cf12d26f7b66", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242823, "uuid": "e6717b27-d4db-40d2-85de-0fb60cd37361", "comment": "Malware payload (a310Logger)", "value": "6faa04210fe0655fb2078458b4244e496944d1d6d42eef08819c9a7f98b40cbaf8fce3c76174d33d056d5909c465da56", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242823, "uuid": "aaf35ee5-e084-4b68-beed-cc73bbcd9bb9", "value": "T17A95E0027381C062FF9B92734B56F6515BBC7A260123A61F13A81DBAFD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242823, "uuid": "a2c0c9ed-4248-48fb-b191-404bc4a8295d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242823, "uuid": "2a360611-79cc-4bcc-9d59-9d66f1f69516", "value": "49152:jPVtqLZeJbInQRay64BvJyYsR9gFIDRRAubt5M:zYYbInQVBvcfYUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242823, "uuid": "423ad631-72e0-4730-9cc5-0a770c47abe3", "value": 1973760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242823, "uuid": "6868db08-1084-4ac7-a250-653c78de1d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242823, "uuid": "94f6b3f1-29d1-4685-b3be-2a3f4192cde1", "value": "665987b9904957dd663155d375b077782d4f65468408d6ad2bb9f0f135be675b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a7ca93-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243412, "uuid": "8df6de45-2496-4a75-a7c6-320a2f86ae37", "comment": "Malware payload (Formbook)", "value": "2b07015b951e87fe7aaf6f354c62ae25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243412, "uuid": "970be028-b8c0-4412-b74c-a4fa15d9e769", "comment": "Malware payload (Formbook)", "value": "668c098cb10ec8bbe3935041751680e04a9c32a2cfafb0f709bdfbe08e578042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243412, "uuid": "1bdbdf49-d4ba-4c04-89c6-0f0e24f5a6ef", "comment": "Malware payload (Formbook)", "value": "1daec60d551f9a9dd052c330e57e4fb0ec4eca48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243412, "uuid": "b05418b3-f2ac-4049-bdad-54237eab62b6", "comment": "Malware payload (Formbook)", "value": "535a6007fdcea4cd454bac232011a34a4607463b6a32591d899025e68b3975376e3fdaf0b4348183a125a0ba394027df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243412, "uuid": "e4025e84-520d-4de5-b488-5b5b98e277dd", "value": "T1893502486259DE02C5AA1FF41E70D77447B89DA96022D207CEF6BEEBBE3931169053C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243412, "uuid": "b9f845bc-51ef-44c4-82ce-8c03e4306fa2", "value": "24576:0jSJJSHwOEYzDoow+jxDAkm/tpYmVwCOWT1Rv8q5:0jqUwOEYz8ow+RAh/j+cRP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243412, "uuid": "bd744b13-3433-48ca-a306-70cf940cc8f8", "value": 1141248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243412, "uuid": "58992f09-74d8-487d-82d4-d758dbe9afcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243412, "uuid": "5877e378-72e1-4ffc-92cf-ff5970fc57bc", "value": "668c098cb10ec8bbe3935041751680e04a9c32a2cfafb0f709bdfbe08e578042", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbc099b-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244014, "uuid": "bdd58929-bfb7-4e0b-b4c5-3f309abd2577", "comment": "Malware payload (AsyncRAT)", "value": "27b7b7ce39c3a07b3ac3b9aaca8400ef", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244014, "uuid": "42fa2c85-3d0e-4e38-b30f-68dd60f7e944", "comment": "Malware payload (AsyncRAT)", "value": "6696a40df3d22b3a0e19ac9efaec76e9bf05ccbd72c5962425f5db35a16b015b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244014, "uuid": "109daea6-607f-459c-9454-26cf31d53110", "comment": "Malware payload (AsyncRAT)", "value": "ad74b7a6ad9532db4b217f945cd0e4f0ac34031a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244014, "uuid": "f6ea5adc-5df4-4003-92d9-16e6a9cea544", "comment": "Malware payload (AsyncRAT)", "value": "f2a3b7f1d5e562d41b6cd68b9be17271abc3b6a5a0192d832d00376b1cb5cb07ef8617193e9180bb51350a45434633c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244014, "uuid": "47157d99-d459-414a-8edf-29210dd50f32", "value": "T1C6F36B17B3A931F9E17BC67488924606F73678794761ABEF03944BB61F122E09D3DB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244014, "uuid": "a8d395ed-8af0-41f6-81b0-2d30f4d63a9f", "value": "d010692da5e0e07c07c8928e1fe93691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244014, "uuid": "197eb3af-46e2-422f-96a1-a2c285ced061", "value": "3072:FGs2uJl2cH33VUhktwWJ75q9nfsv15O7onLkOGSOCtMtle3Z0liY8bvnVnz:FGs/P33VU/WJ9q9COSkOGSOCtMtlDsvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244014, "uuid": "dfbc6715-d0a0-4591-b1db-70fa0c68949e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244014, "uuid": "0cc2fa5a-27ef-47e4-89c2-3baf27f1de02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244014, "uuid": "6d4b301c-13ef-46e8-88b6-adb05126f9c4", "value": "6696a40df3d22b3a0e19ac9efaec76e9bf05ccbd72c5962425f5db35a16b015b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0feff5-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244089, "uuid": "99afacc8-5ade-4ea9-981f-1b82f88bf6d1", "comment": "Malware payload", "value": "70477eeaba04649a96993a7d3060af80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244089, "uuid": "41d440c6-d792-49af-bcbb-fc5e261e0474", "comment": "Malware payload", "value": "6755e18a3d594f09d2e7a730d3ae71c65bb4fd78f81e7b1b8dfe7a53ce7d102e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244089, "uuid": "2b21c6a2-f0f0-4610-9046-905983cf6798", "comment": "Malware payload", "value": "f3c9f1413051b4d631fcd0a8a977b7fe61930a89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244089, "uuid": "58f2b842-aa92-4222-a6af-3826222800d6", "comment": "Malware payload", "value": "e624337b8e27aa7383bb6ae27036e245d9a9a0eff6d30158b3e7e99ae8de8a316b823ab5806ca67c2d6a8acfed0f3ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244089, "uuid": "6d0011b9-7200-4444-ba54-3b776cfc8993", "value": "T120735C1AA34368ECD61BC5B486EF6733BA72F8A61630DF3F5754DA301D14E902F2A524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244089, "uuid": "d5e4415f-8eac-4d79-9bb6-91e31b7c9879", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244089, "uuid": "2483d261-c76b-4f84-bb92-5d30f1b4f1ad", "value": "1536:rlcEojXj6X/gk78cVlAqEvNhkiklGghTm4:rlcEoaPFvVe/NhkiklXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244089, "uuid": "a02d4ca9-c5ac-4473-ab37-b9aa56d1fcaf", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244089, "uuid": "f3139290-3fab-4b82-a543-37c487d3a5a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244089, "uuid": "05bfa1b4-f703-4990-978f-02bb0325893e", "value": "1461d81916a2cec46d806341b76e35e2df6fade2e9f441217fe93137a0967a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdce9c02-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245595, "uuid": "43f49677-dd0f-4416-bdc1-7e788f4f85f5", "comment": "Malware payload (MassLogger)", "value": "cbe8478e6817bc9cc03d95f78b034d5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245595, "uuid": "7861ed0a-16a6-4db9-9499-346d12dd2cb3", "comment": "Malware payload (MassLogger)", "value": "678dd08050e3c808b5bd4ea9545678f6670ddde6268125637ef61e12c0cd610e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245595, "uuid": "782f30c2-1411-4f0c-9b7b-2bc670b90084", "comment": "Malware payload (MassLogger)", "value": "c3c959f8a9437db87915d3d4fa003a162083072a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245595, "uuid": "c42c3fe7-fbbf-430d-8638-16b390e7c3ed", "comment": "Malware payload (MassLogger)", "value": "26c0e28c55fff12db0098fd720309ceeeba250656d2c6b464a2db6dd2a68101f72ee47c307cae96c14b97d1d7b301b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245595, "uuid": "5461d3ca-69b7-4eb0-97fd-c0bfdbaf8d03", "value": "T13A051229632CCA16C46B2FB00D72E1B41778ADEDE625D6579FC8BEEF707A3445940312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245595, "uuid": "8e0b982b-55f9-4831-829d-f009e849234c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245595, "uuid": "645fc48a-06e7-4ad5-a780-ff8302724e08", "value": "12288:NmjogKR8dthDFL/kGYx2kCK/eDIkYkQRWM/i7wrDlQxqu+2kZw3RHDPlfniTqwhB:Nm9KRQtBFL8xlW6hZuNkZSH5fniTXqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245595, "uuid": "d7d0c662-bc5a-41be-b152-1675eebfca4f", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245595, "uuid": "c4cbd760-47c3-46d1-a36a-f3426d38d928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245595, "uuid": "81e9c162-084a-4f08-8d37-ff17f8285056", "value": "678dd08050e3c808b5bd4ea9545678f6670ddde6268125637ef61e12c0cd610e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae3464b-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244758, "uuid": "918eb838-55b8-446e-8840-9be38d164163", "comment": "Malware payload (Formbook)", "value": "1593c60dd2b48738b4a3ac539513aeef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244758, "uuid": "259d5ae9-f1cb-4142-8852-1d378fb74806", "comment": "Malware payload (Formbook)", "value": "679522b9c8a0ae3fda6468c0062360d2504f7cab88d085b7296b5f12421d45f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244758, "uuid": "cf6a00ca-5912-493d-b403-75b36f160085", "comment": "Malware payload (Formbook)", "value": "c8b85b9095605bed161291f5bb33b658ddb880ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244758, "uuid": "741345d2-bb1c-497d-b470-45edbb2c7c8c", "comment": "Malware payload (Formbook)", "value": "11caaacaa3691a76e19cb16bf39e42c1ba68911c89e7795d7e52f553962ae1c482fb528c6abfc83df7e389f340bfb8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244758, "uuid": "e6a87909-b998-419f-a575-09a11e397bb1", "value": "T10825120836ACCA19D9675FB44970E0B007282CDDE525D94B6FCCBEEFB07AB152E94346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244758, "uuid": "a5ce84f5-10c6-4a12-85a2-966388a884e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244758, "uuid": "136b941f-a1ee-4910-98e4-2563c47b23ff", "value": "12288:EqwhbgfS0mahLRZX8nxL60/ETP8xHGSiAj45MEoTUULXOcheKPckhrkPkyvX9/ZL:EXKNmxL6gETPaHIpC/vZP97yv5ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244758, "uuid": "5bc9bd3a-8e11-4681-a9a9-b16445eabae5", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244758, "uuid": "356b4301-ddb1-449c-90bd-33877769614d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244758, "uuid": "ddc572d5-8bfe-463a-8c23-ba88a0959c12", "value": "679522b9c8a0ae3fda6468c0062360d2504f7cab88d085b7296b5f12421d45f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b4f170-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245776, "uuid": "921595d8-c90a-4a55-86a6-406de004370c", "comment": "Malware payload", "value": "4c7b7bfaa16ec4675d0b24cb2143a5fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245776, "uuid": "9fc4081f-6af3-4c39-b34b-33650b86082a", "comment": "Malware payload", "value": "67f6c07c2b4dbbd2485a7b2495917425d4beca4ed33f4c95c15fa778f2ca8d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245776, "uuid": "7a8c4c4d-cb40-47ff-8bd0-42044a1b79fd", "comment": "Malware payload", "value": "7f2d5d9bc1de9d4006f43b0329ef49a133b19a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245776, "uuid": "18abc1f9-41da-4c9d-b424-7173d9ea8497", "comment": "Malware payload", "value": "63738277da3af4f5319a349306dea09faa287a3d951063367619cd3ab615e89394ac907864d5852cd93077a004c2d01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245776, "uuid": "42ef1737-3ed9-440d-a9b3-e0a73da24515", "value": "T196B4C051F380ACB3D82B13718DB6CB212A26FD694B75429B715DB2251E7339331B788B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245776, "uuid": "2cbabea5-979d-4191-b938-a00d0d0e3ae3", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245776, "uuid": "f49f9ed5-4df1-4bf5-9a7b-3e77b0a8e012", "value": "12288:Eh1Lk70TnvjcMaQ5+QoYcuWIdyjyQ3mAzmK51J:Ak70TrcMn5+QcbIEtL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245776, "uuid": "8eeb817b-23ff-4d1b-a1b4-d5463ca3b546", "value": 511992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245776, "uuid": "6f6ef124-5dfc-45ab-ac79-e40ac603f94d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245776, "uuid": "f292351e-495f-45cd-9d6a-4869639a1bc2", "value": "67f6c07c2b4dbbd2485a7b2495917425d4beca4ed33f4c95c15fa778f2ca8d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc6d3e2-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778245967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245967, "uuid": "9711e0e5-34ef-4ae5-8572-5e45bafbef0e", "comment": "Malware payload (AsyncRAT)", "value": "ae5430b57ad3127d3c1c97d5c6b1d7cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245967, "uuid": "68292fbb-4bdb-42e6-b1c2-af96b62562a5", "comment": "Malware payload (AsyncRAT)", "value": "67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245967, "uuid": "8f8d3ceb-9ecd-4cb9-a968-e6e53b690c16", "comment": "Malware payload (AsyncRAT)", "value": "790db8c7e06722be0bad5edaa8ccf230404baa09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245967, "uuid": "1eeba7b3-3330-4d79-b450-a24777db69a2", "comment": "Malware payload (AsyncRAT)", "value": "51eb623b5b724fae449fe9efc8e0609848b4fd9b7813dd50c8498e0f364b1d3fc38df52ae4e8dd08ccce4ba3b41d01c8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245967, "uuid": "59879ef1-f83a-4601-9e28-e3a3265809d6", "value": "T16DF25C0837D54229DAFE7FF95AB366021770E5079A03DB4E0DD8895E6B27BC189007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245967, "uuid": "ea317096-3b93-41db-a069-4ed32356323b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245967, "uuid": "920a5f02-f55c-4ef1-afed-5c8bb759dc35", "value": "768:V6KkDnV2jZgWSVOo+M1TnLV/Fn9SRK6TOMh237:Vfb8BltnLxFn9SRK6TOM0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245967, "uuid": "dff8c249-3d3d-4efa-a1ba-08ceea8d5668", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245967, "uuid": "f4674325-3b87-4c39-85cb-07f447a96373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245967, "uuid": "061a87d6-b378-4364-981e-3e723ab5cd3d", "value": "67fad1e9e67fdf140f3cc37a458f680645556b10cedd221a3ea872fbe5aa7b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cd149e-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778244232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244232, "uuid": "15aae20b-5eaa-433e-95ef-b5e6e4566342", "comment": "Malware payload (XWorm)", "value": "1fdfb4d8b675aa915bce4cf1f2e56337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244232, "uuid": "62bb2e9f-d479-44e4-96a3-815761113a54", "comment": "Malware payload (XWorm)", "value": "6806d7e4fcabf3e9147f446a3babf29bc8970cf32a8ecc1176271a0dd1e3a847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244232, "uuid": "8a7277e8-c02c-4758-94da-b76a108c44ee", "comment": "Malware payload (XWorm)", "value": "88e214b02eea72b4b588122c9f3d867084c38c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244232, "uuid": "88fd0f5d-9699-4a6d-be97-03d7870265db", "comment": "Malware payload (XWorm)", "value": "7655cb1e854033586abd37ed6c8317d94765313e81ec09d1ff30e6612b77d147be696a26a90ec54a98affb681c7e6b34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244232, "uuid": "e5d209a3-dac8-49ca-bad0-a0998a8c354b", "value": "T13EF401247A38CE52D8A513F80DA1E33213B89C8EA511D3179EFDBDE77575B1A2918383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244232, "uuid": "6eee9040-3a71-4050-959d-8b8290dc1db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244232, "uuid": "0748ec4f-8fea-430f-a551-e61d75f6f15f", "value": "12288:kt+d8+DbFdr9/O/Fv6c8dFAUEfT0BrZToD1PAq4Lcs6B4YPotyVd9XSKAxaf:Zd8+v9k6cPzfT+9Tk1PAJcs6Bw0XSK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244232, "uuid": "adcc1d2a-269a-476f-b2c5-2141c577a582", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244232, "uuid": "2ae737af-fc55-4c5f-a158-90264854246a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244232, "uuid": "92afd905-43b2-4c3f-a99f-9679f5f32579", "value": "6806d7e4fcabf3e9147f446a3babf29bc8970cf32a8ecc1176271a0dd1e3a847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532d2746-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778245845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245845, "uuid": "4afa60cd-3600-4563-a8e7-0c69ad8af9f8", "comment": "Malware payload (PhantomStealer)", "value": "a3022250d582f6d786d92dc159d90830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245845, "uuid": "a77fa50a-8694-4365-80e7-188747d3ba7e", "comment": "Malware payload (PhantomStealer)", "value": "685d68c74f40fa90396f21639346cbc8811c5afa4b9c22b831d274c0c14168bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245845, "uuid": "c39b8048-12b0-4d0e-96a4-1d26c6908f82", "comment": "Malware payload (PhantomStealer)", "value": "004084eaa2289b83b4028b032e3dc748dd68c3bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245845, "uuid": "07f9bfa8-661a-4157-a3ec-43b9a01dd419", "comment": "Malware payload (PhantomStealer)", "value": "9638b12525ef6cb05094ff1f6d7d881903e4fecbdc70b7d2ce0252e44d6c38114aecbbbf56d938daf46c4e705398a1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245845, "uuid": "0c78fbce-1ce5-4de2-9923-b976a4dbf73c", "value": "T161F4DF6873EC5A01F1FF6BB294B59D51AB35B513A961D71E11C080C80E72B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245845, "uuid": "af681fa3-da19-4088-925c-abae137b020f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245845, "uuid": "3fee809a-b1ef-49b6-a2ad-00314a3934e2", "value": "12288:v9xS2OhkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab63NUW6:v9x6kqjVnlqud+/2P+ATAS/JYe43NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245845, "uuid": "2245d6b0-31e3-4880-8f0b-ab51ad82fd4c", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245845, "uuid": "059f7cd0-50bc-4ef2-8a04-e00ffd0dcac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245845, "uuid": "d7ae1ed0-7c6b-450b-8eef-c03c26378ff3", "value": "685d68c74f40fa90396f21639346cbc8811c5afa4b9c22b831d274c0c14168bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ae453a-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778246843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246843, "uuid": "8abcfeae-6694-4c10-ae63-8847b32fc229", "comment": "Malware payload (VIPKeylogger)", "value": "c456f10243e43a0b0a6586e72c284346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246843, "uuid": "a9f1dd6c-03c5-4ec4-8a07-93373fc03bb2", "comment": "Malware payload (VIPKeylogger)", "value": "687e8747abfc36f1ad89e220d1f59c89e3214c71a98ec65417d486daa87eef8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246843, "uuid": "1c5d819f-518a-4a2e-919c-b4fdc13ffc9f", "comment": "Malware payload (VIPKeylogger)", "value": "0a3adfd247a08624cd82a7166ee539b6afd4db83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246843, "uuid": "b02ce405-17ed-495b-87b5-f625d57518ac", "comment": "Malware payload (VIPKeylogger)", "value": "2ec8f9a3f794c990534b9685329edacb9ae15689c807d27d44cdb926192210b9159409e6b67702c9a32a5b1779509645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246843, "uuid": "2fb234b3-074f-4310-8f42-435cf162dea5", "value": "T16535125C36559B03E9A61BF80972F23527B90D9FA812D30E9FE87CEBB561B114D24383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246843, "uuid": "d7620262-5d1a-4f30-930a-ed688d8e0ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246843, "uuid": "9c2c8f62-a765-47fb-9b52-2cb6df1946d1", "value": "24576:hLMkNvULYmcs63pGo1IDjgGYSHgODgmJKlusF74tUwIM:qkNGEsKpH1SgGYSAOMmJeJFnxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246843, "uuid": "da0e7005-23e9-4c24-8e97-bd276293867f", "value": 1097216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246843, "uuid": "6e72d9e1-d9f6-4e81-92ce-1913fcf098e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246843, "uuid": "a8125548-c780-4afc-9456-c89fd1c851fe", "value": "687e8747abfc36f1ad89e220d1f59c89e3214c71a98ec65417d486daa87eef8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7510d8-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243581, "uuid": "a6f1ca86-b964-42b7-bfda-48cfe169b4e6", "comment": "Malware payload (Formbook)", "value": "4a365033323051d90b7a161b4b9a15fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243581, "uuid": "1ae71d49-4bee-4ba9-aed7-50c5153b87f5", "comment": "Malware payload (Formbook)", "value": "6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243581, "uuid": "617f0f8f-133e-4932-9fea-ac91117e4b33", "comment": "Malware payload (Formbook)", "value": "112292743ddf5f9b1e1e30b493f61b0360e65130", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243581, "uuid": "dc081ea9-6550-4328-8519-5903d678e7df", "comment": "Malware payload (Formbook)", "value": "413329644383c21cd2f593355010fad11d430193ab01cdf6d5f67dff79d34d0d599ed625607a4db2eb82cf2ec321b321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243581, "uuid": "3c7dac77-1ea7-42ba-bd4d-957971b113a0", "value": "T13F4501452715DF02C5969BF01E70E3B50BF56D852411D327CEE77DEBBA38B12AA00A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243581, "uuid": "b7c01346-99c9-4fcb-b64e-55ac55e034ff", "value": "24576:yuNt0WAsayeoFriCTebXXFeQG3BZ5MjdyYSJJSHwH:yC2EooFGCCbHFeQGRZ5MJpqUwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243581, "uuid": "7c549506-aee8-4486-a7d1-27bbd1371459", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243581, "uuid": "655c5f4e-6000-4a6e-a8a8-520d793f8e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243581, "uuid": "654bdaab-cb37-411a-bd97-8646a705932e", "value": "6881d3138ad95abb6d4ae0e16a1cabfb51b24d4d729c09f8225f1e3f5db2e735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ba1aec-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778244127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244127, "uuid": "cc379dca-43e0-4413-9267-e65a68075421", "comment": "Malware payload (RemcosRAT)", "value": "6091d6c0f9807c87d0d526bbcc2f537e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244127, "uuid": "e8e63919-0493-4d14-8275-ce0276f391e3", "comment": "Malware payload (RemcosRAT)", "value": "68ff46fff74851044d2e15eea53292925e6a9022f09e038eac9cf7afbbe340f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244127, "uuid": "9c967e52-7b06-4591-8ce6-53728a212060", "comment": "Malware payload (RemcosRAT)", "value": "a28d84b27f24206234d5d251e9d04ff141e61f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244127, "uuid": "a759a16c-ecb7-4c90-8932-8ddc9d0e65c3", "comment": "Malware payload (RemcosRAT)", "value": "79b1b4977494227b6e2c7f6d93c34fdd7e2ab9cd4eccb8287d5c9625eb417c67e373f7ec26a33d0f69afaf261a08e4c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244127, "uuid": "cdca0611-aec4-48b8-87d4-b9e0cac6413f", "value": "T183551265BB9EC902D8E256740D24E77507785CEEE801C21B4EEDFEFBB829945780C293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244127, "uuid": "10c11d96-f924-4cde-b246-3d891e9d823b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244127, "uuid": "ee229388-73bc-443a-a35f-a4f18c70e2d7", "value": "24576:8YYDPG8+v9Q9onrJt9B0IW7wLC5O2U+Ntn5lgkNZUt:8YYDsv7dhyhnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244127, "uuid": "c560ee1d-f447-4af2-9f82-05b171881e6f", "value": 1282560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244127, "uuid": "1ae401d5-0f33-414f-8679-6e6693ef74ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244127, "uuid": "777e2977-085b-446f-88bd-04c87ccf618a", "value": "68ff46fff74851044d2e15eea53292925e6a9022f09e038eac9cf7afbbe340f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ff4297-4ab8-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778229306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229306, "uuid": "97327b2f-c3b3-40b9-a634-9be58ddf00c0", "comment": "Malware payload (NanoCore)", "value": "c1f45f0d5f4d06e94e5b8a7f0cbbb1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229306, "uuid": "8f8dbe0b-4851-489f-a3dc-d81c52502b45", "comment": "Malware payload (NanoCore)", "value": "691b6b56ca1bb9cbd0fba91cc2743c491ed4903c6a3e98ec1db4412d9b08e4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229306, "uuid": "b89c00f1-7ba7-488d-9d39-3cb11b6a3183", "comment": "Malware payload (NanoCore)", "value": "433e5a71a38a5e6cfaef1b1766c3d539e592ddd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229306, "uuid": "6a254644-2a32-474f-a76b-cf4fc1dfc76b", "comment": "Malware payload (NanoCore)", "value": "03639ff68b8aa78186404569c6a1a32e7801a7f32e670ab1477fa58e4ba3833fd40c572c551d1987bb1e8555cf63db4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229306, "uuid": "8d9531a0-4478-4ce6-a564-939b2766e9fc", "value": "T11D14CF257BB94A3EE2DE8679612202179378C2E3EDC3F3DA58D454B75B267E40A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229306, "uuid": "3d3f17e0-86f9-4c44-b12d-671d758ec113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229306, "uuid": "21de3f2c-1c5b-4ef4-9d82-2b539ed8b8b7", "value": "6144:MLV6Bta6dtJmakIM5nplNzULgm7SB7e+U:MLV6BtpmkAzcb87eN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778229306, "uuid": "6b95d8b8-c38f-4dc7-a328-7f51f0882f0e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778229306, "uuid": "d9bc5d86-0a6b-4045-b835-2d58a535ed00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229306, "uuid": "a79d56af-ced4-4100-8163-854777431388", "value": "kno77.it.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2258b89-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242542, "uuid": "2dd98f9a-79f1-43bb-a60c-83373c2ee7f6", "comment": "Malware payload (Formbook)", "value": "cdfdc7c214c6b6d67be8177f013cc930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242542, "uuid": "c95443c1-968d-4346-b9b7-f4000fa3d838", "comment": "Malware payload (Formbook)", "value": "69270e83d86a77f6be6b008e1d3dc8471fbe8e1a91481ee5f892162fad23410e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242542, "uuid": "f655b7f2-b624-4c1a-b4f4-11828fd672e1", "comment": "Malware payload (Formbook)", "value": "34747fa235b568a6f56965b3790b6d5d86f01de8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242542, "uuid": "4a9cf34b-9d43-4816-8884-09c87a2d7ef9", "comment": "Malware payload (Formbook)", "value": "77867f0e46520effaeadf1d32a91133a36de906a9e9ff5f4a56a080c54d15c1fc08d4448927ea94c76f569a622288516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242542, "uuid": "fc5028a8-7ada-4bea-82cf-1157e5eb9744", "value": "T1EB45BE58207986C1CAFD96F00F28F2741A636EF45A9EB341C8F77C9BF926271651C84B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242542, "uuid": "441712a3-5ff6-459b-8fec-82e6515f6095", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242542, "uuid": "a7510ae6-70f0-4731-9787-94faeeba9813", "value": "24576:Kel7/gmtPG4vZuo1Qlz+KzHYu5OBSLFL+o:Kel7/gMhlSDYaOeFLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242542, "uuid": "059f69ea-10dd-4508-87f6-2a01df4cb068", "value": 1276424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242542, "uuid": "8da32a28-f822-4295-8847-e7e99a713773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242542, "uuid": "aa9fcbf0-d0ce-4a74-8cc3-ca7830f8c884", "value": "69270e83d86a77f6be6b008e1d3dc8471fbe8e1a91481ee5f892162fad23410e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92229993-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778243374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243374, "uuid": "fa3e080d-b32e-49bf-b270-822ff9bfff2d", "comment": "Malware payload (MassLogger)", "value": "bfa37024a30ca58a0dbd28e59060d5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243374, "uuid": "d2279d49-0884-4268-8fa3-6d707ba097c1", "comment": "Malware payload (MassLogger)", "value": "692a4df2ae72a96a0451e5a4f8fcada0801e89fe8ee76f71c94df11ac8700e55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243374, "uuid": "0490de3b-b46c-4599-84f5-5e9649823ed7", "comment": "Malware payload (MassLogger)", "value": "af7586d172645d523c4e956738f183ed96f74e61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243374, "uuid": "e33afe15-527f-41f2-b5e7-c8eed24e6416", "comment": "Malware payload (MassLogger)", "value": "11c6f54d0e4d83e0dde56c5e2e4d77b48b4e49cd0f1f8270e5239d163921f2f8dea7b6cd96f65299044b8da001c11ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243374, "uuid": "f3ba56b6-fcb4-44df-b0a2-c39ad3a72158", "value": "T1E715F1482259EE02C9A65FF41D70E3B407B85D94A422D317CEFA7EEBBD393456908783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243374, "uuid": "f1ca7271-5f9f-436a-b90c-c709f933cc05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243374, "uuid": "07ca5260-0481-446b-804b-42c47ae9354f", "value": "24576:0fSJJSHwTAiCd3YBUFBJV4aTvT5hL9d4EW:0fqUwkiCc8BJV4az4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243374, "uuid": "93b56f48-9ffe-4b95-a77c-be9d09455ae6", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243374, "uuid": "1182de81-935a-4788-98e3-431b22395b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243374, "uuid": "bbe7fea9-de9e-4903-adf9-da142576265d", "value": "692a4df2ae72a96a0451e5a4f8fcada0801e89fe8ee76f71c94df11ac8700e55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bdd875-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232623, "uuid": "73af0fe4-f9dc-4712-9a44-012cc583a04f", "comment": "Malware payload", "value": "b44eeed0b14e4f7d99adaaac52b12ad9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232623, "uuid": "31379223-947a-4a12-bef3-c8abcd0c0d03", "comment": "Malware payload", "value": "6a3d670364b5cea68b0c26ba8182a31c475b3e1a7c755678e4af72639cf7461e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232623, "uuid": "354cca91-3b2c-4c1b-9dce-9b5fa105cb9d", "comment": "Malware payload", "value": "9d760de97f77a458761b8f13684cb9f6e958d292", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232623, "uuid": "8b34efa3-2c39-4a83-8c7a-73f32b6f0d68", "comment": "Malware payload", "value": "d8e5bf1e9c77821ef840589f45eba637e9d60a908fc89c207621e752f53f814688022d52c650ff2cfcaac8fce1cb1c64", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232623, "uuid": "882b1547-8c0a-48a6-87d2-461ef7c6357a", "value": "T1A1F6BC23F51969A6DED6A131F5E3179572340D480393A229271FF026FDF21CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232623, "uuid": "6c9055d4-a888-4482-9c24-cfcbe6fa0508", "value": "196608:SJR1DfugUhE3f4JmS0F5pURNIyuQIvT/J7VeRyuSsmhmWr3mMC:gR1784BU/IyuQWJeR+smhmWr3mMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232623, "uuid": "bd8e627c-c697-4d72-8111-b45415cbd469", "value": 15967830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232623, "uuid": "bb100551-784d-4f56-b573-dcbb1a5b05c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232623, "uuid": "387f0dda-6e16-460f-82fc-e4cdb2c4d969", "value": "iMobile Lite(11).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558331d9-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232535, "uuid": "eb4be764-9aed-43ae-ab19-e37b5125a065", "comment": "Malware payload", "value": "4ce9ba5f260c43cfd6360a927972bcbf", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232535, "uuid": "6d4a30cb-a666-4600-80e6-c855f808d6f9", "comment": "Malware payload", "value": "6a686be56c860ded433c4cb6aef5eeee242cce051b0c5a4b57e41d0fda230901", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232535, "uuid": "cf7eb940-0dcb-44dd-9352-2b5acbc0153a", "comment": "Malware payload", "value": "e0ed2ce406506c5b71ed745c66258a2d42eb0503", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232535, "uuid": "4754cdea-b035-471b-baa7-ee0d32a39d14", "comment": "Malware payload", "value": "e7105ec06838cb1788626329d43be87bd6a74b257dbf61711774e0eb96eb0fd5090a4d6874aa31cb97119cc5ff16f1a5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232535, "uuid": "c86ac53b-b7f4-4177-9a11-b4b1b0834997", "value": "T19A4283472381237705730652BA5C70E6E72A817C6337C668B86C823D2BC5D3866FBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232535, "uuid": "30c71e95-7f1e-4d5e-a672-31e5ce64899c", "value": "192:23hTJTpBxWc1iiX2MB7GdlywfKkAlhNd0SC3ejLtvjmVK9uoWXCRSyEBX3yb:m1f92MxwfPAlhPCOjL1mVKIaRsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232535, "uuid": "547df550-bb77-4c94-ada3-86f808f4105c", "value": 12399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232535, "uuid": "b5fff1b6-15b2-4fdb-b7d8-ef727e7b1712", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232535, "uuid": "c6ac8717-e2c1-4895-9f92-ead29fbfd025", "value": "BSD9_136163.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0fb091-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242986, "uuid": "7d728e6b-de0b-4eb2-8c91-92c49bb6e66f", "comment": "Malware payload (Formbook)", "value": "b58061b5f4fdd771e807ce000b42505e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242986, "uuid": "508a16b8-6f64-4bdf-a935-e95e45c58be3", "comment": "Malware payload (Formbook)", "value": "6ae4625d9b0c21c993c9e4002ac8943c9e3d366ca7c4e1a2dfa43207b92805a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242986, "uuid": "9b3e72c4-0ae2-4906-9ff6-d070eab95683", "comment": "Malware payload (Formbook)", "value": "bc1a78738a5168976452a73ad05f4307163ff4bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242986, "uuid": "d9624009-b9ef-426d-9ff1-8cb960cf1343", "comment": "Malware payload (Formbook)", "value": "4688b31a6dd981771eb025f7c2998619875171edf37e6ef5a36e43d9a5b4eb5d0a5069e4e50c4f27608c0d9139fd28fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242986, "uuid": "c8feb084-92cf-4cac-bc7e-204da0265785", "value": "T1A83502843369D902D5B61BF00E31D3B547B86D99A812C313CEF6BDEBBD39B81180A597", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242986, "uuid": "c31b1f02-5120-424c-81f6-efd3cbe53c82", "value": "24576:K/YOASB6zhXdX12xdwHGQH6bjdMXqzdyri6aD1d7z/4WVX+5U7sGx:NFSB6zhNX12xdwHGQ2dAqzkmz/4OO545", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242986, "uuid": "020a652c-5ef1-4dd2-808a-ea2741c8c546", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242986, "uuid": "8247780f-b9ba-4551-a9a1-d43b4a2dff84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242986, "uuid": "6afe9f27-6ff1-4487-a434-8ce451738d77", "value": "6ae4625d9b0c21c993c9e4002ac8943c9e3d366ca7c4e1a2dfa43207b92805a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2412de3-4aaa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778223349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223349, "uuid": "457c4770-8304-4134-a480-0bc68f7f7119", "comment": "Malware payload (Mirai)", "value": "236479c30a16af0d4efd43ffc79d2ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223349, "uuid": "20a650e3-dac1-4414-bf86-c2be76b991fa", "comment": "Malware payload (Mirai)", "value": "6b4371ca31cb6ebe399c8c1e6a5f61894caeb3b9398e0f41a7aff59e8eca3188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223349, "uuid": "8ed9b15e-53fc-4fa1-bc47-7c83a8f6006a", "comment": "Malware payload (Mirai)", "value": "6d002ba52e0fe20e37fdd957f071461c37d2ef9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223349, "uuid": "a4a58163-e366-44d6-bc3e-8834d5f649bc", "comment": "Malware payload (Mirai)", "value": "43019711c71baa50323e6f43a0c350e6ea46b3c4464b68a7f7e36a56b2b199c3ee69cfa849afb97bdf4a67ec91e36e6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223349, "uuid": "a0768711-4bd0-4a93-b594-c4da6b7cb978", "value": "T16ED35C0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223349, "uuid": "c637e67a-a42b-4871-81b9-4d4d83e4a9bb", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTS:yssqf/3iPcgrerAl8fEtHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223349, "uuid": "53173208-4c18-426b-8aa2-b19835e6ca09", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223349, "uuid": "c4176d35-110f-49f6-8c5f-55eca57b7e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223349, "uuid": "f93b4f3c-a5f7-4029-83ca-7c5c8928fdd9", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f79486a-4ab8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778229062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229062, "uuid": "175ecb83-5fb0-45ae-81b0-8826a076c36f", "comment": "Malware payload", "value": "66b909b18dadca0f5fd69af9ed1afa81", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229062, "uuid": "e5fe0190-7104-4862-8a1c-c4159d85382f", "comment": "Malware payload", "value": "6baa921b2a5309dfa942555c0a21bc59b136fb3997d47ecc54a9dba901b7f534", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229062, "uuid": "abbf9d10-8a41-4dc4-9e91-2b3c7a97d40b", "comment": "Malware payload", "value": "a8ff90ddf3fbf67e0dd5574b511914fa08d9de3d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778229062, "uuid": "a919f41c-099b-4880-b2e8-943eee75b59a", "comment": "Malware payload", "value": "d0947a3460bcba634e4905f341ae1b1c07d0b385c5e8a4218469db427548961ed24cc47e5ad5898a03d774a812d27ae0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229062, "uuid": "1c1707e9-efd6-4f42-8ee6-0c61f300c797", "value": "T1F905AD1798588B57D22942B87E470D981F4A6F0CA9C135AE302F7E9B7BB4B364C9F01D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229062, "uuid": "bad470ca-7da6-46f6-9c1f-d24f0a1832ff", "value": "12288:P7gX3umqfXLksVyImj3hvAZwakbPDfhPuDKnMD7JTjZi0pYsXYt:P4+mq4sVLKAjKP1PucUPZi1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778229062, "uuid": "257ca81a-fa80-4cf0-98b4-34e4e9438603", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778229062, "uuid": "d05a3c37-b44c-4bee-8250-b1059dbb45e9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778229062, "uuid": "5e27417d-3c37-45d1-b85b-269cc21e9f97", "value": "SecuriteInfo.com.X97M.DownLoader.2343.6861.1515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625117d5-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246300, "uuid": "ea4a94cc-e4f9-42c8-9d96-62fa9cd4e553", "comment": "Malware payload (PhantomStealer)", "value": "7b47aee9fbfeb048c5a23424a945f48f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246300, "uuid": "31d2e8a3-9171-4981-a366-76eb8458c953", "comment": "Malware payload (PhantomStealer)", "value": "6c747331a05ec6606b409a18097bd0849cc4206367d92fc72b468330a390525a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246300, "uuid": "e7596eee-e495-496c-8350-704aae3b8aa2", "comment": "Malware payload (PhantomStealer)", "value": "265e5391bf49b5351f2566fc35a26278a7fd4557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246300, "uuid": "92990d46-ce3d-431e-916c-30770f15313d", "comment": "Malware payload (PhantomStealer)", "value": "0d18bc0b803243d2e152066c7612e2df0317cec1e3d0d26f9535c61944b8ac2ee526cf7e485fa200bbec495ebc0e5e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246300, "uuid": "aa92993e-8683-469a-bd8a-1f90f83b4440", "value": "T1E8F4DF1873E85A01F1FF6BB294B59D51AB35B513A961D71E11C081CC0EB2B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246300, "uuid": "54211fa3-954a-465f-8600-e5399718310e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246300, "uuid": "456c961a-c803-45a1-b16d-0c3931c14ad9", "value": "12288:X9+OXFkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabe3NUW6:X9BkqjVnlqud+/2P+ATAS/JYeE3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246300, "uuid": "fb242b62-f8d6-4216-b747-9fb18503b546", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246300, "uuid": "7efee24a-ae08-4878-ba29-64db26eb9bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246300, "uuid": "7b9f3352-a675-4dab-a1f5-be3174a33844", "value": "6c747331a05ec6606b409a18097bd0849cc4206367d92fc72b468330a390525a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5170c4-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246824, "uuid": "60c62d95-7c79-4010-9144-43cb582a5f79", "comment": "Malware payload", "value": "f2c9ae8da66d0269480d648a5e8d0a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246824, "uuid": "611901bf-34ed-4858-bd8b-8b998b44deb5", "comment": "Malware payload", "value": "6cbccbae6d304070475112b4c220cd792b732d2a7e963cf89984a5e5f6b2854f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246824, "uuid": "09a9c249-7e3c-46c7-8312-6759cb797e18", "comment": "Malware payload", "value": "f3311e6ded046d6a979f6f3459e20f8d3a129ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246824, "uuid": "7baea754-e801-4913-8cad-1223ae7ee63b", "comment": "Malware payload", "value": "57421be9ced16c50b5eaceb79b66f03021db981f12b1c5df62b52c14ec0727e2a1db6ce3235e5c4507acdfaebcb04d5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246824, "uuid": "691d7dd3-78ed-4413-bfae-9c5eed570f8a", "value": "T13705BEC95E172A49C23E6FBDC3525848B3F0C983E3E7C71B6EC846A9D6536E4CA43581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246824, "uuid": "89011ccd-2a13-4cd3-ab88-0520d1df32bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246824, "uuid": "f495b989-a0fc-4aae-b086-cdda8f76f7bb", "value": "24576:DqodlTg5qA0CIYFF/66LghoGFq4H/+Ua7KV:+ovTe07W6thv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246824, "uuid": "0054ae43-a0da-4dc6-b180-acd67edab1d0", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246824, "uuid": "86704922-87e7-4e68-9fcc-14843123f0c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246824, "uuid": "c3d8701b-d6a1-4be8-a108-555bfadbcefb", "value": "6cbccbae6d304070475112b4c220cd792b732d2a7e963cf89984a5e5f6b2854f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe54b4ae-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242697, "uuid": "b6ac0354-796b-4528-866b-46068876cd66", "comment": "Malware payload", "value": "4ec6a7301522e3138cdff61c6a993de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242697, "uuid": "929c809b-eb5e-4cd0-9697-310eef0218a0", "comment": "Malware payload", "value": "6ccf08011c86c4e0e6e94c64564758b63fea91f98a1a71302c6c482f63deb079", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242697, "uuid": "cc7bad32-9014-40bf-b5e1-fe2ee18c8bf2", "comment": "Malware payload", "value": "4603be384bd7c91b2efde4692bfc4011bfe32a10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242697, "uuid": "c1cf29a9-2b31-408b-ab65-4790583563da", "comment": "Malware payload", "value": "3201faab3e8ef26c9325cfdede88775a0be0a98a3c762f903f900bfc9898b51e66afc6ca7eecf3dce7e5470de8442ae2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242697, "uuid": "b8a28139-07c8-4473-815d-1e4ba35dbd99", "value": "T193B2B77CD2E9ADD0C76F22F074ABF7C501AAAB17BC265B1CB8D815551F60244EBB428C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242697, "uuid": "60b95e87-c5a0-4609-ae7a-d1364435940c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242697, "uuid": "3644e254-783e-494c-9479-b13b5399f115", "value": "384:yz57Ngy0RmY554b1Pk0kyVkJLp7oGWikqA0qmbHlrpcsjTHbYyfXkcgXcLU11WJm:yz57Ngy0Rd56bFbyVoGWiRqmpfjTHhfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242697, "uuid": "02f55fa7-6d9b-4bb1-a6bd-724f6cccd748", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242697, "uuid": "890c38f7-9e80-4f5f-8ec1-fbe08263eca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242697, "uuid": "3a6d0a07-791c-4e49-9f79-7f9504241cb1", "value": "6ccf08011c86c4e0e6e94c64564758b63fea91f98a1a71302c6c482f63deb079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c89769-4add-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778245123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245123, "uuid": "92886d12-2498-4dea-9455-931f167f0e98", "comment": "Malware payload (Mirai)", "value": "fa886b59f80564e49c925d5e909edd90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245123, "uuid": "8b4b5722-e87b-4a4b-94e6-cec394510d5d", "comment": "Malware payload (Mirai)", "value": "6d5f52819cec6d1adf9b7f35d639bf7b070d2e0f9ef5dead33e5f683442eaa80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245123, "uuid": "b9d4f57b-1625-47e6-9cf8-e97c10577c01", "comment": "Malware payload (Mirai)", "value": "383aab0f95f393af4e31e8949bb6d48e3229060c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245123, "uuid": "5915a47d-3621-41a6-bf5d-f9112329fb23", "comment": "Malware payload (Mirai)", "value": "57af0d9063fb46f65e7f02e1c91149e3f0c79268533077ab1ccb4224f3df6b11c8f4d3703a8feabf91ac464fd7c9043b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245123, "uuid": "ee09cc78-a11a-4806-9796-0136d2278185", "value": "T1F3D31846E8819F12D5C151BAFF0E128E73131B7CE2DE72129D246B747B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245123, "uuid": "a1ff69f9-eeac-4ab0-9165-462fc9a9e0c0", "value": "3072:4tZ3AcjQm28IbTtvavYduEMMZ2WoV6zt9yTjdOL9AZ:eZBl28GtvavYYEMooUt9+dOCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245123, "uuid": "ae028189-682a-4fd8-8356-073b846f8ba0", "value": 142324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245123, "uuid": "40aac5c0-1fdf-4c9d-8b14-3fa82e3f71b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245123, "uuid": "8ef1bf95-1ff4-4e62-b9f5-bac458b3bb48", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d658a0c-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265109, "uuid": "b774792a-b004-4012-8c1a-e06daaf045be", "comment": "Malware payload (Mirai)", "value": "1449e3f0aa33f2b5ea4e2a11536950a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265109, "uuid": "ee55cf64-2c51-428f-ac84-9e1249663ee0", "comment": "Malware payload (Mirai)", "value": "6dfdb11e45fc2a40cb38d581351d73a216ec023ca9b1f8a22591fb3785ec049e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265109, "uuid": "6733ab65-e91f-495f-8fd3-bea26882e0cb", "comment": "Malware payload (Mirai)", "value": "ee9350bd12ff2dc20480e6d869a0cb1f11d66029", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265109, "uuid": "a49284d1-0389-4db5-9c77-eb288bfc9063", "comment": "Malware payload (Mirai)", "value": "b3498d347f0642ab27c4cb916de34db37b8322542da6ebdd3fd41fdb527fb8e5355bf037d253e4ae7b671a830a8e8e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265109, "uuid": "f5a32912-f35a-4ab5-83c2-7553c737b571", "value": "T17AE32B46F8815F12D1C112BAFE1D124E37231BB8E2DE72129D246F747B8A97B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265109, "uuid": "2436257b-7e1c-46b5-9909-0b0b777cdeeb", "value": "3072:qp5G0bi/6bI8/99XMDIaWWjt7PWoD3RegLIjV:oG0bi/6bI8jXBaWot7DegLIjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265109, "uuid": "2c6a8d91-2066-43ad-8439-9aac21a6c399", "value": 155196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265109, "uuid": "5ba29d6e-6abf-4a0e-8e51-dbe1abda615d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265109, "uuid": "644ca7d1-7351-4e7b-87b2-5cd38a811cb7", "value": "micro.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef71495f-4a80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778205305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778205305, "uuid": "89fe76d3-3954-43f8-b257-04c6fbde785b", "comment": "Malware payload", "value": "a0b5e905ff6fe2bca7660f57b6560b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778205305, "uuid": "2258fbe6-6ac4-449a-b1ac-c0f7d30d675d", "comment": "Malware payload", "value": "6e1015e19248552a3c4cc200a5c3d1fb42f6d86033ac0211196917879242a0c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778205305, "uuid": "ef7e2b59-38b4-4076-8da8-d7d25f110364", "comment": "Malware payload", "value": "fea901fb5daa06349bb8c0c9480fc9877f0a219d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778205305, "uuid": "c86b7c59-e2f9-47ba-adfe-9d238e35a952", "comment": "Malware payload", "value": "d7f2ee5b759d8f3cbb65d8bae84b6915c5b414c320f5a927275854592c9df13c1440e26f95e59b64be690e7e20da251e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778205305, "uuid": "ff3289dd-8925-457d-aad8-5883d933d636", "value": "T14464CF56F3A960FDD4ABC238CC91260AE7B2787643649BCF43904A1ABF135E15D3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778205305, "uuid": "d515a904-fb8e-42a9-8743-914ce8617488", "value": "86632d6e557ec1e96328e5b64f25b46c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778205305, "uuid": "c5099ea4-b513-4370-9faa-edbec929a109", "value": "6144:5Cp5PYUaXNIiQALhRattHoaHi5G1NMwPukfqt:op5Pd5iQYhYXFHMoMVkfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778205305, "uuid": "7aa7cf38-ae75-4684-bd25-8750e9979c32", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778205305, "uuid": "70e0320f-961a-47c8-a4bb-36ef1cfbba41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778205305, "uuid": "0444c6ef-3df0-4256-bada-c68c08694831", "value": "neo_p4t4t0rz_pwned_you.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9f928f-4a9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778216419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216419, "uuid": "ee377ce5-c29a-4d2b-b2c9-6d2ee7e1b1f8", "comment": "Malware payload", "value": "f4badd8413dcb3053892d775dbd83977", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216419, "uuid": "7da72868-d281-4aa1-9f10-d58cd8f4fa56", "comment": "Malware payload", "value": "6e2192ef701df7f25d63e3357220f1ae82b6432009ba38812b5c953866667d13", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216419, "uuid": "793d8b6d-ddcd-452d-a8ae-4d4cceb395fb", "comment": "Malware payload", "value": "c1b0e5c07c40f333ffb909fa9a29fd88720afafa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216419, "uuid": "1ccb1bee-2382-4db4-a74d-fe00f89f6f55", "comment": "Malware payload", "value": "da0497c5c3dbba7f67fad747625ca3723e9af2b40a84de1c87705ad6dc3dfe2152ea754e047a25d1f2afa85bf82a3616", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216419, "uuid": "5767a429-f15e-4301-8742-2b3a5a635d03", "value": "T111E46D44D213987BEC430675A647E35B157AEA20C832CFCBE6D81E65DDB39E25B0A307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216419, "uuid": "34298468-dec7-4c18-a18b-0bcbc70afd73", "value": "953394ee44f1817f72dbbc6e791bce8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216419, "uuid": "8e92eb1e-071f-4d69-9717-481e525df97f", "value": "12288:VIwqOU7FU0phFKxZVovamPYySE4B2BzkfWvPfuh2fllghUQKuyvcIkjKKjszV63:VZAFUu8ZOimgySE4BoznKKlLuyEIkwV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778216419, "uuid": "75f94408-95db-4649-a4ff-65ab9b077223", "value": 699048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778216419, "uuid": "7bb7d47f-c909-48a7-bf5a-01d03afebb56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216419, "uuid": "9e27f967-0dc3-437f-ac31-bf33765107ca", "value": "sqlite3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbe9fbd-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238723, "uuid": "1e31b4e4-85cb-419d-a7b8-1846c118c02d", "comment": "Malware payload (Mirai)", "value": "c6c27187e4637789ec8fda438417215e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238723, "uuid": "539e5655-7c70-4171-8514-c86b6e6ba664", "comment": "Malware payload (Mirai)", "value": "6e23e45f691ac1109d67a3218011856e23127c8f796a8bd865ece21852dd465f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238723, "uuid": "e8b1a0c1-6405-4ad5-8cc1-6f575c12a6ff", "comment": "Malware payload (Mirai)", "value": "8283dcdeca4990fab6210aa9f569dd49b44a7889", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238723, "uuid": "8aeb594e-8015-4e13-9ae5-f26240f998bd", "comment": "Malware payload (Mirai)", "value": "cf14bb4995ce473073dc2fedba3a906127b162e51080947be955595675b876c452e1ab296d05de21526cf6626351ff13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238723, "uuid": "fc8cb800-996f-4767-b5a9-8922bc6c7e94", "value": "T12F631A4ABC819B12D5C5127AFE1E128E33231B7CE3DE73129E106F25778696B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238723, "uuid": "a71b0c45-38f8-4f91-bbc6-10383b21b598", "value": "1536:AhnA5AKA1lGavDQ+jM6iMOA3EjqW7j5FYG:LA1kahOA3E2W7jLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238723, "uuid": "14431c65-50c3-4ead-a18c-b13e0e61db7d", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238723, "uuid": "8e3414bd-90e3-42e6-af1c-64610a37be35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238723, "uuid": "1d3f1571-f786-4973-95a6-741cbf51e773", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c086b65-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778243337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243337, "uuid": "1ae8a421-b1f6-4888-9888-5b50258461ca", "comment": "Malware payload (SnakeKeylogger)", "value": "7d6e32079aa73ea31dd0ce8b58067f39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243337, "uuid": "1ef49b55-0787-4f8d-ad4a-9c3904339256", "comment": "Malware payload (SnakeKeylogger)", "value": "6e2c7b90b921e3a70b16d29b9dde6fc06d0798849d09cd1420c99a76abca6908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243337, "uuid": "d13abb42-9f86-4e19-aee0-4e6606b9e8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "fe982cf0c1ef093c93e1af426698cefe2fb28d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243337, "uuid": "d42b71c9-d2e7-4b8c-b3c0-7c97f4396e28", "comment": "Malware payload (SnakeKeylogger)", "value": "7e87ba4c96475e8eb1c0c1b3fc02ccca30e05cc66989590e9b08f9d159583a04338c59ffe8a25e6f8e7782079385f7c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243337, "uuid": "6f786238-6864-4f71-97d8-e83f003f3df6", "value": "T1DB15F1482369DE06C9965FB41E70E7B407B45DA86422E307CEFA7EEBF9397017905283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243337, "uuid": "d4a08e53-4d97-4db4-ba52-e4c658ec6208", "value": "24576:VuSJJSHwIWDbVfm3JhUw5aLqqohnuT8LSgw2rH:VuqUwIewaLshtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243337, "uuid": "5bc68218-61ee-4edd-9741-9de073ca77dc", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243337, "uuid": "9770b25e-29e1-401e-85ad-d8446cb9ba6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243337, "uuid": "848c41a7-3129-4746-a1a9-c6b98a8982ff", "value": "6e2c7b90b921e3a70b16d29b9dde6fc06d0798849d09cd1420c99a76abca6908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bd14bd-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236726, "uuid": "f86044a3-11d2-4f5c-bbde-e717ed0f88e1", "comment": "Malware payload", "value": "cff1e5a85f5d188a37b141a28c47b6b4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236726, "uuid": "90bf23c5-a075-450c-833f-47747869dac4", "comment": "Malware payload", "value": "6e4c16291fe07a594b10f94c93b647a46a543466d15e4aaace25139e98fb4f80", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236726, "uuid": "2b05ca84-d2ed-4d4e-ae0c-7b1845c45788", "comment": "Malware payload", "value": "e37c5a3c733093e8e27470fbc2b485a716bdbf50", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236726, "uuid": "4264b87c-9d47-484a-9013-10cd6ec31b5b", "comment": "Malware payload", "value": "d0cb960ffa54e1c85916697714146d30458c77378ddfe8d18476bf7378236f1a9709831badbe755e74f6ada6da8e353c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236726, "uuid": "9e3d51c0-4567-470d-a71a-c8d82c0e0511", "value": "T14D534B20DA500A3B4F5767A9BC698761C9BC8206863744F1F6DA074D62064FCF3FEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236726, "uuid": "3f45635f-93a7-4a1f-98c6-8d8c85890184", "value": "1536:dTGLz5WqbCnbZQJ5M3cdOZdzck4NyhKOMMGPiz04:dTGLQqbQbeTgGOZxtKxrPizF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236726, "uuid": "2167c97a-0b43-4702-b6b9-b551d8ffeb91", "value": 66710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236726, "uuid": "bb3f8c3a-eda0-4185-a7b0-e91e5f5b171b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236726, "uuid": "a5d09929-cfef-45ca-b597-d122600bdd5b", "value": "RFQ GS-05054 SUPPLY OF POWER SUPPLY.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e7893a-4afa-11f1-a769-42010a9c0008", "comment": "Malware payload (BabylonRAT)", "timestamp": 1778257638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257638, "uuid": "4f5fabe0-1049-43d7-89dc-383036b6374c", "comment": "Malware payload (BabylonRAT)", "value": "024a9f89f5c5977f27dfc25f3a88307a", "object_relation": "md5", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mpress", "colour": "#DD82CF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257638, "uuid": "b88088e4-caba-40eb-a830-ce6087a176db", "comment": "Malware payload (BabylonRAT)", "value": "6ec4a56cbf21b654de7cd5fce1a62f0684ab5fcd48688421d08c2119a69f3492", "object_relation": "sha256", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mpress", "colour": "#DD82CF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257638, "uuid": "a0f6dd1e-2a24-4bf7-b48c-5bd94a45c89b", "comment": "Malware payload (BabylonRAT)", "value": "9b8ba41b82f1f0283625909654b07025024a6595", "object_relation": "sha1", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mpress", "colour": "#DD82CF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257638, "uuid": "4c8c57e6-6316-4dfb-931a-c85d6d20f1ab", "comment": "Malware payload (BabylonRAT)", "value": "2f4ae2ab9aea5362412832e7ba8ae0bfd9a84f7517fac8777b2826abe44c79fc477b91d45010251ea27ffbc8d497143a", "object_relation": "sha3-384", "Tag": [ { "name": "BabylonRAT", "colour": "#7890FE", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "delphi", "colour": "#283503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mpress", "colour": "#DD82CF", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257638, "uuid": "d00c836c-e37c-41b1-b183-950a4e1c1175", "value": "T15D44E195B888C8E2E52634F0BD6EE9F038A57E8C8468561936B7370D9473583DCABD0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257638, "uuid": "f3922606-e06e-4e31-8cc4-2f851decc40d", "value": "dd2e3254a193cf4be6d2ce044c38fcf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257638, "uuid": "cf503df3-5307-475c-8979-68e46632e17a", "value": "6144:3YLtU7Ixhnhz5aqHCIxmLrDTw6UPuc4dj8+gPevsNivH:IsI3lTiQG38C1cevHf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778257638, "uuid": "bf869cbe-9fd8-4635-8b3f-44c9bfe6fdb0", "value": 273408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778257638, "uuid": "ce1d613f-729e-4d6d-88c2-9c70c3389d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257638, "uuid": "200b572f-f8e2-4b47-bb2c-10f1b9d63d0f", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6e9b3-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242659, "uuid": "29873c8f-e5a9-4682-92c9-9677a7722d67", "comment": "Malware payload (Formbook)", "value": "7e5db54d4fb8844f38a282c5b8717f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242659, "uuid": "27221f5b-1b04-447d-9724-eaf0e5259eb8", "comment": "Malware payload (Formbook)", "value": "6f0b107e6b814ce45e913e49e093c01f695dce75918ee6db9acfb2555b20a49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242659, "uuid": "c1f7da23-935b-4013-8ce5-229ba89bdefd", "comment": "Malware payload (Formbook)", "value": "8f9d82d8ae061fd84cbf9dadc004f60567b65972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242659, "uuid": "2a0587b7-59d2-4fb7-9c74-19306bb6314c", "comment": "Malware payload (Formbook)", "value": "c814a4fc2bca5c9ec0784d4b080a299e3b08ebc422e42319c17b0b3c32b6ea91ed2e4c330c637d0a4bc451f52fdfb056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242659, "uuid": "94dcc8fe-fe91-42ba-8389-8bf73f9b7e9d", "value": "T1FD3502482659CE02D9925FF81C31F3B423B95EE8A921D3078EE9ACEF783E75159452C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242659, "uuid": "173b73e4-977d-4d30-a3d0-4704692629db", "value": "24576:v7/gmtfOgnXyVGyrgilBZmNawMA36tQqjHQv7njTrdhTjxv:v7/gMfYrNlv8awMoqcnjTr3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242659, "uuid": "7f4bee20-c47b-4228-a812-5d8779b6a858", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242659, "uuid": "5d13dd58-f475-4469-8bed-021f597a6da1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242659, "uuid": "677e3a2d-b0e5-4c08-80bc-d3e9163db57f", "value": "6f0b107e6b814ce45e913e49e093c01f695dce75918ee6db9acfb2555b20a49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb68134-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778246430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246430, "uuid": "573e03dd-78b6-47de-9950-4e4e3487eb3f", "comment": "Malware payload (SnakeKeylogger)", "value": "ec771cd98d577f274b211d420e366169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246430, "uuid": "f7cf69d1-7e71-4441-9618-034542d6fc9b", "comment": "Malware payload (SnakeKeylogger)", "value": "6f156b9664a0f933075436c8f3a123635005ed059fc88bf5e053d76cd619f1db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246430, "uuid": "63b4a00e-f6a1-4b72-a6ec-b01b1ab856c2", "comment": "Malware payload (SnakeKeylogger)", "value": "4c19cbf4943267cb2c48e1433700dfb812adc46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246430, "uuid": "cb4deca5-4c4d-4881-9ab9-fabd471c8d88", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8a430cb8e764daeab998f647de606a953d6ce4232cf2cd362c128f910953489d91156067ee6f500e9a940e96ec9a9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246430, "uuid": "c7e5a2bd-6486-4bc2-821e-ac222aaa9362", "value": "T1FC3512182258DA1BD863AFF8E831D1B167B42DDDE820E6568FC87FEFB029B150518753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246430, "uuid": "97513e07-54bd-4e6b-9e33-d8eba9acd68d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246430, "uuid": "0a9dbe15-87cc-43f2-afa0-604d5f4c09e6", "value": "24576:TXXlvXYw1AAYNsM924qY6hIaQLlG6lYlV0AaS+vSKSokSt:THlvrAA+sMEQLlM+vSKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246430, "uuid": "58d2c3bc-1320-4434-9e21-1a3ece5549cc", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246430, "uuid": "e7ff360e-e82f-49a1-9811-1e777ef6fdb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246430, "uuid": "65e07aaf-7dee-488c-963b-778dc8d6e181", "value": "6f156b9664a0f933075436c8f3a123635005ed059fc88bf5e053d76cd619f1db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462acad3-4abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230362, "uuid": "0f075496-e108-428d-a30c-4284fd2cc95b", "comment": "Malware payload", "value": "6a531f1a91204ef7fdc3e398791075bc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230362, "uuid": "c1c01e2a-de85-4d76-a4b2-d0c32d5a1f3c", "comment": "Malware payload", "value": "6f1fb8d7517ac977118ddfd4ec96f79d67cc57b63f03f7c22e8e8d79e1408e5d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230362, "uuid": "4febcfc5-f5b5-45b0-837b-4b14bae9e1b0", "comment": "Malware payload", "value": "209c7e5f2a5949d3afa8493d2ea782768f971997", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230362, "uuid": "3f572640-2308-497d-9dd3-d63743c6e06a", "comment": "Malware payload", "value": "2d9749476b99642e86275c67f57a6dc06c6f584a1eb8c0b3c00a8fe7e6a899f31e1195e5af43b567b2979ea6fb00004b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230362, "uuid": "51b93e68-e876-450c-bdc9-e145b87ff622", "value": "T10FF6121BF308696AD9F35335B93A437B541B1D354F43CA877860B23D6AB36C04A6EAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230362, "uuid": "572dacc6-9438-4214-8a2f-d1497669d25a", "value": "393216:t9FMmPEfH9Hd5xzfOgMimneKtnwAlNOIneT9g:tjPEfdHxrGi5knwONOFT9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230362, "uuid": "b16191d1-2853-476e-ae73-49799bbf4030", "value": 16298653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230362, "uuid": "75e1b41f-b496-4fd1-817a-9eee5951046c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230362, "uuid": "079abcbd-91f1-4cb0-8f10-9f5b6dd95160", "value": "Yes Bank (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c30d5e8-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230774, "uuid": "ca0c5c5c-f6d9-4309-8dc7-bab65ea13266", "comment": "Malware payload", "value": "c6860ddbd5a5cc6a48c43056881e45ca", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230774, "uuid": "04386528-034e-4bfa-a886-65f49d6b335e", "comment": "Malware payload", "value": "6fb3145e1792169d75ac79fb57ca055274b9e1dd9400b9e8fb26f72b70e72202", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230774, "uuid": "49b3587b-f971-426b-b563-8a0995ec2774", "comment": "Malware payload", "value": "c314730bdb38f28ed8b2ab33b5a1a072616ab313", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230774, "uuid": "57f5e288-d147-43fd-82d3-7e79d4626adf", "comment": "Malware payload", "value": "6cbe91bd81560c1928858f0f8e8f630f43989d380981adf11ecec718c7f4220f41fa8436c3ab769dc7b0178747a232ba", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "VSSID", "colour": "#838DCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230774, "uuid": "4555e903-22c7-433d-97fb-272fd899ad3f", "value": "T1C237D005F20C662AD9C6F07DAD8605E2B536BC8A6350C5463537B32DFAB37D48B267E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230774, "uuid": "74982460-dd32-4773-bc3f-6b3ed9a04301", "value": "196608:iBWrMQ/Q6hZVc/0F70EgdVf6Ans1sgAXFNgI7a7/Y3Zu9yzhLrZy6epA0RMplixk:iFQ/py/0FaSs3FNgIuM9zhL9OYlixy4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230774, "uuid": "fbdb7726-467e-40a9-9daf-c77d7cc54640", "value": 23108938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230774, "uuid": "30acb8cc-9a60-4de2-b0d8-fa3c267636ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230774, "uuid": "fa845e7a-c1ab-40ed-86ac-66ee930a3c33", "value": "VSSID(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db5df72-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243796, "uuid": "cb6c1353-6dc3-4c57-b731-243324ce15c0", "comment": "Malware payload (Formbook)", "value": "5a6f2a1e5fa539e211ea96211ea27e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243796, "uuid": "4cf81bc0-b3ec-42de-979a-d73c22d50125", "comment": "Malware payload (Formbook)", "value": "6fd1fb9c7ef73273554d83785045233a44abb00164da9b87fdc182a0df6c34da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243796, "uuid": "3bce8078-2583-4fa9-a4de-9aeb120dab19", "comment": "Malware payload (Formbook)", "value": "42bbf5d9d520f427db15b1c11ce66d853ce81e80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243796, "uuid": "0e16c8b4-2eb2-4869-83b4-3c53e2ebdc18", "comment": "Malware payload (Formbook)", "value": "7faba701e956abe9656d9c913fddbbc3ce84d157b6127fa1ce39274c56777c2872c06bb97ab386725cf0ff892ef9f489", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243796, "uuid": "0ff6672e-e773-4ca6-a147-42da9a91775a", "value": "T15B45F0416227EC07D5A29BB01CE0D6B00BF66D85A412D253CFF27EDBBA39B49A5C4353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243796, "uuid": "54b89552-6d3c-4c35-abf6-ade0b3820ff7", "value": "24576:W8csuzSJJSHwOEC9EA06nzG0ZHMLtXpPAvuiKLY4i9F7Hoj:pgqUw9UEAF1ZiXpUwL8oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243796, "uuid": "2cd0f7c8-d947-4e1a-88d2-ea7446ad6e87", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243796, "uuid": "66b67673-be45-4f3f-92ea-4223e949f08b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243796, "uuid": "e5e801a3-2446-454c-b58a-8cc9718a3de8", "value": "6fd1fb9c7ef73273554d83785045233a44abb00164da9b87fdc182a0df6c34da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1399aa87-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244021, "uuid": "4cdf852d-2130-42e2-882a-15c43e498d57", "comment": "Malware payload (PhantomStealer)", "value": "8b32485a02828df0b8c05e34b61422d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244021, "uuid": "40f657ba-b055-4e05-9370-dda6acfc4009", "comment": "Malware payload (PhantomStealer)", "value": "6fdd0b6f626718d5943028db1733c36b711eb9343a7a3b2d8e2ef92976e7e4a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244021, "uuid": "036e8ac5-70cf-4770-b294-ac51f65a9f08", "comment": "Malware payload (PhantomStealer)", "value": "1ef05dd388a64324952f641fc53bed062bd32e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244021, "uuid": "39839a34-e66c-46b9-8dd3-79c4a33fbd18", "comment": "Malware payload (PhantomStealer)", "value": "78944cb42bf7316172a148e26c8045808a9a904eda6f0ef9334e56159ad8058a39ad70adb1f1a419099ae95077d56ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244021, "uuid": "f4b67d66-bbf1-48c6-a109-507f5ce2bfc0", "value": "T169850204FA8CEA69CCA741B5F667D5B105F44F69B8018E5746ED9FCB7A60232B0ACF01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244021, "uuid": "dbff1b5f-d4d0-4445-a2cb-fbf7a345c61a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244021, "uuid": "a036c97c-9ef4-4376-acf5-b8e696853653", "value": "49152:SYYDivMts2Yi1PX55Mod08ihuGucylazv5P+h:JvMts2Yi1h5vGucyl0v5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244021, "uuid": "3402c340-10e6-4e0e-9236-869b8e1aa7fd", "value": 1762816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244021, "uuid": "c33b1c84-5966-492e-b94e-5d57341ccbda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244021, "uuid": "8e184237-c2a8-4d17-a508-e8f3b9b8026e", "value": "6fdd0b6f626718d5943028db1733c36b711eb9343a7a3b2d8e2ef92976e7e4a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48bd70e-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244318, "uuid": "574d1832-25bd-47e1-8c49-83e556198e54", "comment": "Malware payload (Formbook)", "value": "f63c10beab545afeae5f3334bc878d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244318, "uuid": "18519adb-97c7-4275-ab10-fcb8be5f680d", "comment": "Malware payload (Formbook)", "value": "704cc2c01544716c2834dd46cb3d210a0401ec5523ec5ee5ce07590ad95193c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244318, "uuid": "5e52953c-a527-4a72-8b43-d8b4ef61f3e8", "comment": "Malware payload (Formbook)", "value": "f9489058e99f8c67c8e6391c8abf6f2d378cb7e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244318, "uuid": "c58673fd-db1e-437d-ac88-756d8475dbce", "comment": "Malware payload (Formbook)", "value": "efd71a0270241abb3f10ed934b57d21a3047df2fb1365ac20de41803034a39038cb1910a5f852b5cd394c1d62471e61b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244318, "uuid": "549eb44e-733c-465b-9065-47a451f1911b", "value": "T17C5423A9B3C51172C8C4C73F7DA465EB14F868F8C34CA22763C6262532751EA2DD9F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244318, "uuid": "7c711d65-168d-411c-9219-7968e0454564", "value": "6144:41yi8wYfRMMKxywQdHIsIzecZ3OgB4rS1OTMF9RM1CYq:SyiIfRGyroD6cQG1nMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244318, "uuid": "28d25037-12d5-4465-b10f-591178b718a7", "value": 285852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244318, "uuid": "4788cb29-b424-4122-8f15-ff63da63a0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244318, "uuid": "0f75f66f-be2e-4f85-9532-d07b17d22f74", "value": "704cc2c01544716c2834dd46cb3d210a0401ec5523ec5ee5ce07590ad95193c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e642c55-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231234, "uuid": "4c8814ff-b834-4aef-8b3a-085d9d83552c", "comment": "Malware payload", "value": "ec2b445e20891ae731a0b71293e6a8fd", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231234, "uuid": "d287af7c-f6a5-4027-81c8-702fec7084a3", "comment": "Malware payload", "value": "7060f7df266dffbfd5a63a9fcdaf14af020d90ba267c3a45ec44ea972e6936a5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231234, "uuid": "e1986099-a46e-47af-8fbf-b91eb93b7707", "comment": "Malware payload", "value": "619bbc99ffc9e140eef6f6013710de6dfcf2e2a6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231234, "uuid": "d2651312-5827-4a60-9947-3ca1a0ea661b", "comment": "Malware payload", "value": "28c2477fb119b92f46296d6fcc2988b70b54c81ee3ab60524b4cb49f8eb9369b7615e5915fa2515e517b2edf77954fb8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231234, "uuid": "5a40202e-75cd-41ae-9923-90977017c934", "value": "T1BAE6020EE29E4F5EC8F786773B2E137122192E245B03C127E671B23965FBCD48A1A5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231234, "uuid": "b4a24c6d-4218-4570-bbb9-36174868d99f", "value": "196608:7dh0qWQiGCHShu0rUzhvgfmrmOY/XwJTF7uEGG/558VrNA/xVW8/YxnJSb5Zc:iS5Sufma1/Xmr/55H/xf/Yyb5Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231234, "uuid": "c55a2001-349a-44b7-b9bc-f419d0f29041", "value": 14327880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231234, "uuid": "3e2d2e6e-883c-490d-8c35-557f889639d9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231234, "uuid": "9a402936-d43d-4f17-af81-bc50d8a59d4b", "value": "\u0406n\u0501us\u0399\u0578\u0501 Cred\u0456t C\u0251r\u0501.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b500f1-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236246, "uuid": "78cbf1af-7daa-417a-8d35-bb9a06fd6d67", "comment": "Malware payload", "value": "b3d083288f5b5dd47c76ffb8675a3dbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236246, "uuid": "7be14833-9bb9-4346-b5c8-4e22d44e071d", "comment": "Malware payload", "value": "70a7d57dbabaa77877840c542b7dda23194a9dc815638d620df1f5f7a154d414", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236246, "uuid": "81bdd349-0970-4b88-9acd-ce4cd391e17a", "comment": "Malware payload", "value": "6f7d6b67550aa198e21c58277279267dc648bcd8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236246, "uuid": "bbec0b8d-19ae-421d-898f-d7a27a14bddd", "comment": "Malware payload", "value": "a7dbf2448103fbb6eea68652b3142ddf5e3114b356d25d6f58223572606a721b9e56d02b06a4bac59bc8f4f4fae885a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236246, "uuid": "881b7472-5855-4901-8bfd-925e01e3db2a", "value": "T15F32F79433779020D68239A6F0FD0943B2398E05BC4E8850712E8EDE4A1DB4B1F77FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236246, "uuid": "dc553d06-d242-44df-a2f5-5db85bcf5e1a", "value": "192:dRIwCSC8CDqo7L/X5UxtZnso8rgKEzQSM8m5HAubsicisR9Kb3TkBMMmK+lwit8H:d2FRHqKWxULrgLQSMX5gosioKDTVMmKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236246, "uuid": "7059bc80-e156-45fe-82db-3a3f77c9f43c", "value": 11671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236246, "uuid": "e0ecff41-a4bc-44e6-9be4-7646cb32db2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236246, "uuid": "bc314d0b-5d88-4045-8f0b-2977367cd07e", "value": "background.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12819d3a-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265064, "uuid": "5dfb5c4c-c313-4fdb-8c7f-31b212e3a234", "comment": "Malware payload (Mirai)", "value": "9ce6fa0cba04fd04af1d8ad1daaf5299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265064, "uuid": "6aef7e35-9e96-4b83-b293-8dba380c0efe", "comment": "Malware payload (Mirai)", "value": "70e8eafdb11d066ca6a69391a1e5a4208735a45805f0dfd6858e3e83a4a3edb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265064, "uuid": "e276c5a8-fbf8-40d1-b892-c3ac50f7c4d1", "comment": "Malware payload (Mirai)", "value": "122aa6f9fe9fcad6b844170a507c7d23a0d8f8e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265064, "uuid": "ecfb379b-f15f-4f06-b986-c925fc083c84", "comment": "Malware payload (Mirai)", "value": "8010b60401d902a4ecf6c0ff570b3d12e87673be54c7f5542ce1e5be260b31e6a47e855e8cc5f50b9cfcdf8fe123bfa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265064, "uuid": "d6a1d2b0-12ed-4051-890b-8325b7d5e2c2", "value": "T150F329CBF800DDBDF80AE73B08530909B530BBD150925B37225779BBEC3A1991967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265064, "uuid": "533716f8-7119-4a99-9896-f533b189606d", "value": "3072:BS51u5w8WOuPwNLM4L8FQxNynZVHjbiILQo2qoyZl+9U:k1+uPwNLM44FsynHLMyZI9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265064, "uuid": "e0fe3080-254f-4a19-92d9-bb070c0a33fd", "value": 157440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265064, "uuid": "36042281-cc53-4bae-9549-12c09716c7e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265064, "uuid": "89c2489f-94af-46ba-a4e2-71dcf4a0a50f", "value": "micro.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c896fe80-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244324, "uuid": "148f4171-c12b-4808-898c-fed7dcc14807", "comment": "Malware payload (PhantomStealer)", "value": "0e64ed20c2b0d064ac772dfe597014d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244324, "uuid": "b1deb32d-bd75-4b13-9aa5-5a006e417972", "comment": "Malware payload (PhantomStealer)", "value": "7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244324, "uuid": "ece8bb65-c553-48bf-a2a0-2f11143dcd12", "comment": "Malware payload (PhantomStealer)", "value": "1267e369e73b2274e787075ca9693c5086cf4b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244324, "uuid": "0a1d6bcf-cca3-40bb-95dc-c30b2d12098c", "comment": "Malware payload (PhantomStealer)", "value": "3684fc7745a476bb5322e1ec670120c8753a89a80524aeabbb9eca538c3d53302eac5f0559cb74fb56673823ec2436a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244324, "uuid": "5331d79b-9020-4a21-8609-4475d9e25473", "value": "T16E652304B647D802DCC1177584E5D67803765E8DE912C21BAEFCBEFBB86A72E6C085C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244324, "uuid": "77505984-297a-4e8b-b153-f6e1dca8e58d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244324, "uuid": "a9117a22-b72f-4715-9d15-ce530d5c7df5", "value": "24576:Alddce8+v9/KHex9rQkBTNE6Rp0tqOSojckCJowN4lQ3lx9WCms6P8ZB/XCe1j6q:AlddTvIHe/QkBTN+qb4guwyO1TW5sFvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244324, "uuid": "e6ac2328-5f7d-4463-9bd7-a53e97712298", "value": 1539584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244324, "uuid": "e1bf7f61-ef10-4f9e-bfe9-8f18e09316a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244324, "uuid": "01e5f4d4-abcd-4dab-8a86-e4e4062dbaad", "value": "7176bb04c88a750ab69ca4e8edc016980a22cff9d42b2f43b5fd2218c61643aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea2a2a0-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244764, "uuid": "77f22da0-8afc-4365-9cc4-dbee1fb7dd75", "comment": "Malware payload", "value": "32daef53e183c3fbaeab44b2bf888811", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244764, "uuid": "fa72a14a-09cb-4c6d-a587-0ac41d3d1cc3", "comment": "Malware payload", "value": "72239ae8f68343214b64b28c8c351f336a4ed921d798d687ed464f01dd39a689", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244764, "uuid": "2921415a-dd8a-406e-ad4b-497da22cf19b", "comment": "Malware payload", "value": "631e216168a06f93972918608acb7a552792689c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244764, "uuid": "9944545e-3d2f-4cf7-863b-169ef548eb11", "comment": "Malware payload", "value": "7994f0f0da4612d23d3babe96b119d7aa88a403aee02f0863e68858ec6eeb05b3cf9032b9b02b0a9e59627a8ce3cb218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244764, "uuid": "9d1be932-daa8-4e5d-9024-bc8e2623fc75", "value": "T1AEC44216EA61A02FF49389B0797996467C292D361780EC5BB7801FA930709BBF1F471F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244764, "uuid": "074415e1-d7a6-47f9-a162-d8c8936a7282", "value": "a8fe9eb050cc33e62db3a409759231f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244764, "uuid": "04df0730-6d5c-44f7-a6d7-ab31b6546a87", "value": "12288:epuh4lscF1FpdqBwMSc0G7QWLjdGIuzuK1j:epuulXdQdGIts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244764, "uuid": "9d42b9bb-df72-4acc-8f8e-ff0d7baf56a3", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244764, "uuid": "48cecad5-2bb5-441c-8111-3c523d8e7880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244764, "uuid": "e161995c-7d76-4d1a-8aa7-7b6b93f94798", "value": "72239ae8f68343214b64b28c8c351f336a4ed921d798d687ed464f01dd39a689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe7f4ae-4acf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238995, "uuid": "22b621d3-e99f-4905-ae86-49225e170c88", "comment": "Malware payload (Mirai)", "value": "5d0acc37719e91653f447f6ac284f400", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238995, "uuid": "572dc764-0587-4343-80a0-5120dd92d3fc", "comment": "Malware payload (Mirai)", "value": "72343c8188de7346737727f6e9f3af99340dbdd1182dcafd1f50939cc8045624", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238995, "uuid": "4d3b0429-2c58-4a0e-9ece-b407a35f5b9b", "comment": "Malware payload (Mirai)", "value": "1a384fe776319815e1c43f8c97fea0181a906d1e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238995, "uuid": "e2a833fd-7a32-4290-a0e0-c0e77e3dca55", "comment": "Malware payload (Mirai)", "value": "fdfac6ab815db1d56ce1efd83536683847735e792164a1d2372d42c3173c16b974112aad6b7b2f52cf3dd64f89faaade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238995, "uuid": "aa84903e-ac99-4d1f-9452-061352617036", "value": "T15883F942BD429F13C5C225F6FBAF015D3B167B79D6EB3242E921BFA027864DB0D26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238995, "uuid": "fe889127-a1aa-4b57-a20f-f4eacc7fce56", "value": "1536:kBjWe2rADWC+4ukByg3qVMnlqRE0XS7Yo0qm9CVPMvRYJH0A/tvt0dhnb8GCdK/:kBjIO3qVMnlqREin9cPMvKJH0AcbNKK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238995, "uuid": "6edc4651-b44f-45a9-8e26-3ed10d88b6f4", "value": 87824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238995, "uuid": "9858ed81-dbd2-41f3-a927-cc0bf4154072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238995, "uuid": "b6b5b91f-d8cf-4f48-8b17-2c0f046bd416", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a256b707-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244690, "uuid": "41702142-3c25-45df-8c88-ce2924c8391f", "comment": "Malware payload", "value": "f387e4b27538664be158fe53dad5d97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244690, "uuid": "0d8390ab-443a-47a8-b93a-88ad6ff76e3a", "comment": "Malware payload", "value": "7236a2dabfadbacbfb20f1bd10437d188ec820c0a5a16e1c48ede49dea75ce06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244690, "uuid": "3a1bf28d-4b49-431d-ab80-832a98a503f4", "comment": "Malware payload", "value": "c10f3b15c086549527b03c07a66562974a3cbcbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244690, "uuid": "306172d4-bd47-4a7c-9e8a-f8f00d781580", "comment": "Malware payload", "value": "9a709513ff0df1ef0cd6c66f346132307dae25fabd810b9ee3821fd9c3cfad977fb4c1f4321c008a02af5de7e75b8eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244690, "uuid": "8835379f-4637-45a2-864e-99492c8d6bb1", "value": "T11AE20724A3E1E0B1C15B237027D6C5A112E2EDE74E371619ACC8F99BEBF33046B16E45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244690, "uuid": "f3ead0ce-04bb-48fb-b86f-00a3960b5e7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244690, "uuid": "14fc07a0-ea16-4bfa-95a0-48e8e182d504", "value": "768:9z57Ngy0RK0NbFEyfJ12VSGnOXwWASUaq1LyJQz:eNbOyfJiOX3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244690, "uuid": "a3734328-79d9-4707-8c55-72f8be1167b1", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244690, "uuid": "a1533b45-a704-42dc-8773-7ecf16e2aad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244690, "uuid": "dd746d4a-9095-4baa-bbde-e3093ffc49d0", "value": "7236a2dabfadbacbfb20f1bd10437d188ec820c0a5a16e1c48ede49dea75ce06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde53d8e-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243018, "uuid": "ddc793af-ebed-4492-9cb4-811ce2228814", "comment": "Malware payload (Formbook)", "value": "282cac4a7fedb9139483069bab169801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243018, "uuid": "037a0571-b0b7-4be6-a0de-a0f5951b2b07", "comment": "Malware payload (Formbook)", "value": "726504b82c74625d5a4637ccd322e60a1815e637ffba73581d0de678aa612756", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243018, "uuid": "a7ec058c-ccf2-43ab-a2ce-dc8447ca207a", "comment": "Malware payload (Formbook)", "value": "2396c0d348e7df68ffc0fe6473fc16e050a7eb34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243018, "uuid": "cd224240-909b-46b1-a078-8a74bb7e42f2", "comment": "Malware payload (Formbook)", "value": "1cc7dd8c1fd93c57260fcf4f2a364523e9d76787deadc0b94078314d62b6b9740c3cf9f26c0c2748e08a1a6c2100066c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243018, "uuid": "394408e0-1bbc-4027-94b3-17f9d161fe6e", "value": "T1BF350288221AEC02C4931FB04D70D3B94BA89D89E911D3539FFABEE7F93D65278451D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243018, "uuid": "65488bda-b6be-4176-9900-0da20889eed6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243018, "uuid": "17d4d2aa-0eb2-48e2-b53e-dccc62730458", "value": "24576:8pJOAS0kHvTBx7FDggsiYDVpG/zjhRy6cRIUbcJ5B:8pJFS0kbFRnYS/zjDyNcnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243018, "uuid": "602f5457-29f8-40be-9273-80807c575b08", "value": 1104904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243018, "uuid": "fb05afce-d0f0-4e59-a7f9-9f8ee7be65c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243018, "uuid": "faac1492-c9ca-4b95-9e44-37634cd48331", "value": "726504b82c74625d5a4637ccd322e60a1815e637ffba73581d0de678aa612756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e363484-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244522, "uuid": "42f4b250-33b1-4a26-8632-ab215a511def", "comment": "Malware payload (Formbook)", "value": "608d711ac79743ec1d22f375d7ea3448", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244522, "uuid": "5854894f-8a5c-400f-a80c-32f55a3afc3e", "comment": "Malware payload (Formbook)", "value": "7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244522, "uuid": "1f98ea4c-5c1b-45d8-a86f-fba56740a434", "comment": "Malware payload (Formbook)", "value": "ecbf78135a6a6d3208629b1a36df71efccd0be5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244522, "uuid": "c802a184-86aa-4bff-8c4c-7d306964bba4", "comment": "Malware payload (Formbook)", "value": "54e1707f6132ebf6d0ec80f66e2fc8f80e0083ae1c82da85f644d73ab442e6c3d570a5491f102760224c7171b0d85bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244522, "uuid": "e37cfd25-b1e0-4b91-91a1-cdbb70378811", "value": "T1C245F1532658CF02D4368BF52D23E97017B76E4EB911F2AE5DC22DDF7D25B240888A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244522, "uuid": "4b05bfdf-8c5c-4f8c-b1dc-a8f10f5d0e81", "value": "24576:NFbal108HXksnHZt65tDKxmN8Uqgo808AwzFMrP72roJ4m6:e108HLHnctmxm/1oX8ZMrPK0J4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244522, "uuid": "f0ac088f-5cd7-48be-be20-1c143aa0452a", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244522, "uuid": "d3ac497d-ac12-4e55-882e-fe4988003d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244522, "uuid": "51e55e97-3ac3-440a-b410-cf4442d5f9de", "value": "7290aa04919e26b4c3e6f91f82a2f242cf93d0e07683d2be6079ab24bef69ef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209488c9-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236741, "uuid": "05d1e4bd-df28-481a-8975-ed684a74eca8", "comment": "Malware payload", "value": "e9689c4909b1fd103415d57c7029f924", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236741, "uuid": "5f113bc0-1dbd-41ca-9b0b-d65186ee993d", "comment": "Malware payload", "value": "72a1a532182a9cc3e6d5251bdda94f8dc75195c56700321906486a0e6643714a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236741, "uuid": "fd97716e-878b-455c-85c0-4d7560dfedc0", "comment": "Malware payload", "value": "ddc0d1e8376ad64cb1244b15e42c51a1ae72a020", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236741, "uuid": "221a1ba6-7af4-486c-b4d6-8d77e52eb402", "comment": "Malware payload", "value": "07ac6d81869ff4788c3dfd23d85e29d9dd2c87dd0f8d3cae81dac7c3136f4474068a54a6ff439fab478b4f70b17cdda3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236741, "uuid": "a1ae89fd-de51-4256-8860-6ec0697926c3", "value": "T131D6C2C8DE7232E2D03965B0D357885706275E4E3F36EEAC212325671BD2EB782A4357", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236741, "uuid": "896f5128-7bbb-463d-8e82-909d40bc64c0", "value": "1536:urfjs2Uf42rnCLhDh7YudX0kC2AtxzipEjJym7AMhNpAPg4tmZd7js8N6BFMpiyv:k6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236741, "uuid": "727a4dd7-9180-4a0c-914d-90ae275a02bf", "value": 12859300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236741, "uuid": "68fc2c50-a79d-4a43-ad0e-19ea6cd0257b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236741, "uuid": "01bfdcec-9d6c-4bb5-b504-451a7c28058c", "value": "62608658.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1763e5d-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246030, "uuid": "3b852bb3-1549-40bb-b00a-01f83a3f5f26", "comment": "Malware payload (Formbook)", "value": "9610adcc930dbad350ca3cba725ab4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246030, "uuid": "64413107-ffe3-46db-ae9d-be7f186a8524", "comment": "Malware payload (Formbook)", "value": "7328e8a14dba077e0aec26cdbe1edf288251fd12993644b30fc8d01e8b1f5aae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246030, "uuid": "7107032a-380e-4d5a-aaca-4abd1fb99f0c", "comment": "Malware payload (Formbook)", "value": "c5723435e7dd7c8c6611943bb377e067d4ff93c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246030, "uuid": "26f2dea0-0207-4334-8bff-38555819bf8e", "comment": "Malware payload (Formbook)", "value": "c2060c30a5555868876b7997875532ab34ddefce6a7fa2deb241814bc35353c2bdefd55e24f3c656ef4b3237a7efd3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246030, "uuid": "aca63ba4-42f8-4297-b18b-1fba7b91c7cc", "value": "T1F254226CB3C6C3B5C4C0A03C39B2E373514526B469396DE33778A6293EC9999F0B5B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246030, "uuid": "ed0720bd-3453-4269-8f61-f92bc3f48e59", "value": "6144:hKtmDUE2TTRzv9OHgAzKzU8CcwTysXKpvN21pVZNWa:ktmDgHRlOHguOIy3211", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246030, "uuid": "f0635b0e-c664-40eb-911c-186b4d0636b9", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246030, "uuid": "d347d589-2838-4b03-96d4-cfe267b4e8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246030, "uuid": "20b0c709-bc5e-4833-8b4d-0f8af233b7cd", "value": "7328e8a14dba077e0aec26cdbe1edf288251fd12993644b30fc8d01e8b1f5aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3682725-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242974, "uuid": "66146e2f-65d5-42b9-96d6-cea48b796efb", "comment": "Malware payload", "value": "37a8c06e50f7ef7a6c4cfbe83e9214dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242974, "uuid": "bba4520d-1b03-4073-b150-4ccfea7c242b", "comment": "Malware payload", "value": "7353de41ea358d0b9a6a9cacef2c05e087a8c3c021933132ffacf8f91e2b4c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242974, "uuid": "c34a15b2-dd7d-472a-8344-a595f2aa338d", "comment": "Malware payload", "value": "a44cad9ece35e927730b8435ee50737ae05a669f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242974, "uuid": "07aa77c4-016d-4ef9-9c83-bde5a4c0a162", "comment": "Malware payload", "value": "a6898579c78fb4597c194cf232442d4d7ab45b6ddeb7c52171476532b7591a586082d39dd5cfcb961cd569e12817d6f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242974, "uuid": "e96304a8-3ae0-455f-8bc3-3d011b84d358", "value": "T1A625DF220E872F48E63E0F78C01A1859A7F0D6279297EB5FAFEC41B16BA7B40CD17455", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242974, "uuid": "556960b9-31de-4fb6-b041-f0b3fbde88f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242974, "uuid": "0d9ab38b-7c73-4f98-b6f9-1e4ee0e24939", "value": "24576:HOjRWOEF4Am1UB2TKf+6uVgBYddwAKoGXaqsO:9422TE+DVgBYddKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242974, "uuid": "5584f66c-5401-4ad3-ab8b-4f0eb663c059", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242974, "uuid": "e0836ea3-2199-4215-b1b6-aa7c8753ee7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242974, "uuid": "d6e9f5d9-591a-485e-9cf0-bdcaf85efe68", "value": "7353de41ea358d0b9a6a9cacef2c05e087a8c3c021933132ffacf8f91e2b4c69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8667b101-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244213, "uuid": "8e44d14c-d7a0-4b0f-8b64-8d7b0e67115b", "comment": "Malware payload", "value": "2cc2c76aa629801f14c1e797f8a82729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244213, "uuid": "6818f625-e73f-4225-b820-1c562436b998", "comment": "Malware payload", "value": "739695de8e56142d75622bc607610fa6a3346bc3ffa5d0b0799ff7437f1e9b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244213, "uuid": "d59687ce-21dc-4f76-8038-92fbe79eab7b", "comment": "Malware payload", "value": "424a59c3a2797c7378fb3dac7501568dcd54b6d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244213, "uuid": "15c6cef7-00f7-43d5-8f1c-933254b719f6", "comment": "Malware payload", "value": "dd7930be3c10052c9a7c1f9adfcbc3a8f864e65324b05f77a7a42f7c254043ce58c9e88fa2a71ffb3e0748b7250d3fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244213, "uuid": "e6e1dfd5-9639-4156-9e94-b4646b690b82", "value": "T1728502A8EE44A645DC4146FA1A10C37187BA4C6FA624D1029DF9F8E7B837B0377317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244213, "uuid": "7c448003-3084-41e6-a9d2-7717b0658012", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244213, "uuid": "4b2b73c8-50cc-4223-87d0-28b0ea7afac7", "value": "49152:8vj7YpGD6+yI0CryAjKIPNX+tGFX2xdUIMIyN:8v5OA1BPNXo3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244213, "uuid": "d8a2a2b6-31e2-4cb6-8967-5c061251ca20", "value": 1734152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244213, "uuid": "6be1d522-ffea-4a53-9de8-ff67d9854a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244213, "uuid": "0e3aa9f2-921c-445c-95c2-cdc02be55ed4", "value": "739695de8e56142d75622bc607610fa6a3346bc3ffa5d0b0799ff7437f1e9b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebde4fa8-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1778243525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243525, "uuid": "b9a09cc4-f74f-4743-b18a-74925000d9eb", "comment": "Malware payload (RedLineStealer)", "value": "3cb297e191cc064a4bca8f37bf2f17bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243525, "uuid": "616df6ff-f489-4d8d-86bf-8915620d1fad", "comment": "Malware payload (RedLineStealer)", "value": "739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243525, "uuid": "54238b9c-7bb0-4e2f-8d91-e0a9c9ba0363", "comment": "Malware payload (RedLineStealer)", "value": "b1f6f9ef0a6709ff783f91dbd2530aca1b4fb21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243525, "uuid": "f4ff10c6-a605-4605-9489-ad8d731d7729", "comment": "Malware payload (RedLineStealer)", "value": "201b3d3061d568a89eaa2c045adae6f5c033a68a00c256a7b080c1f066882fc9f6105ba6edf3ea7f300f56434c784a2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243525, "uuid": "fe27d19e-918f-4fdc-a4c6-25bcbcea07ee", "value": "T100071256A78022F8D06AD23999E2C139D7337C5113218A8F4FECFD599F376A04E3A716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243525, "uuid": "724c26c1-dd0f-4491-9bbf-c25cc162239c", "value": "5175da4b99d292f751a152b8e78310d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243525, "uuid": "499d7e1a-918f-4947-8779-6cd6cfed8b2c", "value": "393216:Y5Wjr1Fdq1B7wgZHsoqEbpibzoTGTqb0wemWMlvhnu:s21Fg1Jnlbpp6Tq4wemW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243525, "uuid": "86f1ef53-fc48-45b3-ac18-28b1a310b74f", "value": 16946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243525, "uuid": "abe276ef-ae0d-47f1-83b8-e7bd836c5c6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243525, "uuid": "f3822b1b-8b37-485d-901a-0f76a8f677c6", "value": "739929896c3af40e66be5d76b499066b72bb5cd19c34e6e0b220e01d1216266f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13d69da-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243077, "uuid": "942dcbc7-44ec-44ac-a8e8-2e066e4200de", "comment": "Malware payload (Formbook)", "value": "a505cc48c5620f55e0b2bf52fb0eae33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243077, "uuid": "ffde2490-8e2e-41cf-b442-66bec68373bb", "comment": "Malware payload (Formbook)", "value": "73f67234b1d2315ce7cbcbadb5f6e3a5e7a92e6441d4ae7c321a5266f0ece801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243077, "uuid": "764a1d2b-59bb-4297-90c5-549ef1164205", "comment": "Malware payload (Formbook)", "value": "b0ddce91635a1da5a820a12f51d2584a946da9fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243077, "uuid": "ac49192c-2875-485d-82ac-809fe37e5442", "comment": "Malware payload (Formbook)", "value": "83fba8ec0e58efb2c11dc58fb4926163bf1b07e23ac4df1829724a0664186729ef78b711d3747a79d3b7b31768c26593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243077, "uuid": "4f383d95-874a-4f0c-8fbc-c03b4aad8664", "value": "T143450254231ADA02D5C22FB41D71D3B453B89E99A422D303DFEABEDBFD3D3526448292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243077, "uuid": "4cdbe232-697f-42d1-ac44-a0f127e39b22", "value": "24576:fSJJSHwWsTXN92x0xWnWNbhIS80DyGKe83pEcQq7:fqUwd9gGxWeISpxKVZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243077, "uuid": "6cbe6768-b381-425a-a906-718f667ed310", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243077, "uuid": "0173ef19-a914-4f1a-b2a3-49b499eaa21d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243077, "uuid": "70b05cb5-ecec-49cf-a452-0e6445682415", "value": "73f67234b1d2315ce7cbcbadb5f6e3a5e7a92e6441d4ae7c321a5266f0ece801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3bc8e1-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242671, "uuid": "ee908171-ea00-4048-8848-04ed2408c4d8", "comment": "Malware payload", "value": "ddafa5d21d368ae3770b2aaee89a6fc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242671, "uuid": "827de5d8-6f2c-4d94-9998-3259537f8ddf", "comment": "Malware payload", "value": "740d8d5fcaf29c188f656d793f4b46c31e0165c7c7cd42f87dc2a8fdeceb71cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242671, "uuid": "bd01dbf5-c594-4995-9b62-dc560a001590", "comment": "Malware payload", "value": "6c4f10697ed2dc2cdeda068ce3cd0d90cb95e6a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242671, "uuid": "7547d714-a9c4-4ae4-a540-a6d85fdb260c", "comment": "Malware payload", "value": "00b01b7994158df22ea70f0bd75e0968b6e9c6c24ad4490f6aeac70e6123a93d12176cb257edb16fe865d125adff43cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242671, "uuid": "f1a77d23-2da5-4160-9877-5181472ac991", "value": "T139C43F12EA61A02FF0938DB07979968A7D192D361680EC57F7811FA930749ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242671, "uuid": "7749ad87-0d96-49aa-bf2e-e36780d15acb", "value": "a653bf8cdc9a8cd55b7efc01e74f7c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242671, "uuid": "6c2ac8b7-1a6a-402d-bc90-0716bed5c331", "value": "12288:xX++3MaW8TpE/6b5xwTOmZg75zJprLgvHW0:B88TpbVcC/L4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242671, "uuid": "a5323a39-76c8-464c-ba40-a6b6dc48c69d", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242671, "uuid": "0fe04c4f-fdf4-4476-ab02-2fb75f223684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242671, "uuid": "09c35851-fbc9-40bc-a04a-0dbdf448d22f", "value": "740d8d5fcaf29c188f656d793f4b46c31e0165c7c7cd42f87dc2a8fdeceb71cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d00b53e-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246748, "uuid": "7902790e-9b08-4619-ba97-437cc1703b03", "comment": "Malware payload (XWorm)", "value": "b454511331112a2fd22cf24180202695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246748, "uuid": "61365897-5a61-4388-9318-57f198780d31", "comment": "Malware payload (XWorm)", "value": "7437146516474588bff5c4572fa549c95405cb5467116567e14472ab436063b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246748, "uuid": "4fc108e2-8003-49e7-82e1-938ad12945ab", "comment": "Malware payload (XWorm)", "value": "84d0330473c94a5a36f991fc423c885deae73b84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246748, "uuid": "b0e3228b-d2d1-4180-8dc1-b20dca7ba0f3", "comment": "Malware payload (XWorm)", "value": "e92bb1cd9d62a64510862d0314fbfa6f3278996a5005f80f293c3de76338c69310f89994e364bb08a98cb235a60bd114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246748, "uuid": "4a54c627-1740-4e6e-82a6-157480aede4e", "value": "T19B2502442194CB12C0698FF94671E27163BD1D9EA462C74ADFF96CEB3DA2F040E29793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246748, "uuid": "244500e5-8326-4076-b0ff-9c2a5fd8327d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246748, "uuid": "4bb483de-6635-4c48-90c6-8f2c6d62b55e", "value": "24576:KrnNG/nx0VS0Vb0VcE0VuRmjcQpjHwQpk/HMT1XddE2//9:KrnNG/nWVdV4VaVBjcQfpkkhjz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246748, "uuid": "5d87c3c8-7811-409d-850f-831f34fcf08a", "value": 1029120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246748, "uuid": "5b32c659-590f-4e48-bae9-d0fd7a7f54cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246748, "uuid": "be4bf4f0-b150-4289-89f1-a48c53609600", "value": "7437146516474588bff5c4572fa549c95405cb5467116567e14472ab436063b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9afd2d-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243927, "uuid": "7a08239a-3c8b-4726-8734-a1473c0ecded", "comment": "Malware payload", "value": "a118185fa98992eb2a96bedd0e82fce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243927, "uuid": "8aae6385-3b11-409b-888c-6508d73ce54c", "comment": "Malware payload", "value": "749456f8911bbdcaf4e49703b29c5c1b19474d199e0948c3bc02cdb59e4d0f40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243927, "uuid": "b66abf46-73f2-4827-a57a-6d61ed98f73c", "comment": "Malware payload", "value": "98f649da04d7478a382e14e4c13fa918d32645dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243927, "uuid": "7a7ae86c-5641-4561-9b26-10bb1e070e71", "comment": "Malware payload", "value": "babaf054824d02adbeb2e80b77326772f25bbf1f2242aace70ea8d04feb250da81c3865a8a7d2774b7d691411c1f7982", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243927, "uuid": "9ff0c197-a042-404d-b547-536b9d64cc5d", "value": "T1F44501513A1FEA92F89D4F341966FA7907223ED9B400C2069ED4BEDBBBF2B513415312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243927, "uuid": "fcfdc002-9742-492c-af44-9a745853de81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243927, "uuid": "f7be1e83-1dd6-4f48-b91c-df77c8e94157", "value": "24576:aYm8+v9bA6TiJ24e/J3p910i0rcSMyfzs+9M3RIQk35:jEvVnStwr10i0rcSM463RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243927, "uuid": "2afb05cc-0f16-4f2d-b37c-6de0122c19db", "value": 1213440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243927, "uuid": "fdc394fe-874b-4178-977d-b7e90a3d4330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243927, "uuid": "5066ab6f-ef90-4b46-859c-3b6931a28bd5", "value": "749456f8911bbdcaf4e49703b29c5c1b19474d199e0948c3bc02cdb59e4d0f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed0d8e0-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778242993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242993, "uuid": "a3da6775-677e-4e25-8abc-ee6f2d85d0e8", "comment": "Malware payload (RemcosRAT)", "value": "1eda3c085ad60fba4466add7d5f06e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242993, "uuid": "dd7dbced-0cb1-4ee5-8ab7-143d06f06ddf", "comment": "Malware payload (RemcosRAT)", "value": "7573bdc1bae362ef4433202bfc26696fc16241e2bd3f4f3e14694a7ed70c5e93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242993, "uuid": "f6373686-8032-44fb-a7ef-c6c11857269f", "comment": "Malware payload (RemcosRAT)", "value": "baeefea3c3d86f8cb3c4461ddb7595e4006bd3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242993, "uuid": "c9083332-788d-45b6-818b-30eb9705e596", "comment": "Malware payload (RemcosRAT)", "value": "f206c63b6d719c148d74fa1fa150a618e5ac7a5e26079f22f1cbc923f041373e8ca6951d6154b4717e940361cb4679a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242993, "uuid": "a36f1859-bbfb-46d1-b5c0-ba8d402605dd", "value": "T1C4F4B03EBF049F11C47566FDA484E65142058DA283238866D0FAFEB5EDF628E1CD4E6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242993, "uuid": "0655c39a-7207-4119-ba6f-d4a63f3ac857", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242993, "uuid": "e895baed-e5b3-486d-baa3-bc7b0d4f4ebf", "value": "12288:iMyOp27k95GMiEmDXgLcrTwB7aUsjUh/dWffVZr5fSApX1uaXax:wf7k95h0rlrTwB2Yqft5pxXax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242993, "uuid": "7a1f4bae-923c-45e0-b147-79e54a2d3122", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242993, "uuid": "5e0fa7d3-2904-4918-be97-4a93bfa17f7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242993, "uuid": "7a676bc9-a238-4f6d-b2aa-45a046fd3422", "value": "7573bdc1bae362ef4433202bfc26696fc16241e2bd3f4f3e14694a7ed70c5e93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77c74f7-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778243839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243839, "uuid": "01008f0b-62f2-4bee-9ba5-779edc010c8b", "comment": "Malware payload (a310Logger)", "value": "4df1e781c8cf286e57ff4863441ac5a8", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243839, "uuid": "90857fc8-8011-41ac-bd6b-17da877087b8", "comment": "Malware payload (a310Logger)", "value": "75878f84273257f75cc04ca71e339348f20d9e1add05cfde2d0667232285f40b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243839, "uuid": "254f4bf0-182a-4790-87c1-5dfe3525b31c", "comment": "Malware payload (a310Logger)", "value": "ab66e8663dc080c6803345bdec597168da681397", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243839, "uuid": "bcf0589f-c68a-45ae-8e31-e3c41254801c", "comment": "Malware payload (a310Logger)", "value": "9d7884f9396a7d1265f579d025905fd940cfb2f067fc3f387ad5c4611df66d5468b7514d07c35ebfb45eb75613c25b4e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243839, "uuid": "a57d38a3-b5dd-4d7a-943b-aa13a756202f", "value": "T123944A13EB60A01EF1A3C9B0B9B5925A68267D351B98EC4BF3409F1A35715D3ACB131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243839, "uuid": "1b5bcb77-cee5-42f0-8b99-b35c701e828c", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243839, "uuid": "8f1a387f-a505-4316-8962-0d4dd3a4de61", "value": "6144:r8d1/w5KA81IJ8GpF6nuTmOOUiBUrjx0ueIO6tdm4+6tWFgKQuHgyfJPs9OX:wjYKkJj6GmZUiqrd0ueI5Q6klgyfJP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243839, "uuid": "b09bbd2d-0d37-4f47-9891-061899e03882", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243839, "uuid": "dbea712b-49ab-488e-93f4-ab2e1878ac1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243839, "uuid": "e853c957-6d6c-47ee-aef7-1f2267033a8a", "value": "75878f84273257f75cc04ca71e339348f20d9e1add05cfde2d0667232285f40b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37507280-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1778236350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236350, "uuid": "42f59539-189f-4900-911c-2a4c3b0d5f2c", "comment": "Malware payload (PureCrypter)", "value": "70d11c925f8933b372eac38936252f84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236350, "uuid": "c3434a07-9e9f-4d9a-98cc-8547aaeea41b", "comment": "Malware payload (PureCrypter)", "value": "76310c2b5ba91a2a728c81063e0b1ef3745f8d7f30f5f042800ab512d4296fba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236350, "uuid": "e8e97d2e-8e22-426c-a3c2-74164f31854f", "comment": "Malware payload (PureCrypter)", "value": "b2ee9b8a18c4163e7fed9c7f5b49fed94d5f6dca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236350, "uuid": "d7e9e557-a9b4-4e49-a1d4-e145d2c75828", "comment": "Malware payload (PureCrypter)", "value": "421595f0964ea0f0fe614b47cf71bafe697a255a38d8e29b70aebe885c860065587aad2ae5bfce2a0835db54f38d8e1c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236350, "uuid": "535a5eb3-3af4-4c37-85a3-895825e95a5c", "value": "T158038B06619FDB0860B256894AAF13754B9F769F1FBF40D90489EEC94FD34128C8B7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236350, "uuid": "f803eb6c-ac03-4cbc-a830-3a123e52656e", "value": "384:h2B18KRRCUopoYm6HqqriWr7a5MZsUxZ7JWDWb0cmmfLS:h2B1diUopTHG9fMiWb0cmmfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236350, "uuid": "6b3e2369-b0a4-419f-8979-3e1c449ffb2a", "value": 41034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236350, "uuid": "d9b02304-9b85-4b00-8425-e14a9b2c08b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236350, "uuid": "c9585aba-1a66-4d44-91b3-c92819838b86", "value": "YG02188821778802422-34012.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc73b2fe-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243901, "uuid": "8a35e1e9-5675-4054-a47a-aba684e1661c", "comment": "Malware payload (Formbook)", "value": "cd87c1000a41763ca7142257287421e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243901, "uuid": "29c67f25-2c5e-4f93-8cca-22a8646b793a", "comment": "Malware payload (Formbook)", "value": "76458a978c4078953d84869b770c0392022fbc54af5dad73e3cef6aa013611dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243901, "uuid": "485bcaaa-c9aa-4d42-ac77-90aa0051ad1b", "comment": "Malware payload (Formbook)", "value": "83fcc992022057b09975fb9d41a944e6afe76582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243901, "uuid": "96bba8d6-ad15-404f-a368-29170eb86457", "comment": "Malware payload (Formbook)", "value": "ccb08af5d353570fcdf13928c5943350c9c5b494004bc2d86f18312241049597d10b70d161e16625f03a1d6f267fd8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243901, "uuid": "d020c98b-dc8c-487d-9b13-a5c2c0b08795", "value": "T1C4559D91604FE482F45A0FB15EA9F53055A97EECB4A0820D2DD5BA5BB2F3342301EF5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243901, "uuid": "4d0e50d3-22d8-4065-aec9-8c264ad1220d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243901, "uuid": "ca23ee8e-62b9-4dfb-879f-4153f598892d", "value": "24576:mYX8+v9yxHcsobNf/Up/KsJxOdoF0mbRaWD:PJvw8/bNn0KdoQWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243901, "uuid": "5a2b3ca0-dc76-4a60-a417-f9545a3a404c", "value": 1356808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243901, "uuid": "c4618592-da54-4765-9337-202a8b315281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243901, "uuid": "4935f73b-9e58-4a09-808e-8dc674acf408", "value": "76458a978c4078953d84869b770c0392022fbc54af5dad73e3cef6aa013611dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af9b8d9-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246207, "uuid": "507cbdc1-8943-47e6-8187-9dd3d08df733", "comment": "Malware payload", "value": "32e3d3023d9f1406e8e81d83392d01be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246207, "uuid": "39a550c2-ea95-4632-b857-f9d7e7c9ccb3", "comment": "Malware payload", "value": "775ea21f938b349b83c807ba0ec290e2fa4341242d6ac5fe9e7003754e44d857", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246207, "uuid": "e63178f4-17b4-45d9-8121-78a57ea1cde2", "comment": "Malware payload", "value": "603aabe539faefd91c421c900c110f6e9aa23a64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246207, "uuid": "40fb5bf8-95fa-4eba-b004-4b1911431f85", "comment": "Malware payload", "value": "f59abad515a83a710165194a12888ff4959ef15322450519fe8603720e84aafb1f375cbb799f54675e1b20c93a4cbb5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246207, "uuid": "9f1fd652-7608-4844-b2ea-3b68a77b8afd", "value": "T159735C1AA34368ECD61BC5B486EF6733BA72F8A61630DF3F5754DA301D14E902F2A524", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246207, "uuid": "e6313876-c871-49a0-9bea-687c02f268a1", "value": "804f215ec136a2d8766a73e605481db0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246207, "uuid": "558f828c-cb7c-41ec-a5e8-d3d75739fe6d", "value": "1536:6lcEojXj6X/gk78cVlAqEvNhkiklGghTm4:6lcEoaPFvVe/NhkiklXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246207, "uuid": "4d9b88ae-2247-41df-8349-d8f030c58d92", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246207, "uuid": "742ecdc1-8fd1-4d3a-aeee-8bca07448687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246207, "uuid": "29c0b67d-2a22-462e-b382-456909d4bf32", "value": "985d90e2067b0db89cbe55c067e961318989b0db0d0f930fd102e625cf62383b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d62cc2-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246469, "uuid": "70daa458-de26-459f-90bc-c84a94e919ad", "comment": "Malware payload", "value": "a28fe2dcd463e9001d335ac0d01afaa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246469, "uuid": "6eb8bee7-0456-456f-a86d-276173179dce", "comment": "Malware payload", "value": "77a5ddc799c47808d1d093b102338be15d541693908f7819e2ba3f03b1ee4cb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246469, "uuid": "31893f98-d0b8-493c-95ec-4d0e888e5d5c", "comment": "Malware payload", "value": "db1d5e078dca7f1b19a2ef96ada0c7dab266d95a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246469, "uuid": "36d02e63-b9e6-4f6f-a459-9227249dcbd9", "comment": "Malware payload", "value": "51f55b656fff7dc8188832eb241d6e677aea08a47f123405360930a3a060083a530884a6523147eab5be9b19e4b2b3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246469, "uuid": "ee217e6b-cfec-4103-a0eb-bff84caedcfd", "value": "T1D2B5F1990B8EC6F8D32BECB486C79C4BDBD5C21E172DD6859B637DA52022C6CF0B5484", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246469, "uuid": "3d9589d6-fdfb-4c00-9a52-1ebf2a75d8bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246469, "uuid": "76de7c85-d07f-4bfc-97f9-5818c94fefc5", "value": "24576:mOY1t1aTtDCR8aRvjV/7zen0B9woGXF+2DpvI+i:moaR7denwwvokN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246469, "uuid": "0ae534de-f142-44c1-a764-5f7bc33af483", "value": 2484224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246469, "uuid": "76ba7b64-f3d4-4f44-8731-fdb716cbbb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246469, "uuid": "eb2074ae-3060-45ac-a776-95247883cdab", "value": "77a5ddc799c47808d1d093b102338be15d541693908f7819e2ba3f03b1ee4cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2585872-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246488, "uuid": "1a79cb66-bf5b-4dc6-8fff-47e6ca71ba6c", "comment": "Malware payload (PhantomStealer)", "value": "d5bd123b5ef39e6dcb3794cac9b57087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246488, "uuid": "4a38ca47-32bf-4ffe-a06b-a7e71d87694e", "comment": "Malware payload (PhantomStealer)", "value": "780518662f014dcbe11772fa0640d9374c597566813af727758c5e01febd0beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246488, "uuid": "6715fa5f-3594-474a-a5e0-9997586ef302", "comment": "Malware payload (PhantomStealer)", "value": "a1694398adb24529e5aa13ae5a9dee20d6369afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246488, "uuid": "69eb5307-ee6d-4ce3-9826-3436ce6daff7", "comment": "Malware payload (PhantomStealer)", "value": "1304863f209a608cb3b83d716cb6e09bb8a28f7b4518078041a551caa832dd299489524560c2ddadcb3068cbe1cb076c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246488, "uuid": "922b9645-3dd6-4f68-a3ae-997b0fbaa279", "value": "T17775232922A8CF0AD43B67F40AA1D03057B91D59E520C64B2FC77EDBB83AF198B15717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246488, "uuid": "2959871a-cead-4138-870b-24d502275717", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246488, "uuid": "ef6e9ee0-6a92-4eb7-9e77-2ca90ca55a5a", "value": "24576:qXihjdqsms6sfVLlDrvhWek7AU/t6ZeAQHXj9uv1py/+/7Z0SYmbSNOhpZBO:qyhR1xBv8BAUl6oHXj9uTu+t49IvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246488, "uuid": "027f3170-fe6c-4b2d-a599-fcc1ac5dc341", "value": 1645568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246488, "uuid": "69592e26-90ce-42fc-80cb-a2fc8f83dba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246488, "uuid": "5235685e-7d8f-4fb0-91d1-25db136afd67", "value": "780518662f014dcbe11772fa0640d9374c597566813af727758c5e01febd0beb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf842b6f-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238726, "uuid": "d35e01a7-6b34-4d57-8f5d-97a64831ff82", "comment": "Malware payload (Mirai)", "value": "940b1dab889c917ec8b354428c593fe4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238726, "uuid": "3bad0d04-9b1e-424b-8743-57e748d9db51", "comment": "Malware payload (Mirai)", "value": "78669694bb85ac132bd9590543c8823c2cae86974c444ec05465ab3962b403a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238726, "uuid": "af23a9c3-4beb-40e7-a34a-3193d7c96faa", "comment": "Malware payload (Mirai)", "value": "dc9bbb0403d5237bc31a2329f1845f6fc9c554ad", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238726, "uuid": "78c7b9b6-74fa-4cb3-aa5d-b5cdbdfcf851", "comment": "Malware payload (Mirai)", "value": "17dfb6065cf0a587c5551cd1f0ff12297e591ee9dc37cfe2fc887fc9ce8410bd4a12ec55be2704121fe69dfd655a4e90", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238726, "uuid": "29457061-e664-4f2c-84d0-45248d00891e", "value": "T12463C71A6E219FEDF7A9863487B34E21A79833C62BD1D684D29CD6005F7034D741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238726, "uuid": "cc469560-00d8-4434-8bd9-dc688e39bb3d", "value": "768:7rp2peFqgTiMgZpvOd3hauUEa8jvWKQEoTh4/48qIgbJBSl6byoG5eLOmaYIjmyJ:BFFqxFz2jFoT2/44qBS/eXaYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238726, "uuid": "54583f6e-904f-427a-9e00-105631070b69", "value": 72520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238726, "uuid": "ea9f112f-57e2-48b9-983e-7076516c6c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238726, "uuid": "87ac26f5-4d87-4e39-a3f8-a28e4dcdea7b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c8a115-4a7e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1778204269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778204269, "uuid": "84eef9a7-8d4d-4edd-a43e-aad60f7c903f", "comment": "Malware payload (SnappyClient)", "value": "71ca3ab436e94af3e4552dabdc305b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778204269, "uuid": "79ba0b6b-e1fa-4b9f-934d-270faa002ef5", "comment": "Malware payload (SnappyClient)", "value": "78ae8945fa4604b14ea8e78243ffcd3a58724f467e0334eee25cc45576eeead4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778204269, "uuid": "7f2fc4b7-56c7-4f7f-bc6d-e9a44d97a112", "comment": "Malware payload (SnappyClient)", "value": "f804b2e7a1a052cd47eec62cb5378078236e3ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778204269, "uuid": "a4035d44-4b40-4f72-bde9-8b9a0cd000a1", "comment": "Malware payload (SnappyClient)", "value": "3cb85312efdef83c5a318795d3853794d6c0f76289b37f10aaeb99b1237ed2b880c467ca6b186f057772394095652ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778204269, "uuid": "ad38ca6c-d95b-46d7-a67d-4f273a55440a", "value": "T1BA86A40799B60991C078A274557F53227BFB38445B101FCB2E9AB3206ED3BE47AF526C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778204269, "uuid": "b962ffa3-ffe6-48c6-a0c2-625b80d96de3", "value": "e3247e89e12b2d28a61f9c8baf0fa5d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778204269, "uuid": "0972110e-9f62-459c-a062-f755914293af", "value": "49152:iSQFQLCJ+QS54SEvOjsZKfZDdn0IPl1QZEx4HGX8csekbiPiYPqx:iS0Ochzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778204269, "uuid": "fe42ece1-120c-4d93-a0f1-1f55de60e506", "value": 8051712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778204269, "uuid": "b45bfbc1-fd90-4f79-97f9-9bc32780c197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778204269, "uuid": "7c5ae2cb-45d1-482f-af49-ebffd95dd994", "value": "SecuriteInfo.com.FileRepMalware.18654683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f11edb-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1778244422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244422, "uuid": "127e6d65-5a87-459d-8a66-30d57f680e2c", "comment": "Malware payload (RustyStealer)", "value": "41df08d68f9cc43554b1067a1ca5cc86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244422, "uuid": "1ad409a0-04f8-4411-bfcd-a8547455e6a5", "comment": "Malware payload (RustyStealer)", "value": "78af1163cf88eda6e3d20c9bb023e2966a37141db5b906913aec2fbd72489c4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244422, "uuid": "98428ddf-53b0-4d0f-88f3-253594a7ad5b", "comment": "Malware payload (RustyStealer)", "value": "729bae474c196fba4cc7acfc7c7b101e62b594fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244422, "uuid": "92661bb8-1aec-48e0-ab25-0cb0c34189df", "comment": "Malware payload (RustyStealer)", "value": "e7bcc5e76174a2c5db4ae5753d173621c04fa21dad5116c48abec2d6af268b953bba408d7202688263420ab4c3cabae0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244422, "uuid": "ace01b4a-3a0d-466d-bfd0-66b317f8a601", "value": "T17C3612A197881FFEDAA9093440F5743ED3F02AF69556788B4FB33E092F97980063D949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244422, "uuid": "7da00d0d-d98f-4118-93ab-c710088f915c", "value": "25a99fd97b3f5be28f251855c10b8a6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244422, "uuid": "84ac1793-b4ff-4877-bece-7cd4db78ecef", "value": "49152:5f1uMuK8Xav1s7R51sdk4j8RphNWGc3ZizJlGfPWU6BKfvr:hBuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244422, "uuid": "349f3d09-f2fb-4af1-b094-1fd2a3c4474b", "value": 5268992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244422, "uuid": "fb74620c-6656-4c2b-8c57-9c88229ffa28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244422, "uuid": "78d73f12-860f-4fbb-9417-0ea4d900ffbe", "value": "78af1163cf88eda6e3d20c9bb023e2966a37141db5b906913aec2fbd72489c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1146eed2-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243587, "uuid": "a7676027-de8b-407f-b87d-8aae26a3de72", "comment": "Malware payload (AgentTesla)", "value": "0abe9f7519552c42e94a9c894a36197a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243587, "uuid": "16b9e7cc-78ac-4d1c-8488-12f5aa11b707", "comment": "Malware payload (AgentTesla)", "value": "790c53a59a8052ba22dd877b3ded8db7253726074ad0c32ce0c6e1b895a82960", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243587, "uuid": "bbf624e1-c99e-4859-9759-5d7fac3c0d7e", "comment": "Malware payload (AgentTesla)", "value": "55fd0313f2d746705e844a6a92267fb657cf2230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243587, "uuid": "734d284b-f85d-4003-81b9-9f749a4e3cd5", "comment": "Malware payload (AgentTesla)", "value": "512c0ab067006dde5ca68f10d05bfdd6a00ac83105a7570325a583f9811f25b361b17ecc243d15f3d34719d362da8327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243587, "uuid": "76556062-79c4-4129-a6ca-c8affe0c923c", "value": "T111652283362488CAE2B05A780E2CA51495B3BF787466934D35F73A6E91BD3235C3E771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243587, "uuid": "812a740e-64b9-4eac-86e0-c031fe0a967e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243587, "uuid": "df39864c-f2db-4839-95d1-af7ce1aaed4e", "value": "24576:sYXcwfAsUKXdVkBanrxBySzvoFyFzRIcis69BAiYY2wnzWU:FXcqAsUCdVwCrWSzvNFz+s6LAil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243587, "uuid": "cd105368-d570-43f7-af60-5a116f80a9a6", "value": 1548504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243587, "uuid": "0d5231a7-2777-4493-8ba5-d773bdcec219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243587, "uuid": "f2fb3b9e-2448-444d-8d13-0ab90740a001", "value": "790c53a59a8052ba22dd877b3ded8db7253726074ad0c32ce0c6e1b895a82960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "279750d7-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242766, "uuid": "cedb388c-8664-4513-8894-cfa11523d57e", "comment": "Malware payload (Formbook)", "value": "2e5a0465d113f20805215b5b4f5091bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242766, "uuid": "8ae03ceb-6100-4708-a1bd-31130d02a2c1", "comment": "Malware payload (Formbook)", "value": "79b1d72476c6d6525e17a5c409aca357b793a6d1f4c8fba23d3da19ca2efdb87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242766, "uuid": "e01c5456-36ea-4440-8de4-c64fc0d819c0", "comment": "Malware payload (Formbook)", "value": "f5810ae370f6164f54b56736a781ef3bde9c746d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242766, "uuid": "f48d5d9c-3d82-44bf-9836-3e3914ba8800", "comment": "Malware payload (Formbook)", "value": "24c1e072b467fd86dd4e2600b2158178b989ffc84a272565b34cd6cad66e40e8a34116991de24457f76717d236f79fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242766, "uuid": "4facc6e1-a8b4-41f7-9848-2328e5941467", "value": "T1723502442316ED02D4921FB45D70F7F85B784E99A812C3439FFABEEBB93E61628141D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242766, "uuid": "f47584e1-5029-4b9d-a6e9-19047d1ceb5b", "value": "24576:MwOASDN+lEL9OdnDrmSbfp3whA+VFoJrzTzOllNg5SHZx2RA:MwFSDN+lEL9ORDCSrOA8iJrzvOlKIcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242766, "uuid": "6449fce5-88f9-480f-86ef-e136c2eb9041", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242766, "uuid": "abaf55dd-13d1-46e0-b0e1-9f5438599f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242766, "uuid": "fe51f5a9-4313-4662-b9bd-87af66cd495e", "value": "79b1d72476c6d6525e17a5c409aca357b793a6d1f4c8fba23d3da19ca2efdb87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26a503f-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778244770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244770, "uuid": "046e3823-1ea6-477f-bb70-995b2eb13af6", "comment": "Malware payload (RemcosRAT)", "value": "105c52368adf756a46ad09a9419279a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244770, "uuid": "672467f6-796c-4b88-acc2-87d49c29bfb3", "comment": "Malware payload (RemcosRAT)", "value": "79dc630d09a49a3ecf5fb1a0e0e463aa3be31cdd133c8eb862b0c87308693b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244770, "uuid": "ca89dd61-8551-4ca7-bb6a-a34fad9c3f73", "comment": "Malware payload (RemcosRAT)", "value": "92d35fd87d41366a7b1c303a40dff8b5b1d09b43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244770, "uuid": "ba5357aa-e609-4d7a-8835-514519f04dca", "comment": "Malware payload (RemcosRAT)", "value": "274874068066149bed5f8d6589e568bc51e5d57b770df72dac538c9af98869d9acea67dfd64d0ec06a4d28a3af975a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244770, "uuid": "553863e1-3cf3-4f1c-9ac7-d15edb199ee7", "value": "T12FE4F1857B008B77C22953364FD787A56739EC609B929B2B3296F36E2F723515A033C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244770, "uuid": "bdb79855-1caa-406b-b3f3-3d38763abc0f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244770, "uuid": "ed156642-3279-46b9-8025-d7b3160ac6a5", "value": "12288:/XyWmdPEZJ7SyplVhNLi83ZQUaj+Xlkq/RcbwixX:/XrmdPud3VhAUQU4O/RZixX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244770, "uuid": "5562d0e7-a9d7-4ebb-a8da-ba3de61509e4", "value": 703312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244770, "uuid": "4b080363-6076-4779-86c2-4555696d6efc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244770, "uuid": "2076d5c7-9fe8-4deb-824e-a5d1323a7f06", "value": "79dc630d09a49a3ecf5fb1a0e0e463aa3be31cdd133c8eb862b0c87308693b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f7488-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244604, "uuid": "78250251-71f2-4fc4-827c-e75952da80d9", "comment": "Malware payload (Formbook)", "value": "c8734b93cd5f7365310c57efc303c07b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244604, "uuid": "cd3be431-9ccc-4a3f-bbf8-a9a3ca4fca6c", "comment": "Malware payload (Formbook)", "value": "79f378cc9ac9d2095b648d1cea21ce34b6a7bdadc5517a4833cf9b6cedb67107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244604, "uuid": "7a7c41f4-1fa2-429a-a471-355c583b4f55", "comment": "Malware payload (Formbook)", "value": "0d7150404bae911ef20f95998599d5ad97736db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244604, "uuid": "a0eee91c-4292-4328-bb2e-4bc3d19f3b72", "comment": "Malware payload (Formbook)", "value": "f9a196efd4a5836bea75ef244cee7bf24c1f1a92d063e9ba30903bdbbd886344b5a6ae8321d2c476d53bfd53b17f2b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244604, "uuid": "e6bfcf91-3d0f-459a-800b-046a9e0aa589", "value": "T16E45CF027381D062FF9B95334F5AF6115BBC6A260123E62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244604, "uuid": "f1572ea7-39d4-447a-986a-5550bc8327ea", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244604, "uuid": "60dd4b15-92da-423f-b3b3-f5370c31aa57", "value": "24576:E5EmXFtKaL4/oFe5T9yyXYfP1ijXdaDkm95V52/JBSoM3a7o:EPVt/LZeJbInQRaDZ9HshBSoMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244604, "uuid": "339fcdc6-6d55-4dae-85c3-fe4934cec41a", "value": 1225216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244604, "uuid": "5058f5ba-ecc5-488b-99a0-7d7380b83b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244604, "uuid": "562102a0-c918-4c17-bb64-eeea024dff0b", "value": "79f378cc9ac9d2095b648d1cea21ce34b6a7bdadc5517a4833cf9b6cedb67107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc60fb4-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778245700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245700, "uuid": "e03d7e42-d087-4cc2-ba7a-d30ad941c7a0", "comment": "Malware payload (a310Logger)", "value": "165a74b0611a244758f0b99653755fa3", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245700, "uuid": "cdca7988-fa88-4eb0-8e4f-c28dca4605c6", "comment": "Malware payload (a310Logger)", "value": "7b12f5aa202bd9266728fa119f98255eb945b430f070409a2fc06c2f0cc7feb4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245700, "uuid": "240ccab4-667c-4f3e-91f8-0cf14e339484", "comment": "Malware payload (a310Logger)", "value": "4a4ea2e948b14f929eaae5742d78db1c3b7951ed", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245700, "uuid": "91e9ee8a-7ced-418e-b5c1-c9a5d81696dd", "comment": "Malware payload (a310Logger)", "value": "dd45b7af6b2815009164dea507f69298291d8fe0b156ec3307ad588289f9eafc0ddf93ac8c56829277221110c88e3f11", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245700, "uuid": "e67b0520-a9b3-4e91-9104-43b3dd29f2dd", "value": "T1964522146769EA01D5762BF808B1E0B85378ADACE919D2039FDD7FDFB07A34141A43A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245700, "uuid": "c0619af4-eadf-4f6a-9831-fba910dc100b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245700, "uuid": "5ff8b80e-1c8f-446f-823a-2ff94e5f790b", "value": "24576:ZHf7kRuyBR3c8j3O0qNMt5aOjHfKfB7qpJtY6wBFX:pAFc8j3O0PE0CIpJy7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245700, "uuid": "e77ab993-270b-4270-bde4-c63c45700d90", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245700, "uuid": "f08b9985-a790-4e0a-91be-46412156d47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245700, "uuid": "41ab84a9-435e-4303-b683-530c92c0527a", "value": "7b12f5aa202bd9266728fa119f98255eb945b430f070409a2fc06c2f0cc7feb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba1bdb0-4b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271603, "uuid": "f0cd79c3-f742-4d38-849b-b138e0ef8335", "comment": "Malware payload", "value": "a23e7c137e843947ef18a51599e483e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271603, "uuid": "4f35ba89-ed42-4279-8fc4-491fabe9dbbe", "comment": "Malware payload", "value": "7b24ed49826e547722071540982623f39439b1cd0c4b649401a6701476c52ea5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271603, "uuid": "391535c4-b2da-486a-b737-dbd20514a32e", "comment": "Malware payload", "value": "57150f7f6fa5f89341aa966b7f80ab7adc0bfbda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271603, "uuid": "69280296-50ed-45ff-b969-96cd0afcc2ab", "comment": "Malware payload", "value": "d27f7e3d009270836f545685ea80488e323014f17b7d99bfe083c71e56c7732eff6558c1c638e380b6406c9802986512", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271603, "uuid": "da09e96c-6cee-448c-acb6-3f4557bc49b3", "value": "T107B3BED5656CC29EC62EFA3B15539153A571F8043FA539093BD1E0FA0F28D336386EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271603, "uuid": "a8811929-30cf-4683-a59e-d76d8226f7d9", "value": "1536:ew6qBVMQZB2orMD0QBqFeBcB65P6C4zUo2xLrJQt+gE4YUvDiua+DcD1OwMXqmHf:tPMSB3PFeB86kC4zUoQK7Vbiua0c7AP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271603, "uuid": "44e19af8-4da5-4dbb-b3f9-aa440edd49e2", "value": 118114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271603, "uuid": "3f646561-106f-4c54-8976-1f3bc3e2d39d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271603, "uuid": "3ff510de-30d2-43a8-ba44-b537ab9f44c9", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace80b44-4aa4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778220656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220656, "uuid": "abb68bc6-bcc8-44c9-b279-d452bb180c00", "comment": "Malware payload", "value": "0b68597f1aa0caed969139a11b5800c6", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220656, "uuid": "ac42f35d-281d-4a73-ae54-c4ee16b634f8", "comment": "Malware payload", "value": "7b41036cef1848abfd9b6ef786f8e3a383f450243cd4fca7456141335120d5f6", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220656, "uuid": "1bc60d5f-b96c-432d-a17d-a2685d4d574a", "comment": "Malware payload", "value": "83c68ff3fdfb5b2450f234b3087e329c26696ff0", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220656, "uuid": "ae4f04f0-e9ee-4b80-8f40-21e609789e38", "comment": "Malware payload", "value": "ce7e7c67b6d69f7159cddbb6cd091e16811e3b9eedd92f87453c8db4e9c789de1d4de6a223c03592d439b6a8b8e27e7a", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220656, "uuid": "2d2b1ac2-2069-4010-98d9-1d2661d7fc91", "value": "T1E4A34B1427B89A8AD16DD3B985F2570393F4E047AB33D74B0BE1439A2D37F808D86766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220656, "uuid": "482905f4-7b16-49bb-bce0-7670dbcd2105", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220656, "uuid": "d9fde172-24ab-4fad-aaf3-a886fd4808e1", "value": "3072:dpEGwCY8sUtttttttttttftxvQcqe1Ncb1epgT1/zbS:XY8btttttttttttft6z4Ncb1epgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778220656, "uuid": "12c6476e-fe0f-42a1-bf72-2fdd6393c4cb", "value": 107008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778220656, "uuid": "ec15fa5c-23a6-489d-a4eb-e3d6fe6bed74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220656, "uuid": "30e471e8-6eb5-4672-8cf0-63acd14f9ea2", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1573f8-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243550, "uuid": "fbb4d25a-0584-414f-a240-d1a748389071", "comment": "Malware payload (Formbook)", "value": "461d0519d813621c186eb69fe492ceff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243550, "uuid": "82431896-1249-43ea-99bb-e7e051464611", "comment": "Malware payload (Formbook)", "value": "7b5d931b02a09ec9c43bd7afce2a45e5e772b4551df2727b18abf109ae0bcebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243550, "uuid": "1da610fc-2eee-4575-adca-8188a57c00ab", "comment": "Malware payload (Formbook)", "value": "53a4454d36e4df1544adf6eb1ae57d846456ca16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243550, "uuid": "2072eb62-ed1d-4e5e-9c6d-8402526a00b1", "comment": "Malware payload (Formbook)", "value": "36e7b740c16c7ba58f8a7805a39c141bec21f0ea8cab03c4530acd9389048828b4a0ea25fbfdd9624d7698b84174d173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243550, "uuid": "b1dbec4d-84ee-490f-adfc-547711699348", "value": "T18545CF027381D062FF9B91734F56F6215BBCAA260123E61F13981DB9BE705B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243550, "uuid": "9a59a87a-d243-47ac-b966-0dfd9268b267", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243550, "uuid": "7d92485c-4118-4ad1-8d2d-08fde02c3884", "value": "24576:z5EmXFtKaL4/oFe5T9yyXYfP1ijXda+LrX+ZYlPyNV:zPVt/LZeJbInQRa+LI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243550, "uuid": "46b0bdef-422a-43c1-83c9-3b086885e1c4", "value": 1218560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243550, "uuid": "32e23608-ca8b-4732-9055-80c162bd2979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243550, "uuid": "2e4574c0-107c-4293-bc89-369fca343135", "value": "7b5d931b02a09ec9c43bd7afce2a45e5e772b4551df2727b18abf109ae0bcebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb76fba-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246264, "uuid": "23d53c45-94c8-4a8e-891f-7b039215f815", "comment": "Malware payload (RemcosRAT)", "value": "705e4ea825f0ab6b6ec8c154ff5749d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246264, "uuid": "fc9982e8-1230-4fbd-9f06-39d666db51fc", "comment": "Malware payload (RemcosRAT)", "value": "7bfda1988acd3ace4449a128f735576a1b4364c473751880b0e0b8453183d438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246264, "uuid": "82afb1ec-9841-4e14-8980-a4adec154e73", "comment": "Malware payload (RemcosRAT)", "value": "a7ccde8fd2fe62a8761b7fa20823e07286f59c97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246264, "uuid": "57dccbdc-15d3-4e85-baec-5a6df1b5844f", "comment": "Malware payload (RemcosRAT)", "value": "9fcea93403851324575363a179b84994de332506a23ee30e5fa855482ce3cbc80f2117f619beb78b6e33550509638d3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246264, "uuid": "3c59e10b-08a8-4255-b318-424855838a4f", "value": "T1D5F45B517674E7AEE6760639B4CAC36D6454BC30AD06038FF1B03EA947B2EAC5F82351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246264, "uuid": "20520574-e1cd-4185-b1c7-124e09030d1f", "value": "0293eec0b5432ad092f24065016203b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246264, "uuid": "4d867067-420e-4a19-8e78-a2ab3885ef22", "value": "12288:/SW9MrpT34uxqhxw3LsAkiR0O+N/yWCAyH5zkn9GJ:/SW9MrpT3kbw3LjkyLa/kbAnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246264, "uuid": "6c7ccb6f-d642-4b97-abdb-83a7403e8a7c", "value": 743808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246264, "uuid": "fbb18f55-f572-489f-8036-4fd72d56f455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246264, "uuid": "c7eef93e-da79-4a7d-aaf5-a803759a7775", "value": "7bfda1988acd3ace4449a128f735576a1b4364c473751880b0e0b8453183d438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b71eeea-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281024, "uuid": "28998242-a43a-4c9c-aca8-19adb5f134fa", "comment": "Malware payload (Mirai)", "value": "56e556805c74d7b8ae5b86390a66e13a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281024, "uuid": "27a6d2f2-ce31-4cb7-bf40-1625a7115d42", "comment": "Malware payload (Mirai)", "value": "7d1e6e09f321a76ed6525368f44d41836243e176db4207bec51a422e7c4f544e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281024, "uuid": "cb98306f-5391-4811-b0c8-ba10b6acc570", "comment": "Malware payload (Mirai)", "value": "ac28ad91056b7e35c1519570cbb3681a334a1c83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281024, "uuid": "623a5d65-2ea6-466e-9226-745126f9a3d4", "comment": "Malware payload (Mirai)", "value": "095247b6b648f2eaae569075e3834e3d9292914e8551006d5ee2cbebfb1ff3192ab9a50cd1fefe3e497061a4c175799a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281024, "uuid": "c2479a6c-d08c-4e62-8274-ce255921e543", "value": "T180D30816FB210EFBDCABCD374AE91705258C651A22AE7F367934C928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281024, "uuid": "d92ae1f0-8398-4f4f-92ca-40809c27d25a", "value": "3072:NXj17Jo82I/GFSiPep063ec51hER2jPrCz:NXFLOPX8zxERWmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281024, "uuid": "9742895e-3c1f-4de2-86fa-1445efad8316", "value": 141604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281024, "uuid": "0d6d717b-e79e-45f6-b202-2b9f4ec0aaa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281024, "uuid": "c62dfa5b-0e3d-46ff-ab0c-c75a7e05dcc1", "value": "nerv.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe309ead-4b06-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1778262883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262883, "uuid": "049c0d22-f868-4432-be91-f5919e9fc1af", "comment": "Malware payload (RustyStealer)", "value": "36f738a44864daa09018e4fa03df326b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262883, "uuid": "30c9946c-599a-4858-bc91-5a1789563a93", "comment": "Malware payload (RustyStealer)", "value": "7d9426b2c8bf57841a6485d1885c87721ce62a75c0e9bb86f157438145c2ca18", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262883, "uuid": "723a96c4-6277-4667-9519-4d0aa62df6d2", "comment": "Malware payload (RustyStealer)", "value": "b29b51ff94087db36693e0a5a6731b8f80b7c535", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262883, "uuid": "7538137c-2b8e-4c11-b23e-58d29a12dfdc", "comment": "Malware payload (RustyStealer)", "value": "42a76a742dec5a0ac0308dac17a01c4feea06bd3c039e15e29ef8aa9e4263ac9354fefcb2cea1283f0d0c7653c1f42d9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262883, "uuid": "68bbcb1d-67c4-4c8a-a203-8ac3eebbf76c", "value": "T1C142F619B7D8C62DE4BE877C0CB357D10AB4FA02A821CF4F5CE42A5E1C76744CA52BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262883, "uuid": "1a7c0bad-6ead-48a1-bd96-4a1812937358", "value": "192:J0Q901kolmNDGHK64qVaOH/a2HsRkx79DXbh5t:J0Q90ColsS4qVrH/a2Hx79Drh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778262883, "uuid": "e617fd8e-6db7-45e3-bb5b-77f1f3addb0c", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778262883, "uuid": "4271665d-b2f5-4126-bd0a-b806266269f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262883, "uuid": "e1f38ccc-53ca-4572-9e04-d1eb5a8221be", "value": "WinSpoolDiag.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f70b9c1-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233437, "uuid": "2e4b44f6-06da-4f78-bb4f-f7d5815ab52a", "comment": "Malware payload", "value": "658f7bb49be0fb6f84dc7987ba8c74b9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233437, "uuid": "2d28ea4f-dc61-4836-8de5-e7662d680af9", "comment": "Malware payload", "value": "7e631e9f7791f4648f776419c020ce6c33071c3e195669dd473f1423f098d39d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233437, "uuid": "8e1745a0-4a60-467d-bd6c-326c6808567d", "comment": "Malware payload", "value": "54d6b43cba7ef2f0884684a59802f51f635adb3e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233437, "uuid": "bb459260-746e-4dde-b7d6-0a204667ceeb", "comment": "Malware payload", "value": "edf88662ca696669816d2d636c34b97f278d0b116b8afe1aa2c26ebd4867b75f383a0b36fb181bde6a5c9d2f92006b42", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "axis", "colour": "#820AA0", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233437, "uuid": "53fdeb0e-6d35-4f73-941a-2bc5d210c915", "value": "T1F007CD23F5056996CED6A135F5E357A132341E480793A22D271FF026FEF21CEC666AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233437, "uuid": "557b1d04-e4e5-4d03-b2d2-45f4ab9e735d", "value": "196608:Aka6brPO6fIL3ZkUClBpXPwdCVcA80QH/0fmgZqvwmrn5u8JpQqRnl54+hrFMhnk:na6brPzfHljfwdCVM0ATHj5zpZnz72OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233437, "uuid": "68511e91-56c3-44fd-965d-051744664cf4", "value": 17757769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233437, "uuid": "fa659c61-b882-4a20-bce2-23d97dc5e2cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233437, "uuid": "98920fb8-cb24-4ce2-a67f-72450a170e92", "value": "Axis Mobile (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccd477a-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243499, "uuid": "6bafb32f-6c84-4929-8872-6770a97450fa", "comment": "Malware payload (AsyncRAT)", "value": "934d99395f2d7bf831aec13618d332fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243499, "uuid": "5f1abe8a-6970-4856-99b8-9bed57732c99", "comment": "Malware payload (AsyncRAT)", "value": "7e6683cd7621fc823d9c034c99526c914221f2a28a5571ccbfb8ea10069e8b41", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243499, "uuid": "7b06f429-bbe9-4d8b-85be-5702bd34041f", "comment": "Malware payload (AsyncRAT)", "value": "64dba30a0f26e9cfc9ebe1c0ac7308f1eeaac87a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243499, "uuid": "1971f5ad-3f64-45f7-8efc-1fa794c0ae39", "comment": "Malware payload (AsyncRAT)", "value": "90cf585cf7c4ff2843beef345db9a729278ca8adf5e746815f2a1c5ea150cd9900997f81ec110874c2c0dcec002ad2dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243499, "uuid": "36f3d6bc-d6cb-4cd3-954e-afe43c350174", "value": "T14015F0452759DF02C5A69FF00D70E3B10BF66D899421D213CEE67DEBBA38B056E04A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243499, "uuid": "281cd84f-74ef-4678-a742-df3a94165cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243499, "uuid": "aeba3768-1f91-440e-9650-83f15066ba60", "value": "24576:XuOSJJSHwUv74vDyDyJFxxglq7CJUmktLqX:XfqUwUvEvDyAxxgl7uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243499, "uuid": "224c0976-b08b-4eef-b8f4-40af8931ae82", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243499, "uuid": "2fa2b1c0-b636-4c43-a8b5-649efc74854a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243499, "uuid": "08781591-331e-4988-9ce9-ed69e32feeeb", "value": "7e6683cd7621fc823d9c034c99526c914221f2a28a5571ccbfb8ea10069e8b41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0ee299-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242746, "uuid": "9304d214-6ddb-4ac2-9493-b418a6f8abd8", "comment": "Malware payload", "value": "f1c0a440458fd63086c78272e2207d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242746, "uuid": "19e2a642-910b-4cfc-8820-9720853959d5", "comment": "Malware payload", "value": "7e782e5ed2206e5ccb7cc77d1c84d7f92bd64d16b3e801391ccd4ead264b67fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242746, "uuid": "8b6b0f9d-9945-4152-a90c-5d7651967382", "comment": "Malware payload", "value": "efb89ccbbb1efc2fac96c21824ce5ef6e5c28ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242746, "uuid": "8cc2f4f5-9c62-45ae-841d-7433a4919f3f", "comment": "Malware payload", "value": "647408d68281b6af785c278a19698e816a174de7c9742db384212ca39127c8a96bd532b2a7cc8e9cab2d0545a2c1672a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242746, "uuid": "248aded5-3fe0-4805-89a7-475da0c09603", "value": "T1F085E00263E81E58F8BE6B384971942197F5F843E671E79D7F8D42AE1C32B41CA52723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242746, "uuid": "72f5e576-a4e0-4ac5-bb25-dcc5139e459d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242746, "uuid": "c3c1c5c8-a79d-4cfd-864a-0d6b15d500d3", "value": "24576:QO/EF4Am1UB2TKf+6uVgBM+0/eS9BrVXqI+TROYi9:M422TE+DVgBMH/pVaIWIP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242746, "uuid": "f11ba4bb-6bf9-4219-98d0-6480ebc9b264", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242746, "uuid": "5aa95033-00a0-4be3-bc26-3924a5dc19f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242746, "uuid": "602d2480-1332-443b-8f32-2b9ede006be0", "value": "7e782e5ed2206e5ccb7cc77d1c84d7f92bd64d16b3e801391ccd4ead264b67fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5f785d-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233994, "uuid": "c29c6dac-049d-4531-aa9d-a43cbb78b758", "comment": "Malware payload", "value": "42117dbca747db41430de7a00e5e0f7f", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233994, "uuid": "61e0c36f-5533-43f7-b33b-0a3725cc8161", "comment": "Malware payload", "value": "7eaff7148acdee460607115511e2b4cfcc2d0558ff525df4d942d26e555e927f", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233994, "uuid": "aa4f6399-6c7b-4b09-a641-0ad4a6434b8d", "comment": "Malware payload", "value": "c946b1ea5bf092b7cc93ec45f4a56df0819a6cf2", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233994, "uuid": "093a8278-3b19-46eb-9c36-73ea377c9055", "comment": "Malware payload", "value": "603cd32a2b803cda9ff9b3f408e1566635c5df648a2c286d7a5d94fc69b3baa0c24f462b24323a6c9bf7aa0418e88b87", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233994, "uuid": "8ad4b879-c10e-4f87-84b9-90681024b885", "value": "T12FB3CBF6842ED4DAD0D694CB58A7FB2339E31AEB54E1EC0518C098A913701262FF59F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233994, "uuid": "d62dbceb-bebe-42bf-9079-d70d88a77bc3", "value": "768:QEEIMvbPlUzrmI2SBYWwJywQKhM2k5GgUmdcOwNW44Ol0CMJ6Q92VkqMtGsYKt0D:mOPHSYKPH3BPHAmPHd5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233994, "uuid": "c772a783-a20f-4cfa-ba9a-2b2b87a4ad06", "value": 108813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233994, "uuid": "30f1e2bd-dc2f-482f-aec8-929b7770bd0f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233994, "uuid": "d87aa472-fdd7-4a04-b91b-d89ea3391123", "value": "HesapEkstresi_KulanimdakiFon_202605071347421023.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e035cb-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265067, "uuid": "0b3d1e2d-cf90-44a7-abe5-26a7b743e7da", "comment": "Malware payload (Mirai)", "value": "0e48d04e7836eaba8d2a56874c278103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265067, "uuid": "a77dabd2-b773-44c0-acac-56a202be3d8c", "comment": "Malware payload (Mirai)", "value": "7eb790aee2d37e4f94a2a28c02c235b954e2069f4d5088ae2db89bd61731d68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265067, "uuid": "e950be73-1589-4397-83c6-823e8829c543", "comment": "Malware payload (Mirai)", "value": "c012d7d63c934647ec5807faee5935544bda63e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265067, "uuid": "69e55a9c-119c-48de-a84a-e413032d7403", "comment": "Malware payload (Mirai)", "value": "f71a056ed826254f490afe4d9269b3f5113d656c0d84480b47c450573d4a42f9e344be12df8600dd78580c43293f9e31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265067, "uuid": "939783d8-ffdd-40f6-ae28-a161bb37e56f", "value": "T18E03F186C24F9B18D5BFB4352449736A8BA0911BC388EEDA0AC57BE70C47B75157C3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265067, "uuid": "b8ed174e-58da-4fe0-95d1-67c87b5e54fb", "value": "768:G0ovQLdMXkQIeI0fSrE5XnHBr5SGRDHipoznbcuyD7UEQRj/:GFg8IKSA5XnhTRDCpoznouy8EyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265067, "uuid": "6b80ce88-5505-4d7b-8738-f89b814fac5e", "value": 37856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265067, "uuid": "064f3b03-371d-4646-8630-fca28a52c6f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265067, "uuid": "557c4066-5739-4704-9b6e-dac236a7ba51", "value": "micro.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ded359-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246204, "uuid": "3df65586-3d82-4cda-891b-ed769e7e5956", "comment": "Malware payload", "value": "05999ad68f3181d218071b9f7243315a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246204, "uuid": "f8de775b-9053-4d44-be56-8d0e359bc683", "comment": "Malware payload", "value": "7ef3dbaebaa7e275c6f4c77576ec48d934f8f330fe66a2a0c448f1828336a92c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246204, "uuid": "37219b48-a084-4017-8749-a63cba732910", "comment": "Malware payload", "value": "38942f36a4dae858cca66d3b1f644ec7258e3b3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246204, "uuid": "d57802d8-afd5-478e-95cb-f15d6f2c6265", "comment": "Malware payload", "value": "7a5a0f4385e115ea9fb4907c3c0da2420e6714400d670fd4fac9e2bf83a8db4bef130909f6a99474669fcf3e3eaaf66d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246204, "uuid": "dae45a11-6cf9-46a2-97bb-e9e83acf3c87", "value": "T1EB45CF2373DE8364C7B25273BA157701AEBFB82506B1F86B2FD8093DE920161525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246204, "uuid": "16873712-c2e9-4df1-96e6-7fe958be68d7", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246204, "uuid": "097e52d7-828e-4933-bec3-69bbf15cf810", "value": "24576:Dtb20pkaCqT5TBWgNQ7a0ByqNjHo03qTy5FwL6A:AVg5tQ7a0Byisy5F25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246204, "uuid": "c925347c-ac98-49bf-a26a-f0e98d2508c4", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246204, "uuid": "34957b72-3f4e-45df-8515-4d5e22f942c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246204, "uuid": "29606457-a5a4-4c16-b721-17e3e3667d3e", "value": "7ef3dbaebaa7e275c6f4c77576ec48d934f8f330fe66a2a0c448f1828336a92c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae0ed23-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236490, "uuid": "7d7edf2d-85ad-43da-b835-9a5fee84fbaf", "comment": "Malware payload", "value": "70647d3be283d26e72a5f972f8c1decf", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236490, "uuid": "3ff101f1-5282-4547-bece-5d38f3e17c1e", "comment": "Malware payload", "value": "7f530d65bed4beef473f42a30513e538b469cb7b3d80b77a55c7d751a114f176", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236490, "uuid": "65e26eed-ef80-497f-83c7-3be8165f826a", "comment": "Malware payload", "value": "996cd2e159f2ea40f65ae554ec0bb12a39951158", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236490, "uuid": "7cfaaaf8-b8f2-4812-8183-8d4db468774b", "comment": "Malware payload", "value": "5bfcbd8549ec38f67fb7012367d9ecef4ee136ff7ff7f96b595de74654e215cbc878bfc079025907e706e097ff69d9e3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236490, "uuid": "915f6483-92d1-4204-aa09-18154da05e0f", "value": "T1D3C55F0A418CE06D6EDF9483675B3EEBF72BB64C5212866F01A335073D0C56477A1BAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236490, "uuid": "e5b18a77-4e34-4b3f-ba96-e5efe213004c", "value": "768:XLiq7zdxLOnrzDiddu/5GGdp0BSjabp0wdgggNzq6aU7QBiHBqXkK7mECL0xWQFP:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236490, "uuid": "9b5bb1f5-067c-4b52-92db-29c10bf0e0b8", "value": 2705602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236490, "uuid": "361b2565-8377-4353-b035-3dcc88854c89", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236490, "uuid": "cceabaf7-44e1-4a31-a472-0fd8dba8bf79", "value": "Quotation Number QDOM02626-27.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3b9a9b-4abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231768, "uuid": "89c82461-af6a-48db-9cb4-69b651df20b1", "comment": "Malware payload", "value": "0708005f8c74c47c0bbf2b234d755038", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231768, "uuid": "dfc3a1bf-f619-466e-887d-4cb91ea86708", "comment": "Malware payload", "value": "7f587f6845b47487a7e8679f9ff5286b586ef57198e7e8cb7522be20e8506a18", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231768, "uuid": "64364a72-9e5b-4b59-a22f-8bf3001f1dea", "comment": "Malware payload", "value": "948a82d88523f5817a434db9431d08dec60fd4a6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231768, "uuid": "883158ff-6300-43f8-bff8-af7f12accfbb", "comment": "Malware payload", "value": "44a352e529507b6ebb9a1f12c515bd5985ad282e46b3160d94de784ffdc4f6762b087e509f4e06a956f7abe9e8111664", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "yesbank", "colour": "#2ED2F9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231768, "uuid": "8fac63ce-a1d4-4566-84c4-e573e86abfc1", "value": "T122F6120BF30CAD6AD9F75335B936436B951B1D254F43C68B6860723D6AB36C04A6EBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231768, "uuid": "73f35c8a-3347-4246-ba93-b83c371df4e2", "value": "196608:pdOwmtFL6P2bhFYc9CM5uCNA+MgjAMFjupmWAgp1lB040t22XCMphNPnAxXTH7NP:wfYGJ3hp5W9lhp2XCMphNPWXvNxWJxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231768, "uuid": "6351343e-db6e-44b5-8c5f-06398bc976c5", "value": 16265887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231768, "uuid": "649373eb-5c65-49b4-adfc-39f426028848", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231768, "uuid": "2d845a1b-3943-4276-8595-8a71c3d518e6", "value": "Yes Bank (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9266b2d-4ad1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778240004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240004, "uuid": "21fd2426-2358-4a82-9157-d9dcc6fd1b14", "comment": "Malware payload", "value": "0214117d245647045b4df851b202735b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240004, "uuid": "25e0d04e-8111-4b0e-ba1f-7fe737ce1221", "comment": "Malware payload", "value": "7f79316fd5165be9e2f8e05482860e5bb402575640c0ee22f6ad978228d980ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240004, "uuid": "d2405165-c12a-409c-9bbb-07e06f46968d", "comment": "Malware payload", "value": "7fef21c2c3b97d32c0dc71b0131d98a0104c6aaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240004, "uuid": "d9703ba7-2de4-48a9-aecf-e49e264b973f", "comment": "Malware payload", "value": "f512049be09768804d29873d4aed13f44887ea3300535f4d94ce2c0a4b705698ad092982dc4594f67ff56ee70dc2e297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240004, "uuid": "8c6ad297-9b09-477a-a630-0ef7db579237", "value": "T1C434BF63A4BCAAAFDDD82F375C4E880713B66FE5D890603E1C44710EFE1A5085F3A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240004, "uuid": "f0b01ddf-3961-450d-9925-b64eaf5195ee", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240004, "uuid": "37af6b57-e9bb-48fd-aad2-0b909386554a", "value": "6144:tGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOf:tG60BpL8jk1FGjDc8GVdOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240004, "uuid": "9046203f-4d3f-43aa-9eca-d60fa0fb7c2d", "value": 246670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240004, "uuid": "be85a73d-c626-4d87-9d9e-d7f2dbc2ccbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240004, "uuid": "4571e45b-a1d5-44e3-8adf-0f9ff7b2e820", "value": "7f79316fd5165be9e2f8e05482860e5bb402575640c0ee22f6ad978228d980ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acdc734-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244677, "uuid": "b2178bbd-7a49-4bbf-9ae9-6808be0e660c", "comment": "Malware payload", "value": "8e7d4686acc9d1efeb904cec7740f954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244677, "uuid": "1701be1d-e10d-451f-a294-fa7a458b7e27", "comment": "Malware payload", "value": "7f94069e597b2657a1a839a9509ec405371347d1674f0227e7561ca4685abdae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244677, "uuid": "f868fcbd-c41b-4b7d-a160-ec320ef12453", "comment": "Malware payload", "value": "0ba74d1701155b17721ebfb3084b2171895604a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244677, "uuid": "50ee7232-ffaf-4e75-9ae1-ebc7f9315e06", "comment": "Malware payload", "value": "3d14b4f2353dcf6af7f68225b77962632488849126620d676797872de426461bff4e4d4f0916cb9faa9dcda1a91b16ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244677, "uuid": "019d4c2f-fb32-4303-9382-1a5e4d261dd7", "value": "T1AB55232172A0CAB7C437613140EACB791E6A74B25B3882D777DC27DE5D113E19B292CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244677, "uuid": "77ae751d-3acd-4dbc-89a0-26860da7c257", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244677, "uuid": "1a765ff5-8975-4e69-a21c-4e5fe4786daf", "value": "24576:qk70TrcKpQBDVkfTpvhWVEJXym8WNr/bs32lNDPm9/JrZjEAtYdG1eoY0:qkQTAKTTqVEJXp3NLbsYFo/JFEAedNoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244677, "uuid": "02ea695f-0cf0-428c-8d09-ed3054d5ea97", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244677, "uuid": "a3082a59-4485-493a-bb1c-1c6a26960613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244677, "uuid": "41f4a1ae-28b1-4374-be53-01f6f3890d05", "value": "7f94069e597b2657a1a839a9509ec405371347d1674f0227e7561ca4685abdae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c260f92-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778246344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246344, "uuid": "a5987765-ca4e-4de8-b14e-1f704cfa3490", "comment": "Malware payload (AsyncRAT)", "value": "7eb5ca638d0925e5eb7aafec205c0d53", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246344, "uuid": "65b9f3f0-bed4-4ce4-a5f7-b60279478a59", "comment": "Malware payload (AsyncRAT)", "value": "7fe6d020d4e2861541bce306bf96970e89783b4823b6b86d428fc6d5e4241678", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246344, "uuid": "9c776e03-f2f0-4213-9dea-2552915d8494", "comment": "Malware payload (AsyncRAT)", "value": "13bceec256c6b9df43b9d8e2018986e8333098d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246344, "uuid": "a31c45a3-8d37-4ccb-b0f2-300cbcf496fa", "comment": "Malware payload (AsyncRAT)", "value": "cc6a16ac7f47d526f7f1a90d8d3cefe278d5ef71a894e137b00c9526cf71b861e86352287fa1c5dc619eb31508e86228", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246344, "uuid": "f5a3a919-4756-4c4a-afc4-e438499358bb", "value": "T1FF144A06B36521E9D1BBC13885921612FBB274A50732AFEF4764433A5F22AF4BD3DB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246344, "uuid": "7a67a186-77f6-4566-be75-53050e080e4f", "value": "4fecd44dfc94ffab3c4ae3356e71b8f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246344, "uuid": "4db3432d-44a0-464d-8af0-d9715baa110c", "value": "3072:vv4Sm9TMIx6VMb+ucovwTSOQ20M6O1rKg809/ttlibY3vHJ4wO:343tx6VVucovT296yNttukvHJ4wO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246344, "uuid": "8a5a6fd8-fd53-46df-b475-f1b61325d76e", "value": 195692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246344, "uuid": "7f257d4e-26e3-49ec-9fef-9e45f65c74f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246344, "uuid": "50e784b5-1521-49f7-9369-bc4bc36f9197", "value": "7fe6d020d4e2861541bce306bf96970e89783b4823b6b86d428fc6d5e4241678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f5b799-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265073, "uuid": "184a5af8-3d31-4468-bb95-7fff1c1efeee", "comment": "Malware payload (Mirai)", "value": "fa82f9febdac586be619fda515e05c82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265073, "uuid": "0e880ff3-7877-4bb1-bb0f-0f151ad9dfad", "comment": "Malware payload (Mirai)", "value": "7ff3c19cfa76ca7bee2a85427ec9c98a70802c35e1d66a48f2a91b4ef43ebe82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265073, "uuid": "923a41e4-e15c-4e16-b834-ed38204bccfc", "comment": "Malware payload (Mirai)", "value": "eb1d34c8ce7043a457e69bdc9c743e2e301ab24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265073, "uuid": "baf5d6dd-37a5-4397-b8d6-786b330e2e0c", "comment": "Malware payload (Mirai)", "value": "e4ae65d0a770b81623c2af0749d48b01676b811188ffd885d2c3d148e37d0c0ea1551a0a639f9850c1850db9a4aba055", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265073, "uuid": "3257a200-4006-4b87-aba9-abdb622aa201", "value": "T153530211B9E34A9497B298359B185241A06733BDF4DCF19BCF9D8A01AC90683E3FD5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265073, "uuid": "6c156943-f0c6-49e5-b530-a40a330a8650", "value": "1536:bX8XAS5TxZsqrPDaTy1Q7fuz/ZEMzlL2LYH3KUwPBQ1:bMPhAaqy1VhEwlqL4aUj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265073, "uuid": "6e53df55-d0a5-444f-89b3-13e8d625fa19", "value": 62916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265073, "uuid": "0492fef0-a8f8-45b9-b609-4e0fea960f6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265073, "uuid": "0caaaee7-ef44-47e7-854d-0bf6637f252e", "value": "micro.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef109efe-4b26-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778276601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276601, "uuid": "39656e35-aebb-4ffa-af2f-db73f8bc205a", "comment": "Malware payload (GuLoader)", "value": "d67beecd835e29c5241f980a6246aa2a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276601, "uuid": "d450fa9a-9fc9-49a0-8ac1-223f592ccdf7", "comment": "Malware payload (GuLoader)", "value": "8001380b521739a25e079d6a1324af3d6ff22c8162f518b463abd3e772ed5487", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276601, "uuid": "6027ea87-ec0e-4315-a24b-d6b91ed73fb8", "comment": "Malware payload (GuLoader)", "value": "dcebea46d774e32ade0cfa892f08cb7c0f13ffeb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276601, "uuid": "d7ca92b7-7ea1-4ca1-a4f6-5bd601e58ca0", "comment": "Malware payload (GuLoader)", "value": "be549b314ea6fd886b7dce242cd61d82c5161cd74e1d228c2997dc019ec1db256e2db06275dd8b6888f015184c75a8b2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276601, "uuid": "65d1b8b4-8cc0-4e08-b4a5-caa838c2068a", "value": "T19BC4332355F4A2FD0B33C7D0F8D6F3D48AC3155EBAA0FAC90575038271D246A619BEA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276601, "uuid": "a3f168a7-1c41-4796-836f-a2597958709a", "value": "12288:L4BpzFilAj4sR3AozE/BH1AdTPO57/T/BYVLhfFfSu3MZZoJcot55IZjIghA/:sBpJbR3AWE/BHyOt/NYnNau3heo0j/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778276601, "uuid": "07544f2d-e416-473d-b62c-01bfec1e318d", "value": 557641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778276601, "uuid": "e39dd130-4d9f-452e-ae18-2755e54f16e3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276601, "uuid": "49a2d732-b488-4ee8-a908-ccd20dea54e2", "value": "Purchase Order Batch 2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b9d838-4abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230525, "uuid": "37ec97bc-5a42-4690-947d-d90aff956626", "comment": "Malware payload", "value": "db2d4d16aef87e6d475f91b9287c0886", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230525, "uuid": "5202eff9-3c3b-4403-9fee-11d7e2927063", "comment": "Malware payload", "value": "806035bf162b95b28511094a7bef8e7194a26b30232b37b00ca721560e1a6c95", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230525, "uuid": "27ef1bb8-1f82-4a3a-8dc4-d20f5b8af27e", "comment": "Malware payload", "value": "a88e7633ffd9d6d1c0c31a3b928fc00a1e07b37e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230525, "uuid": "a55c7f10-c770-4ff4-af4b-e2146a51da04", "comment": "Malware payload", "value": "6f36d07fd93f514ac0c449355553987c442801e951a65becc4bf2ced77aceb730377c49b0dfdb13d238900593dc0548c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230525, "uuid": "78ac3611-1344-4574-a5d2-bab45bf055fd", "value": "T1F1B612D6F7D4492AC4779072C96E52F1225B4D568B835F87B804360C38B7AE80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230525, "uuid": "d04c3b07-001b-4ea5-9e54-183ce500b477", "value": "196608:uavXX2LthRaFOd7Z34Ou0r8A4idFLKOdV3vr6ppHpeTbwev7:JotjaFOd7ZHprFNdFLvD6pdp5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230525, "uuid": "cc76603a-b89d-480b-9af3-86dbd81810e8", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230525, "uuid": "fc3fe919-3c00-4656-a8c8-ce3c128c202b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230525, "uuid": "6258b444-ea1e-4e0d-b233-b1d3d4da5e84", "value": "imobile Lite (30).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b1b3b6-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232560, "uuid": "ba6e1bef-8dac-4549-88cd-6aab32cad666", "comment": "Malware payload", "value": "2759d87bae046dbda8959bbddc0c56df", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232560, "uuid": "cf8f79b9-b63e-49b5-a5e7-4b34b1b7fa22", "comment": "Malware payload", "value": "8066f1b5f9c8cb2bd068f62de208662487fcdc59e4a9eca81dff3b24b9e8cc3f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232560, "uuid": "85c7d8b2-3229-4e63-8a54-8b8b29e83d51", "comment": "Malware payload", "value": "2bcab1e9fb83f3daccfe9db82c12025610c69a74", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232560, "uuid": "cee2ef97-e8ee-4101-9e6e-66abc18fabc7", "comment": "Malware payload", "value": "c18b4a5cfa8ae83e43cd04cd858cb77a1b146f931a29e08fbd7aa3af2b6c78a9f2e185053931d57eae6615cb8ea7ab77", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232560, "uuid": "71ae041b-2bd4-416c-8c4a-d8568b842a28", "value": "T1A807CE23F50969A6CDD6A135F5E307A572340D480793A229271FF026FDF21CECA66ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232560, "uuid": "e07373b2-f5b1-4770-aa8d-06f17b5a90b0", "value": "393216:Ud1Kx1CE1BB7O4sdbufEQ+YcGHxStZ/EZ5m1cxW:8e1CE1BB7ydbU+SCwwaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232560, "uuid": "f59e512f-6d37-4df5-8683-f90bd8503118", "value": 17888839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232560, "uuid": "bedf1d5a-343d-4c48-9787-0de18b1e8859", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232560, "uuid": "5f75ac3c-b609-450f-a0ae-e318dc0066d9", "value": "iMobile Lite (41).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c035eb43-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244740, "uuid": "e6e98f69-20c6-4091-a67d-13364e77d619", "comment": "Malware payload", "value": "ff0d6cb1dbc8492b769aaf0787ed9adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244740, "uuid": "201a94e7-a399-4d39-bd33-b2db541471f3", "comment": "Malware payload", "value": "806c266a6ca22c51eeee1db136cace707f36da34ee5f262176ef5306775ac9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244740, "uuid": "44baed2c-32fe-484f-a83a-85ed7da8107f", "comment": "Malware payload", "value": "46abd71f06591d9a7ff2b932511e9384e6f9240e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244740, "uuid": "c74a82b6-5c7c-4062-b391-a9d6e451e71a", "comment": "Malware payload", "value": "de0738a134867fbb773da2c36fb7de9e1c545f84a1c7d10766cd55a23885237d67c5dad52439b0f6cf72166ddc308c84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244740, "uuid": "cf2064da-f0f4-4882-a0f8-91883936a9fa", "value": "T11EB5230A979CE417C2415F785DBAD5F52778AC89EA30E24D2FDA3EDFF0A4294A814313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244740, "uuid": "0bf2f9c0-d99f-4462-aea5-10fd7558b7d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244740, "uuid": "229fae9e-1603-4822-a56a-0f96191c5abf", "value": "49152:gvOrbBIcWwTgNOO4WrKqI3tjESZPJ16Y2LSvE31jX6C2t3g:gMrU83YKlE2/2GEFzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244740, "uuid": "ba6593c1-9249-402f-9c0b-e56864872e99", "value": 2336768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244740, "uuid": "18774d47-416a-4dae-8537-0154d3c4d1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244740, "uuid": "1d5b35bd-1b5e-44f9-9840-b0d1fdb89be2", "value": "806c266a6ca22c51eeee1db136cace707f36da34ee5f262176ef5306775ac9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad288170-4aa9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778222804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222804, "uuid": "2157c2f7-7495-4bd7-82f1-42896d296cdb", "comment": "Malware payload", "value": "3ee3c08ab8b6f271b59588cd371ab83e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222804, "uuid": "cf295792-40ec-4c66-aee4-83da84b8d6f3", "comment": "Malware payload", "value": "8073d3c4745ae10fb645e442bfd296e5cfdb3d51a8eec6bc6e4df458eb68b856", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222804, "uuid": "78697801-889c-4008-8077-1e22ea2108dd", "comment": "Malware payload", "value": "4fc17ad99ea27835fa897db0e768dd276d469a9b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222804, "uuid": "6f5bcbf7-d0e7-4d10-b551-99925a33cbab", "comment": "Malware payload", "value": "6176916f8a6e0177d15b0dc7b77e5901f5f1c84a3e390bea4b049cf9f53d31c631d1d41428c08892ee24a92190711dca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222804, "uuid": "0b82f2ec-d273-4070-8653-bb7d76272011", "value": "T11E137D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222804, "uuid": "56dffac6-b589-4c28-a9d4-51bec9370a10", "value": "768:bXXRWNGxVxlS9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bxlxdco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778222804, "uuid": "ed47de90-7319-402d-b4e2-3735d0ffa11e", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778222804, "uuid": "e077a9fc-e718-43d3-9f20-e9b1b53040ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222804, "uuid": "1f7108f6-7b35-4e73-bf39-c55b78914de0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db1da6e-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233059, "uuid": "52c94637-0906-4b5c-994c-00acc7d4bdf0", "comment": "Malware payload", "value": "0e29f74abca3929f9ec2ba3f0183fd3d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233059, "uuid": "c0d1a6c8-1620-40e6-bd20-f21b8e54c326", "comment": "Malware payload", "value": "80de49a3bd719d62f3b2f24d584a03e3fff3e6ac46ad8bea3c04c8a09071ed3a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233059, "uuid": "ca5b5c76-66e0-4ebe-8c70-98664f7cebb0", "comment": "Malware payload", "value": "f98e048cee7911e659687acf4dbfd9ff8f6bd4da", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233059, "uuid": "f0dfb78e-519a-4101-963a-cc74f3ae0a48", "comment": "Malware payload", "value": "fad7170e873ef734e690a32a898b8a65ffdfd7bd3d467743a9aaf5124fc7038c01cac8ac9a76f2f698fef5e7e5bfc960", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "PNB", "colour": "#1CAFAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233059, "uuid": "fbba938a-6c97-4666-92e3-9effc74f254a", "value": "T11F07CD23F50969A6CDD6E135B5E3579172341D480393A239271FF026FEF21CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233059, "uuid": "797f236a-6332-4b7e-a80c-65f46d23789e", "value": "393216:mphjvi7jgieK7PF7S1wBJfBugK4l0POBgdor4EPseUhe:Gvi7JrF7SCBe9Q0POB6ocEUbhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233059, "uuid": "4230b2a2-1589-4ac6-88b7-5ec1e57a57fe", "value": 17753673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233059, "uuid": "fe4871e7-bab9-46c8-a7c7-1dd7c3390d22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233059, "uuid": "8c03a644-a4d3-4fe6-b25d-655a4808449b", "value": "PNB Mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3578bd8-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230115, "uuid": "a1d8f5e5-68de-4a84-975d-fa314e999b62", "comment": "Malware payload", "value": "a954505951d7276e16c731486adfed68", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230115, "uuid": "eae5bf60-e46f-4019-894d-1dd213c9705b", "comment": "Malware payload", "value": "80ebc347f3256dd2c0b505f25c9620f334bf9fd716f17f1b45a020671d3a69f7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230115, "uuid": "3ad3bd59-bd88-4636-a11c-084bdf47d96a", "comment": "Malware payload", "value": "1dcaf1c599f828d79942d8ba402ae9a5cd4392b3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230115, "uuid": "a8fcaa30-3208-4b06-9414-695009f36735", "comment": "Malware payload", "value": "29719ec56d30699f99e62a97ce8529df7cd909b24cf360a3f0688ceb8dfe6fdc1c6b7d05cad31b644b32fc53e78f2a35", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230115, "uuid": "db6c2920-e5d7-4be1-91f3-86f606843c29", "value": "T19EB612D6FBC4592AC4778072C96962F1215B4D5687839F87B904360C38B7BE80F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230115, "uuid": "c394b834-17d6-49fb-a020-6d4c31a3ef7c", "value": "196608:uavXX2LthRaFOd7ZLfdD4U/QafNHkxCFQUl+aig5jUZiYv:JotjaFOd7Z5//QsNHks2U0arJUZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230115, "uuid": "f7fc5d53-a4d3-4171-9068-fc6e623690a5", "value": 11438196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230115, "uuid": "0040a9b6-ab27-4c12-ae1a-27f6f6060f00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230115, "uuid": "ac3b7388-f779-47bd-acf8-380c39111671", "value": "iMobile Lite (24).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e2d5b6-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245935, "uuid": "743d27b1-c08b-4de8-ae00-0aa48c866549", "comment": "Malware payload", "value": "78e551038bfe0cea764a211ea8a04549", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245935, "uuid": "5a51ea3a-dfc3-47d4-84f9-ae07f2d13ef7", "comment": "Malware payload", "value": "8114650dd8bef9931f799d83d31eb8ff555368565ea39a14b46d3b8bd62f8c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245935, "uuid": "3c75981c-d802-4402-812f-fae0f311583e", "comment": "Malware payload", "value": "2b27844989e7dd40356c7613221cdd81d24f3c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245935, "uuid": "37c27a6c-4f5d-4148-8fca-f0a3cd3c1765", "comment": "Malware payload", "value": "8dc3a724f4c972a49b129a0df92fba101f949edde1d8aa557934419fa9e25b366029adc41f68e00b3d0fde8efe224ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245935, "uuid": "38ea0639-a338-4489-b06b-08ad1716b520", "value": "T14EB2C77CC6E5BCD0CBAB52F078AFB7D502EAAB177D56471CB8C814471E20354AB78289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245935, "uuid": "eccb8e3b-7ebd-4bfc-8aac-557dc5e244c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245935, "uuid": "44c2266e-2800-47d8-bd0e-67c0b7a162c0", "value": "768:bz57Ngy0RhNbFGq0w99rvYHJ5pvOMM37j5yc8u/wf8WEN4:2Nboq0w99LYHJ5ROMM37j5yc8u/wf8W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245935, "uuid": "aaf45574-b98d-417e-b57d-2367e3e98394", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245935, "uuid": "b32287f2-480d-4c57-abb3-d1db3a10082a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245935, "uuid": "130734c6-5c8a-48e8-9b79-cbdd9cf687e1", "value": "8114650dd8bef9931f799d83d31eb8ff555368565ea39a14b46d3b8bd62f8c4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9eaf0fd-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778246018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246018, "uuid": "e68ba451-6b86-41c1-a2a1-d69ddbeeafe7", "comment": "Malware payload (AgentTesla)", "value": "a85fb84803ad83b6e55eee50fb3eea5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246018, "uuid": "7426dd1b-5ab1-4c55-b1c2-31bfe2ce3cc2", "comment": "Malware payload (AgentTesla)", "value": "812ff46e29476def51ad85f7ab0f7dd0ba46d978fa30850a938f001e55850958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246018, "uuid": "dc928ce5-bf80-4a33-bf4c-98b130dbb064", "comment": "Malware payload (AgentTesla)", "value": "961de5b09c924547e7e4a2484d070bee82de6645", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246018, "uuid": "c34d9ef2-18d6-4493-8703-58559a3beb87", "comment": "Malware payload (AgentTesla)", "value": "8365f25674763a1d196216b185630f082a9897637eb4c0b2dc00efc98cc2c83c649acfac18427955bce9d7dfdd875306", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246018, "uuid": "dfe433f6-70a3-4001-8129-e51235d6bc99", "value": "T1B3341F037E48EB15E5A87E3782EF2C2413F2B4C71633D60B6F49AEA51451642AC7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246018, "uuid": "d9dae1e1-9677-41f4-9ba6-4d056b578390", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246018, "uuid": "c7dd974c-fad4-497c-b17a-bb18547479c7", "value": "3072:Z53lNYbwI4gwYpHN1lTN1Gp3TA9B9yFOEjPC5sKJriz5b:Z53l+bwI4gwYpHNvh1xyUEjPsJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246018, "uuid": "36abcec5-0b80-4657-980e-af8050136d71", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246018, "uuid": "5e113897-4a29-43e0-a58f-f305dc05cef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246018, "uuid": "263ae9b3-5442-457b-8b55-b2182cbad0e6", "value": "812ff46e29476def51ad85f7ab0f7dd0ba46d978fa30850a938f001e55850958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83dd70b-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243116, "uuid": "6eaace41-4ac2-4878-9572-8ce0c694257f", "comment": "Malware payload (AgentTesla)", "value": "25740285bf8aeb8301d9912a3827a108", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243116, "uuid": "56dac2a8-765a-443d-aba7-e7965945a261", "comment": "Malware payload (AgentTesla)", "value": "8132870454a1a16859a93c7f863186702278859f9d8c83de54816fed2c5911a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243116, "uuid": "1cc497c9-c78e-4632-a705-1fd27191bfbf", "comment": "Malware payload (AgentTesla)", "value": "7f1c708f89145f80c7fe55c34d479356c0479bdb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243116, "uuid": "95d529a0-1924-4d6a-b472-7daef505e08e", "comment": "Malware payload (AgentTesla)", "value": "849a092ccf61a05f109d20daf325ef962cb52f285090aff7fc93e3c5f3a7181e08bd7e84b0dc6d8a6f851f5b471a333e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243116, "uuid": "982ddc3e-3411-413c-a3df-9e3d777a71fa", "value": "T1D2340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AF5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243116, "uuid": "c842837d-ac1b-44c8-8876-33dff40801c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243116, "uuid": "4fed6e97-be3a-4374-a7f0-89be1492f932", "value": "3072:J4p6CyKaNWSKOzujU4nTHo9rG8KaG5jnThcqsufzz:O6CyKagDf9sq8KaWTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243116, "uuid": "7de636c9-c76b-43f0-a6dc-aa0cb6f3c76c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243116, "uuid": "25b39bae-f845-4eb1-831a-e99332a2daa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243116, "uuid": "b50e584a-a2f0-49ab-8377-0d32b82dcf07", "value": "8132870454a1a16859a93c7f863186702278859f9d8c83de54816fed2c5911a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac72176-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Arechclient2)", "timestamp": 1778243174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243174, "uuid": "3927c32e-8fad-46f9-afe0-b0d585b7f536", "comment": "Malware payload (Arechclient2)", "value": "58d22b04235ca136d080d76d1a707aed", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243174, "uuid": "fb225fc4-05c7-40f4-ba7e-681e4d77dc20", "comment": "Malware payload (Arechclient2)", "value": "813a95c11870d94d401682c7a671d61ff6f2f0c2e6124f3bdd22bb4913079f0a", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243174, "uuid": "37888cb9-2230-4208-9dd5-c9db6a61ee5d", "comment": "Malware payload (Arechclient2)", "value": "3719003aade10a63a2286747c560ee000cce14f5", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243174, "uuid": "c0fa2e0e-03bf-4362-a93d-7c444cfd9a41", "comment": "Malware payload (Arechclient2)", "value": "6078db940c1b4ef9ecb7d6d27d1f59ac34fdb70adedefea15be8f80529631a54bfb1b71c9f2116ad96c05cf2382f7d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243174, "uuid": "8b25fc94-3134-4104-b6f4-f79f6c168547", "value": "T17A150245234AED02C5926FF00CB0E7B817B99ED95462D307CEFA3DEBF9397526904292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243174, "uuid": "fdeed2fc-080a-4f59-a047-89b4b4efb864", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243174, "uuid": "80251b4c-574f-4d9e-bbda-85a6fd889d71", "value": "24576:0SJJSHwWMEPJzeW9tO6ZtHZLgZ0go5BV1Y0LjZIHE:0qUwWME/Ofo5NLjSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243174, "uuid": "ba8028d0-2d84-45c1-847f-1bf35f3f6de3", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243174, "uuid": "f800c71c-d93d-4a5f-ba07-494343c11e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243174, "uuid": "526fd12b-2a32-4f0a-b5db-88f2b800851e", "value": "813a95c11870d94d401682c7a671d61ff6f2f0c2e6124f3bdd22bb4913079f0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa822af-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245974, "uuid": "b3d8a65e-55c6-44c9-8395-bcd68dc93447", "comment": "Malware payload (MassLogger)", "value": "80e7cb0718729e82f5daff477ffaca16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245974, "uuid": "01b81318-aed0-47db-8e19-da17c02545a2", "comment": "Malware payload (MassLogger)", "value": "81d08f3800e3dea51f1eae0d3f09f416f73ba1e2933205eb0f56059b01a96493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245974, "uuid": "9b09e690-ac02-4d0d-8f41-fa6575ba870e", "comment": "Malware payload (MassLogger)", "value": "240ccae41ba6fcbc3ce0fa5ee9785cf87135be50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245974, "uuid": "8dc4f33f-0ee6-4045-a59d-61d2f0392c2a", "comment": "Malware payload (MassLogger)", "value": "262b452671129c49f70229d122451f05b7e9e8f3bb64325c98d721553c1fa6f60ef3a6862f2ccb1ea4e962e23ece51c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245974, "uuid": "029644c2-0a53-43dc-a0e3-c864a9e7b0a4", "value": "T176051218A65DDE06D4AA1BF40DB1E27817744C9AF920E657AFCA7FCFB07AB040916313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245974, "uuid": "9f103f3b-2e1d-43ae-a6d4-9626c032cf2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245974, "uuid": "e08267b9-a3eb-449c-b0f6-e867dd81faba", "value": "24576:JXS6ghdjuQoajG6E9o9ded0+iX6OU5j4+y:Ji6kdjMajYisAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245974, "uuid": "c73f624d-76c4-4cf9-851c-e369e6659a70", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245974, "uuid": "82a4eb51-9d66-4201-ad0b-f96cc9c89cce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245974, "uuid": "33c9fd53-751d-450c-b9d6-471ec5702c87", "value": "81d08f3800e3dea51f1eae0d3f09f416f73ba1e2933205eb0f56059b01a96493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d23c129-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244251, "uuid": "f6ebef6b-cde8-4b12-9fd5-b621a5918cdc", "comment": "Malware payload (Formbook)", "value": "9c631efab3786cd73c9bfa8499cbec25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244251, "uuid": "8c8973ad-7716-4716-8fba-245324573d34", "comment": "Malware payload (Formbook)", "value": "821066280582cb940c3a8209a87c82b70745f192f8789719da71874ba8d2d4f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244251, "uuid": "cac9adaf-ad8e-44fa-89fe-9f2a5d1b3cbf", "comment": "Malware payload (Formbook)", "value": "1ffa72fbcc01be97616a67175f78d8232c642d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244251, "uuid": "28ae1509-626f-4b54-a9a6-19af812d0b5e", "comment": "Malware payload (Formbook)", "value": "747086241a4d00666701a2f030cae15564e47149399ce8be8544f4e7f55d5831423ad7b1ed4caadb9e5b494bad71fdf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244251, "uuid": "558c0a35-b5c1-4e04-955a-e2114685c5f2", "value": "T1D2251254BB29DA53E8E507B85574E23613F48C8CE512C3079EFEFCEB382AB192419253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244251, "uuid": "42689b35-3e02-47f5-bec3-f06f0b8c3d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244251, "uuid": "53057876-eef0-4603-913e-b2f1ec58d770", "value": "24576:I8+v94aVEGjVMELTzZkgPLsbkohq+4Do7MHcdUca2/Gr:ev22EwVMQKXbkohq+4Dog8dUcmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244251, "uuid": "f5a0b1fc-1c1c-4f40-8ae6-d3b2ee26eb44", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244251, "uuid": "5ad863c8-f76a-48d8-af75-75d5568b11cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244251, "uuid": "759cde96-2811-4650-adcc-09818b752da5", "value": "821066280582cb940c3a8209a87c82b70745f192f8789719da71874ba8d2d4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db204ac-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (SVCStealer)", "timestamp": 1778244548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244548, "uuid": "c8ab68ee-aa73-48a9-9f82-af9615ffb36e", "comment": "Malware payload (SVCStealer)", "value": "002fda2af77ddb46b656365b3f0a2031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244548, "uuid": "6daff0cc-0f2b-4582-bed0-f2fb87075c79", "comment": "Malware payload (SVCStealer)", "value": "831fd93f76c7e8dc702ac517de7b7dec48670c938138be2a53efd16563deddbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244548, "uuid": "204f7c7c-2a48-4822-b298-3a3fe2cbe28b", "comment": "Malware payload (SVCStealer)", "value": "72fc672b7b468d3623562e0673d020a0f7b1df66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244548, "uuid": "9dab82ee-ccde-4374-a215-08b711880622", "comment": "Malware payload (SVCStealer)", "value": "e6ea05f4ac70e9ca61b37c66731f355ead6f6ed090749f3574a01eaaf94f0fca3556a0e643380ceb787d653e651366bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244548, "uuid": "13ed13ea-f700-4bba-a3c5-5ddf889d5f8e", "value": "T1C496338502E105E3F8B7F23E4AA66595D2B3B4105B22C5DF1B6483A93F6B3F24D36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244548, "uuid": "555ad5c9-308a-4de7-8906-bd713b1e107d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244548, "uuid": "7c22a7a7-390f-48e1-afcf-e4669931affc", "value": "196608:qr65UjrtbW897G+x7eovq5XMP6PzFcx97WZHsoqEbRjMFb:rWjr1Fdq1B7wgZHsoqEbpib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244548, "uuid": "6aab6e65-f103-418b-8f36-433edf8568b6", "value": 9387676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244548, "uuid": "fd1bc805-56ff-4602-80c3-a655da175953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244548, "uuid": "e0a57e16-a87c-4b6b-bbc4-7478d02faa61", "value": "831fd93f76c7e8dc702ac517de7b7dec48670c938138be2a53efd16563deddbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961a9ebc-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246387, "uuid": "19839646-e889-4364-be5e-3c8e25561983", "comment": "Malware payload (Formbook)", "value": "d41655f857e0dd3411042f7a681b8840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246387, "uuid": "12994a24-daab-42e7-89a5-8e0ddc0bd55d", "comment": "Malware payload (Formbook)", "value": "83b22649ee530fdaf4818ea722ec903ad361297305fef3b00978563e84ae7774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246387, "uuid": "bb63c873-a969-4b3c-bf50-2dac7ecd4d66", "comment": "Malware payload (Formbook)", "value": "e5deb46598d4e3585250eace21645a551ac9535d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246387, "uuid": "cfa0b519-9e4e-4114-87c6-46daf7e359d5", "comment": "Malware payload (Formbook)", "value": "fdf73fd40c2bda86df1da1dbc0da2b49bae77db0614b05b2341f32dc89cd7737c4db794d758ca561562392730a784a86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246387, "uuid": "cd7f8fb3-5f71-4bea-8cdb-9be4ce63c7f2", "value": "T14135AF0273D1C062FFAB92334B5AF6515BBC69260123E62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246387, "uuid": "cfc8a23f-3a5d-48c3-8c69-f6e25c5f26c2", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246387, "uuid": "63baa1d9-2eb7-4479-a418-bcf519e64f8e", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aX40Vok:WTvC/MTQYxsWR7aX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246387, "uuid": "5e840094-a725-4562-9799-ea6c44215c0d", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246387, "uuid": "58a264b9-d68a-49ea-8954-2300b5173cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246387, "uuid": "373f6b19-1f70-4108-b33f-21af3d808058", "value": "83b22649ee530fdaf4818ea722ec903ad361297305fef3b00978563e84ae7774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6a4033-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778243821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243821, "uuid": "95989e10-3dc5-4112-88b6-1ddf910341d4", "comment": "Malware payload (PureHVNC)", "value": "4bab52ddb81d53ab7c43473f80d22483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243821, "uuid": "ca212e35-a49e-48a4-b5a6-1d87626f7f7d", "comment": "Malware payload (PureHVNC)", "value": "84b26041b213bacb5271c23beefe1d47d7150c60e4aec1a463025e115ec45354", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243821, "uuid": "640253b8-f893-4a49-a3c8-d8ed2864e6d3", "comment": "Malware payload (PureHVNC)", "value": "7d2c74fba842d0cb51dcf16d3c5740f0427ead3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243821, "uuid": "cc9333be-11cb-4e4c-bab5-9353bc603c25", "comment": "Malware payload (PureHVNC)", "value": "28c3d0a79b64d0f34ca4f6affe4b20cb34122afc7da98575c90a7fbe330a0e096c7d301dd113d7ab6e5de823befea722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243821, "uuid": "795fad1a-1805-423d-8602-1a72f61d5a74", "value": "T1AAE3029667D49E13EDAF07B03E3208656876E328AB5297DE24D5CDFD021B12C83853F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243821, "uuid": "a38bbf84-46a9-4ace-b8b1-6c0823b0a417", "value": "3072:+uFMwWLoFZxhnD+RGn5VbdANo0Li9PetsX8bicu:+uFM0Xxhn5eG9Maei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243821, "uuid": "c4270298-f6df-4638-9049-2ef2892068de", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243821, "uuid": "548e2df4-f5fc-4506-a1d5-35958cdad4e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243821, "uuid": "a8168d3e-c3f1-4b3b-a65d-47c5625e62b9", "value": "84b26041b213bacb5271c23beefe1d47d7150c60e4aec1a463025e115ec45354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe7e564-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246350, "uuid": "0f2a6924-98f4-4c8f-85d0-b0cc667a9606", "comment": "Malware payload (Formbook)", "value": "65904dc3e1ee30386bee207bb76b7a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246350, "uuid": "edba7368-8293-4893-a0b1-29c96107d1e2", "comment": "Malware payload (Formbook)", "value": "851cfb84502c1e3d984f09a7bf320ff6bc357f6c2db75c86d227734569d5e8fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246350, "uuid": "5fa60ed8-3b88-45db-bc13-0b716c7722cc", "comment": "Malware payload (Formbook)", "value": "6eb0b995c76a6f68a0650f0968a11d14d89a6f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246350, "uuid": "6d2e0d50-f4c7-4e61-91ed-be6830a17d11", "comment": "Malware payload (Formbook)", "value": "c7029aa382b40b745237cefa9a15cce9473f7c90f37eb7f02d58c19ed13a5f818580d88aae5b8e93045201fda8ce69fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246350, "uuid": "1785f85f-7a67-45d7-8983-d39268959857", "value": "T111352218226CCA06C4A78FF81971D2B257785DECE524FB4B5FCA7EDBB8B8B150605213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246350, "uuid": "c6426231-c746-413b-b41b-73739844f741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246350, "uuid": "e77ffcff-2da1-49f7-b172-574756d5df31", "value": "24576:0XJsEo49VG+Mm590eMYQUHs1RGZmwbr5hMDN6A:05su990e9HAHwh+DN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246350, "uuid": "e4264ca2-ddc4-4e18-99d3-1daedf3ffffa", "value": 1103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246350, "uuid": "5bfeb3ec-1077-425a-8ef5-f527fe884fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246350, "uuid": "b31feeaa-4605-47ec-a34b-c681cc04a879", "value": "851cfb84502c1e3d984f09a7bf320ff6bc357f6c2db75c86d227734569d5e8fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa9c13f-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246475, "uuid": "a6a6866f-de21-408e-a361-aba756d66c3b", "comment": "Malware payload", "value": "55fc543abae376c4e8e9e02e5fa3b2ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246475, "uuid": "b9aabcab-f594-4544-ace0-1a94b96c0f34", "comment": "Malware payload", "value": "852df25764974a847a4b7aad7d835a87888f5177aff87a0e1f23c3045c83676c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246475, "uuid": "4501a62e-a616-4ea8-9c28-2002206fac9e", "comment": "Malware payload", "value": "ffcee2598f18eb003000f1bfe7a131b28ebe4243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246475, "uuid": "a970617b-e556-4f45-a6a8-dcc41ad1c0a5", "comment": "Malware payload", "value": "5e7626df3fbbc7ae7b3ee5c624d217104d284ccb280ebd33b685f7ea14f6efd66edd748e5025f6cb4309391e060ac39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246475, "uuid": "e7f2aa3a-13b0-4ab3-b29a-f7f2ab25024d", "value": "T109C42016EA61A42FF45389B0697996467C2D3E721680EC5BF7801F9930B09ABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246475, "uuid": "9a800b0f-d829-4e5b-8540-129c4dff83e3", "value": "2b7569a7829d33e4f685a04c0d57f1c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246475, "uuid": "04cc16fd-ade1-4e1e-8063-8cd803bb604a", "value": "12288:v1kBW4nbrEDGeIakAzzHUK2w/7AAD1y9fDvXGLBLlkzhM/J3ujH+mB:v1B4nksGUhTMJ3ubz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246475, "uuid": "e98dd661-5b1b-4f38-991a-bfc38dfeeccc", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246475, "uuid": "caefc01b-f008-4625-a6d3-ba01b2194b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246475, "uuid": "a4467797-2759-43db-a342-0c0f12911436", "value": "852df25764974a847a4b7aad7d835a87888f5177aff87a0e1f23c3045c83676c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38042dc7-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281019, "uuid": "b4463204-f7a7-453e-b2c5-b131099de1f8", "comment": "Malware payload (Mirai)", "value": "2fff7eb7de343b909f614ec15ee74fd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281019, "uuid": "ce78f5a1-2be8-4c9e-8d08-dc452129697d", "comment": "Malware payload (Mirai)", "value": "853ff7d9ee6129a01fb4dd8eba9c72d73c1f118755e6fbcbd9a1b0ca341df660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281019, "uuid": "b1c99d9f-aaa3-4d56-9424-f5aa486618c3", "comment": "Malware payload (Mirai)", "value": "bb7c8b7a946fefed3461ccaea7bfb4095c2c345a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281019, "uuid": "a995ceed-5880-45ba-b38a-488539d2fdc7", "comment": "Malware payload (Mirai)", "value": "aab26d9ff0e8ae5f4161b32006ad70f122faa67be3378f9e93389dd3b87f2bac330823cdb7b895d1b2f4dfee7a87a6c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281019, "uuid": "f7a401af-3581-41f8-8fa8-0f372c6b55ce", "value": "T13AA329C1F68B84F9D54B48704066F33FCE32E52A8071C96EDF99AF36DA37641921629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281019, "uuid": "22cdc145-0b43-49d7-806d-9c67ed20ed96", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3s6SNCoUKcnsEW+QuY3uRa:ZTFPbQ0yhOEckEUI6A12ZHTz1Kmn0jF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281019, "uuid": "6d1d671f-1797-4948-beb0-d943ddede79a", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281019, "uuid": "a838ae51-dc76-4612-ac5e-4778cb42ab89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281019, "uuid": "a911bd3b-9d53-40ff-9fd8-5dd1d484d7ae", "value": "nerv.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396b4c87-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281021, "uuid": "e3e82ff5-c33b-4613-9a5a-463c8fcd30d6", "comment": "Malware payload (Mirai)", "value": "e0ebec3ffb4c4cdeb5dfbd2efd8fd76b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281021, "uuid": "9826fc3b-cea8-4a2a-9754-322cbeb88cbf", "comment": "Malware payload (Mirai)", "value": "857efb0e755a791aa28ac3f13a9bcfc9683aceb631e97fcd204fa385c74759e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281021, "uuid": "3a03d9f7-54cc-46d1-ac5b-ad2be417719a", "comment": "Malware payload (Mirai)", "value": "95e164f6254d7eab24c37bff636ae98f7e49420b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281021, "uuid": "37833a86-702a-483b-a8b5-e750e6572ee6", "comment": "Malware payload (Mirai)", "value": "7a01a9f1f69a7b457313361983dc25a6b42ff6e321e6f66ecd93bb047ab031f75d7f7f9389defe285a909c351bd0d4a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281021, "uuid": "7da1cab6-d2d7-48b4-9b4d-70bff28a1ae7", "value": "T12CB35C22B9751E2BC4D4A8B661F34361F1F3579E21ACC61E3D710E8EEF246503257AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281021, "uuid": "37e7439b-64bd-4021-a0d9-1cfe4f3d54b0", "value": "1536:3t/ikUw0qX/ySCcYIUkKrN8v4AOaOHqkDfBAXoCJdhIyAiWr2IdtorNWq5F9AcU+:3pDwN8AA8h3CGdmrNlDrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281021, "uuid": "4298b397-9020-4cd9-81d9-22a6a7b89a6f", "value": 112644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281021, "uuid": "b7d43bc5-0cf9-478f-ac0b-9f41dc5f85b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281021, "uuid": "37f4cb8c-e37d-45d3-95ae-66703cdfd0ee", "value": "nerv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14921ae0-4ad5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778241445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241445, "uuid": "0f128bd9-a95d-4420-b734-42e261bf6a3b", "comment": "Malware payload", "value": "eceb3c407ce75ccc85ea2591f8ecb6c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241445, "uuid": "ab62a7b7-e544-4ee8-9c1c-4a66b99dacd0", "comment": "Malware payload", "value": "858d9aa51ece9c181be06012a00deff2f4196e531587350fc68ae4b8279677a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241445, "uuid": "4e5d1b80-2b2f-48f7-b76e-7bccebf8b2df", "comment": "Malware payload", "value": "7d06a98317f512686065c70ab7d3ef26767b8706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241445, "uuid": "98f3ab4e-c4c3-4fa3-b8c3-63583d0342ba", "comment": "Malware payload", "value": "fd9fe91ac60e765c0d40145c10e18c689f9eb7f6f78a249f2e50c7bf8be3edc802f12f47f711dbc5dd9ac67efbbf5060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241445, "uuid": "3314d056-19b4-4e99-895d-c19192ce0f34", "value": "T1512833842658CB67D112B83A90FF52500DF21E6BC27C659727F2FF8226D949AED23C17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241445, "uuid": "65428410-7c75-45ad-8f88-26c9beeea515", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241445, "uuid": "a8a9a23d-999c-4e06-9078-90cf92ac9d20", "value": "1572864:bQ2/TWa3Dvq8sWsc9TI0p7+/gA+FzT7AGzbPOw5mU5sazgdyFu:b93Dvq2i/gtdT7Agb29YsMQyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778241445, "uuid": "ead3c8d3-73aa-4ca8-b2b8-f3415b3569d3", "value": 93953250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778241445, "uuid": "00a80ff7-34bf-4a6d-a637-745e46aac944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241445, "uuid": "9c9a62a8-5a3d-4c3b-88ed-79a0d9aaae42", "value": "External.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14948d2-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244285, "uuid": "63804245-7f60-4ac0-bd6a-9a46fea443f6", "comment": "Malware payload", "value": "7ebe53522d7ab94e3ef4d3f3c628eb20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244285, "uuid": "09b8ae7a-3ff1-419f-80db-474ea10aae27", "comment": "Malware payload", "value": "85c0ca7e829e54bc1e9677dd14e1850a4bea01384d4d99b8b13abe44d5e1f61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244285, "uuid": "23ea935c-e05e-4fd7-a73d-2d8d0946edbc", "comment": "Malware payload", "value": "584697e8adfb7ab128216c421a62cfe6a9c13085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244285, "uuid": "324c92c5-8088-4138-b6dd-40b782204ecc", "comment": "Malware payload", "value": "edd6b5296742ae4ae578cbbc5f74223fc0f1823254eef81be7034db9a1f12b7085cbe659ccd415dcb4fc2c327eb81836", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244285, "uuid": "b2f1e8c6-8ac2-4300-9850-282e10490dc7", "value": "T12CA4CFC0F50084CAD5FD06B37E5BA22532B47F68E5F1623753A6329AB4F32D1252EE08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244285, "uuid": "492beacf-5600-4572-ac51-38c8457e24a2", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244285, "uuid": "e791a5e3-4c99-4b19-a7b7-04bbbd34cf4e", "value": "12288:FcuUgFO9l0yJAAv74cOGzNU7A/heuPfAC1:FjE9bZcd7SheuPfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244285, "uuid": "163a0a9e-bd95-4f3a-a283-5743bac3a690", "value": 477692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244285, "uuid": "6e16b749-a21c-453d-a65f-ccefe2038d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244285, "uuid": "3b39ead3-aef1-4087-b305-d1a73a8a8276", "value": "85c0ca7e829e54bc1e9677dd14e1850a4bea01384d4d99b8b13abe44d5e1f61d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b741b55-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265052, "uuid": "6d14ad12-33e9-4794-ac64-acf172d607cb", "comment": "Malware payload (Mirai)", "value": "7f38aa1fb4201303c927d2275ce226c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265052, "uuid": "ede8aa02-1c1b-4419-9597-0511dab8de51", "comment": "Malware payload (Mirai)", "value": "85d113560aaf7593f716ed5f9b01e01523dc580cb654357cf78509125e5396fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265052, "uuid": "191a28d0-7ac0-4e60-b3b6-d8876f9ca12e", "comment": "Malware payload (Mirai)", "value": "06e864771cee9f3c53d16fc71e9467ee7a427a95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265052, "uuid": "49b52892-9f5b-49ef-a9cb-514f5be8a23f", "comment": "Malware payload (Mirai)", "value": "95c546678ec4351073f7b7b509162f1e3b6b869fec210e28ae08a7918bc93980a1b47c3f1c935819a76bd2370ff142ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265052, "uuid": "15847db6-14a2-4c4e-9781-ed57a91b8830", "value": "T18293C54DF964AB29C7E232FEFB4D028E332B1BE8B7E6B011DD315A5533C8B965525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265052, "uuid": "2096e0bf-5f38-4088-ad00-3c0cf596dadc", "value": "1536:JAnxiynr9rYUUE2CW1bjQpVw0DWXlVwGvVC/X4DQu3eI7+lJyUeiHb5Sztjv7S:Q7r9rYrEnRhDWXnzC/X4DQu3Cnb5S5PS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265052, "uuid": "100d0fc1-f472-4c42-a39a-fca864a4dfcb", "value": 94204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265052, "uuid": "5d4b9f99-6be7-46c8-80c8-38a6213fc1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265052, "uuid": "8ce5edaa-ff1c-4713-ac07-6b7eb84e9303", "value": "nexus.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5df0f-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233401, "uuid": "852a597c-c9f0-4b11-9c77-b9c06dd013f9", "comment": "Malware payload", "value": "ad80f5c231b29f8bcb1864bec63e82c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233401, "uuid": "cb999a7a-4497-4096-aef1-fa7964860e11", "comment": "Malware payload", "value": "8635686a46d38ac506d4a9f05a43fec74f15d7d8979931a2ce9a1adba0a5d452", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233401, "uuid": "1a913859-da12-4e16-aae5-9cba896c8832", "comment": "Malware payload", "value": "554fe1bf1fc6680e51cd8aa01279bbd9dcdec3da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233401, "uuid": "3b31948a-ed7d-4b92-8f77-048f3b597e39", "comment": "Malware payload", "value": "49d9381b56dbe8a9273274567bde6753c05b3c595ae664df55763af1f02ea799c70831778196d82718a0dd9cc1f3cb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233401, "uuid": "331227c9-68a8-4888-8e50-59d11c705425", "value": "T148133C15729A0695E826D534CAB73B33E673B881F179B69F7790C5093F6200398F0B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233401, "uuid": "11914059-7911-4499-8d92-8445985125c7", "value": "3ad1e2dd4da5af2fdfa7e963655269b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233401, "uuid": "af614989-f7dd-443d-8fdf-8145def81c87", "value": "768:7+jSJjGoiny/6bkbYu/afXhu6XnNx29s0885VXKfcFGtK5Zi1xya:qsjGoQbkbZaJBms0885VXDGU7+ya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233401, "uuid": "45437e40-c472-4d72-bf1c-20c1db34cd60", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233401, "uuid": "213c7080-f657-4360-8bbe-b4b01e5ec933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233401, "uuid": "e2ba02ee-ebdb-41fa-95b0-fa459755ff26", "value": "ad80f5c231b29f8bcb1864bec63e82c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce251498-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778234026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234026, "uuid": "1b17c3a8-51d9-44be-a404-60c62be84e71", "comment": "Malware payload (RemcosRAT)", "value": "739715804e9d26c489cf800b93a496b1", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234026, "uuid": "a0160261-ddee-403b-a779-828fde4960bb", "comment": "Malware payload (RemcosRAT)", "value": "8727a772a0995a13381b080351b4224c491493477802ab47ff4975d49bc5da85", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234026, "uuid": "cfbcc33c-ca09-4f44-bedf-2d6714719b5b", "comment": "Malware payload (RemcosRAT)", "value": "e6bb19ef9283d21d72fc7e1896dab285e5733c33", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234026, "uuid": "23803812-49c3-45ec-8404-d1502ba55a90", "comment": "Malware payload (RemcosRAT)", "value": "be33b8ba2616737a01a0bda46b26d06c9752b0d7e6b10b0b29e3e4721c9479c6624005a610044bf2ace202c6b8224cac", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234026, "uuid": "9de3a790-fe11-4182-b08a-e92cc67ce037", "value": "T105B37C20ED380A7A0F535B9EFDA50762C9FD8209462650F1F6DE470D61065ECE3BE3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234026, "uuid": "a0998978-004d-41ac-a179-7ebac7ed521c", "value": "3072:EtjIKshkfJi2GBCuymInYCWKy8UVLpY6zV:E1I1hyi2GBrbVC7y8UhpYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234026, "uuid": "59f7bc2e-0bf3-4def-a94a-1fa8701bafb2", "value": 112162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234026, "uuid": "cd361801-39b7-4d43-8bbd-a31421663a5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234026, "uuid": "3f7648a0-2b14-43a8-bf5e-06ce6a943a84", "value": "awb_fedex_original_shipping_documents_bl_tax_clearance_custom_duty_2026_07_0000000_new_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d612e9e9-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244777, "uuid": "c3740324-8d0f-4440-80bb-4acd57030d55", "comment": "Malware payload", "value": "875c81ad8ce7dab79a518d45a139d381", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244777, "uuid": "c243257b-068d-4927-8d49-d70a8677b18e", "comment": "Malware payload", "value": "872a6b7ea30dafa530c11f79e5d9626baef78a9eea3feecd108a4ae451e68cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244777, "uuid": "4c8041b1-11fd-45e5-82dd-7a6f5fb83d64", "comment": "Malware payload", "value": "368b40c7376f63393f98b4beebbe3570bd0729a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244777, "uuid": "3583e0c3-c137-42b4-9aa8-d7a36d20a5b0", "comment": "Malware payload", "value": "dd823d77470190fa1e685ddb50ea716658c013121587ded4782e1e8ee0bec532aa13adc5b3a79a2b4f7f45a7cda120de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244777, "uuid": "35a99aac-1e62-4e81-89ba-6a5f63298ad5", "value": "T1C5E2E729A3D5E570C15B237027D3D9E112E2DDE68E370619ACC8F96BEAF33045B25E84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244777, "uuid": "0abcb58a-cded-482a-a32f-e180f8331237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244777, "uuid": "98168311-8b37-467e-a0b0-e5a639b1b9fb", "value": "768:Iz57Ngy0RKqlXbFZax/2IK+zKsUSUaq1LyJQz:ZlXb7ap2IKC/3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244777, "uuid": "5107114f-4126-464a-b88e-68e82bad35ab", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244777, "uuid": "0e23c221-459e-415b-8b27-d6cc8ff0e91f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244777, "uuid": "2bd6c49b-03e5-44fe-ad62-547208575977", "value": "872a6b7ea30dafa530c11f79e5d9626baef78a9eea3feecd108a4ae451e68cbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7692aed-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231518, "uuid": "777bb481-6a3f-4037-9056-28ac9e6b12f1", "comment": "Malware payload", "value": "352abccac849425e9ed2359842d4ead3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231518, "uuid": "deae7f9d-640b-48dc-b799-a5cadec85380", "comment": "Malware payload", "value": "87cd69f66b23d77c632e1131fb39ad49081c9cc7d1e25ef147a193bb51b85611", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231518, "uuid": "9f2e7089-a9ff-47b6-a1f0-37cfa720b933", "comment": "Malware payload", "value": "d38aa2113b03f6010e3d8fd60e548db746515799", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231518, "uuid": "fbe2bfb4-6262-4c33-9f20-96ce7b28373c", "comment": "Malware payload", "value": "a237be29892230cc226533f4ea5677ea21a07e7923ae9e9a4d6442787ca85c1dc3ca6ba31cb70867927bfa30a13314ff", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231518, "uuid": "ee37a6a0-5b3f-40f5-a6d0-4add353a1111", "value": "T1C8F6224BF308A96AD6F75335B93A436B64170D264F43C6877860B33D69B76C04A6EBC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231518, "uuid": "4a3afbcc-cc9e-4fb9-ac95-9cf8b3c75d5e", "value": "393216:ixJS9PJzDgVYDCR2G1wul4zqEGkSO/rl3:wkjvKYDs1wtzyO/rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231518, "uuid": "e15fa672-9e5b-4e79-8284-ed07f2878f7b", "value": 16286366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231518, "uuid": "45ade55d-5c18-4381-8ba4-9ab6f0c2ffd5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231518, "uuid": "2830aa0d-c2f3-4d93-b2d2-27bc6bad4203", "value": "iMobile Lite(9).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f7b051-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778242842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242842, "uuid": "0f86ebe4-3dea-4040-b0df-dac21dc87ac8", "comment": "Malware payload (MassLogger)", "value": "f466347e23bcfb517d887faf122c7aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242842, "uuid": "203c4ae3-00ec-4b96-8c4c-c89aa25fe595", "comment": "Malware payload (MassLogger)", "value": "8820f32e5cb85755d08b52a3a7c1e69ee05be2c77bfdd683b9d5bfc3990aba2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242842, "uuid": "06670dac-efb3-42d5-b2fd-747fc9c45e9f", "comment": "Malware payload (MassLogger)", "value": "35aca1324c61f14ccf6b639771e66e4cbc6d211f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242842, "uuid": "572d6e1b-7684-4d96-bb86-9d73df4c02ff", "comment": "Malware payload (MassLogger)", "value": "33a4020d92cc7b69c1bb80621a00e7bcbaf4b901c283784f395dcabada0bfc71c124b6ae7b1c1e8bf66a665f987df49a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242842, "uuid": "50216774-8655-42d7-9546-f05ea159b268", "value": "T12915F1482215DE02D0C26FB44E70E3B41BB89D98E812C3539FFABEEBF92D6566C441D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242842, "uuid": "931248e9-ab5b-4631-a028-e4afbb1ddcdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242842, "uuid": "04115143-5d00-471c-91c7-3fb71790596a", "value": "12288:NCFvLGwKXAaIVy5fn8smWVqv7e7DC3BDvz8u9vefwcmfkeCvAIe3sxRs:NCOAS5f83YCuUDvz8uErvAL0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242842, "uuid": "df328736-bbcf-41c8-8448-6b5c61cc8886", "value": 889856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242842, "uuid": "e30dd0f9-87a2-40ce-a5ed-53abfbaf93b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242842, "uuid": "9992f052-d476-4cc3-b38b-db6b8bc3ad15", "value": "8820f32e5cb85755d08b52a3a7c1e69ee05be2c77bfdd683b9d5bfc3990aba2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5a0039-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245839, "uuid": "6f16f0ff-3694-4b5d-9b3c-7838d5bc9b1a", "comment": "Malware payload (Formbook)", "value": "ec2130820d72a8eb0dc5e9068b69a240", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245839, "uuid": "4cb77163-29e8-4299-ba11-4f55260a5f01", "comment": "Malware payload (Formbook)", "value": "8829557f74020104084bce230997399bf7f4f43b79f7233ab7e0247556d352e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245839, "uuid": "a7e0cc68-1e5c-4596-ab45-eb22078a2388", "comment": "Malware payload (Formbook)", "value": "dc0fd4beef50df2c4046dd4b5481eb5d9994cdbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245839, "uuid": "4e21f028-6de6-42f2-8b6a-5a488d238576", "comment": "Malware payload (Formbook)", "value": "45a4645b5d7fd83aa956f68d98b4d4f81704d76119bda6ef607b66d40e23f1de2ca5f540e166f8f658337cd627e9be0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245839, "uuid": "1bd68784-b606-48f2-9faa-eedb158e8242", "value": "T13A5422DA0B67434EC440DAFC586A0A554F88913493C8B403FBF359D92A3EBFA3984B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245839, "uuid": "8793a3d8-99fb-4792-84b6-e6ddaec2537f", "value": "6144:nOu0pVN7WPVRLIDwoCAWQppH+J6BxiB9av:nOu0PxWPVJIEFGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245839, "uuid": "0aa9c6ca-169e-4491-9407-4aca071b21e7", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245839, "uuid": "da262437-6051-4d88-ac8e-18bf1d0a3439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245839, "uuid": "3c93c608-fe5e-49f8-8904-cc032b12db8e", "value": "8829557f74020104084bce230997399bf7f4f43b79f7233ab7e0247556d352e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3798460-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231377, "uuid": "73d70e91-569c-43e4-b9b5-52016996d64d", "comment": "Malware payload", "value": "4503fc13e4adecc1a377e58a7d1e265c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231377, "uuid": "77cb86a5-4b92-42ba-9219-6d898550839c", "comment": "Malware payload", "value": "88740276252861174ee4e0d98a6a7567a8b3cd8204dec646e4aee41cb8a17f66", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231377, "uuid": "98776848-5a78-400c-8472-3d3976409473", "comment": "Malware payload", "value": "46ab2f05fd017f25fbcf2840b46cb7b1427fd1cd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231377, "uuid": "9f8b5726-267f-46fe-bce6-3c13657fc5c5", "comment": "Malware payload", "value": "9530a6d7cee6c3ba8e61a2626d4a488e84571163b28c19b9da0857bbf6451be9f24c40a57156f2ba3d79eb34a404d566", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231377, "uuid": "f89458dd-021f-4762-ab38-0fab99681e55", "value": "T187E6120BF308AC6BD9F36335B936437664171D254F93C6876850B23DAAB76C04A6EBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231377, "uuid": "78c25c9c-98c3-4796-b1da-22e3c4fdad5b", "value": "393216:G0IrDJRr7Hr1YNgo8lRpSC1uZ6HuyDigGJoLUO:/IxR3x/186Hbi8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231377, "uuid": "2a69203d-7505-4161-992c-d8b52098f67f", "value": 14480032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231377, "uuid": "00f4f9ff-a914-4ff6-9e4b-6549cbd35fee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231377, "uuid": "90f2608e-3e3d-4d6e-b265-ceee031d7b0d", "value": "iMobile Lite(7).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f75efb-4aab-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778223521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223521, "uuid": "f9dfdd49-baed-466c-a4b5-7403d623bd75", "comment": "Malware payload (Mirai)", "value": "61281ca3281bc296a8538580a609b5ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223521, "uuid": "1f3c7561-adee-4dde-ad2e-e462e1391a79", "comment": "Malware payload (Mirai)", "value": "88860bf777dc3bfe072137fbb4497881b42cc4abf58daa6e1d0075c78bc0e442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223521, "uuid": "38bac951-43bc-4ff8-90ef-4d1ac0a93bef", "comment": "Malware payload (Mirai)", "value": "5b253a4b4c26892d5dc68babdb7a07d47a440414", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223521, "uuid": "97516867-2d02-41d6-aec4-cecbfe1323ba", "comment": "Malware payload (Mirai)", "value": "9dc007a44fc54ce856faebcf707a1a5a096b9c7b9179bc63b96e8b836bb3193f9743cf49d2f42492f36eaa6963d2fa25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223521, "uuid": "8f05b247-cb58-45a8-9907-2c3cfa7b5227", "value": "T179B3BF87B2907ABEF0A45E3FC4135E26A6259F705583273D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223521, "uuid": "29875e9c-b3f5-475f-ae4a-671038190d95", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzw8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSpUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223521, "uuid": "69a6ce1f-2a5f-4c4a-b741-3de692a79faf", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223521, "uuid": "6a518931-3921-4c34-8b57-7bbeac67b0ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223521, "uuid": "b0e527ef-bb12-4041-a946-aa71ae03c881", "value": "xnxnxnxnxnxnxnxnm68kxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1bd8a7-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242721, "uuid": "6546291c-1849-4389-bdde-610c3414dead", "comment": "Malware payload (Formbook)", "value": "a78819d6e4fc0f762e1a610fe754a131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242721, "uuid": "1f9bec80-fba1-470b-b558-937de0d36635", "comment": "Malware payload (Formbook)", "value": "889ed80f4a0402d52f64f5b0ee9dd3f5c3493077434d3429981f7eec417a58ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242721, "uuid": "9fe47ece-8fc9-44ea-a471-439feb7bfeb2", "comment": "Malware payload (Formbook)", "value": "2735d5785fac2e6ba75b2ff1ed905308427a7ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242721, "uuid": "1500c563-6d6a-4c4f-93c5-cf8ad40e17a0", "comment": "Malware payload (Formbook)", "value": "6add9d95388d44e1e278e26fd277bb4d9b0428c3cd4a704ba4e687afe0ccc7821ea8af0a43e1e3f029feb01a604f66d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242721, "uuid": "c10d2b1f-751c-4fdb-a0eb-1a8988a4eb43", "value": "T1494501083715DA12C8935FB00C76E7F447B59E88E816E3039BF9FDD7BD7A6522819282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242721, "uuid": "088fdb03-bdf7-429b-8558-74b16125720e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242721, "uuid": "f86a1fd2-78cb-49ef-a00f-76f3eacf9dce", "value": "24576:vq0OAS06obiGvsBijK0RzdkCINPNo3CpO+UrJJ:vq0FSobiGUBIK0RRkVliSATrJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242721, "uuid": "05ec8ef6-8707-4515-9a4d-d81eb1715e7e", "value": 1172488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242721, "uuid": "34e43f42-a550-487c-ad80-4b49a6e2ebc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242721, "uuid": "73103995-61f1-4bc8-940c-8b446e869ad9", "value": "889ed80f4a0402d52f64f5b0ee9dd3f5c3493077434d3429981f7eec417a58ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8273de5-4af7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256350, "uuid": "4263667b-29eb-41f0-99aa-f2b552287803", "comment": "Malware payload (Mirai)", "value": "b28da8eec51f80d1b695c48184f6034c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256350, "uuid": "56e42532-df17-468c-bb9f-e6f83661dbf5", "comment": "Malware payload (Mirai)", "value": "88d0e71a7b7bd08dac9398045752d5fecf1078c5cb7fcbc27ab23c7be7c72581", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256350, "uuid": "c011c15c-e566-43f9-87e9-a3d06fbf086c", "comment": "Malware payload (Mirai)", "value": "f3368868771f7700634265aecd3712d2b50951cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256350, "uuid": "cd7c8974-6f6d-46d5-bb9e-c7c1d9614154", "comment": "Malware payload (Mirai)", "value": "32394ed3c00e049e2418a1063da22e1a3ed128920af9c33b15816785d36651776ee1bd5d8040574e08a6c019ccbd5dd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256350, "uuid": "c45cf042-4959-4a3b-8774-641b8537b37c", "value": "T159E3C61E6E225FAEF3AD823547B78E61B75833C523E1C541E1ACD5121EA434E602FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256350, "uuid": "dc62547d-f384-42ef-9835-6a3bfe27d3f8", "value": "3072:cifBQMOTSBMDT3GrljrQYgThz5H//uFqghlYdaybwbZnCcu:cKQMeLDLGkz5H/2b34bwRCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256350, "uuid": "ac2e0974-10ae-48ed-8d48-e60d603d7791", "value": 152280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256350, "uuid": "1a8e6971-c0ef-4cd5-a7da-5304baf3d57c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256350, "uuid": "e3bf721d-452e-4d39-857d-e5a8af914be2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd457ae-4aa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778220949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220949, "uuid": "d1389be9-b326-4641-aa91-4453ef33a9bd", "comment": "Malware payload (Mirai)", "value": "b44881084568ed539d7adcfdbb2531d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220949, "uuid": "8b79f51f-ca9b-41eb-a635-f81be5cfd5bd", "comment": "Malware payload (Mirai)", "value": "89b60065bdc24667294ec0eea5a503a6efcff08dcced18ca68bbaac9783af91a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220949, "uuid": "a411fadb-a0ee-4d1e-a9df-88889858d2d6", "comment": "Malware payload (Mirai)", "value": "3e2cff120cded4f471a6e8d954ec6804a5f79611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220949, "uuid": "3ae542d0-04f5-4ec5-9015-e89ea572e00b", "comment": "Malware payload (Mirai)", "value": "4fa28475990e81e29be09cd9ce3118db2cc3ac89e8d4a803da98f0c740fd114a6f2043aa9b783f07a25b636b742ffcab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220949, "uuid": "0485ad6d-b03d-4292-a8ce-dbf3b182971d", "value": "T1A3C3F185BB636991D0A342FDA4C00AC387912E318BA217480699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220949, "uuid": "99d18a85-edb8-4244-bc07-34c16b3b12f0", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTn3:eMQRtXU9kLCP8ifbxTn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778220949, "uuid": "4b593f11-899b-4708-aee7-522e02991c9e", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778220949, "uuid": "f4a42bad-7ba8-46ae-bf23-56c0410de56f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220949, "uuid": "cea67615-1cc4-4283-a485-4460ee7da359", "value": "xnxnxnxnxnxnxnxnriscv32xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0f0c8e-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778243261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243261, "uuid": "9a5051af-1e8a-4ffb-9b0f-30a88c5abb21", "comment": "Malware payload (MassLogger)", "value": "bb69f0df22d444c6ab4af6f2bdc3fc7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243261, "uuid": "4fa252af-ad1c-4b43-a41a-f2bf64db505a", "comment": "Malware payload (MassLogger)", "value": "8a03ad25b92ea66d934e83e49072b8dd1147bda79fc057b38fac8aaaf850566c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243261, "uuid": "37e2d0ff-8445-4d43-ad65-be9c9ff77c2a", "comment": "Malware payload (MassLogger)", "value": "8c807291fa96260b93f50f050a65c6c9f8ce33e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243261, "uuid": "53879989-129e-4e3b-bfb9-a51275eb67ce", "comment": "Malware payload (MassLogger)", "value": "accf61a095280e84dfbfacbf52eb90bf55b02d17a14b50990ce812b837be8e92125adb73853d17bd03583e6c3f7bfa77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243261, "uuid": "958f239d-17b7-45ad-a3ec-3fee4909ef6f", "value": "T19C25E05823A8EF02C4AB6BF41970D37447F56D999422E30B9EE17DEBBD3970169043A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243261, "uuid": "5178af51-a0f6-45f6-8584-c6f08485771d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243261, "uuid": "bbd7544a-c240-4e70-9dc1-4d19e93ff85d", "value": "24576:/UxHClDW0oP6DFqueqsU9ILY+cdROt7EBRawp8q5AqSJ8gE9/0oSJJSHw:/UxHODW9SA+s13fwJAqSy79/XqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243261, "uuid": "c071251d-659d-4572-bd82-f1e16b38b748", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243261, "uuid": "53e638b9-f9e1-45bc-bd0c-d712252b7e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243261, "uuid": "8821a422-6576-4c45-95f9-fc6625d03ed8", "value": "8a03ad25b92ea66d934e83e49072b8dd1147bda79fc057b38fac8aaaf850566c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e210c1-4ab3-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackShades)", "timestamp": 1778226816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226816, "uuid": "e514dd9c-0022-4a6c-8802-c798385d809a", "comment": "Malware payload (BlackShades)", "value": "0e36b9096412d760c5f8bf040f62fcca", "object_relation": "md5", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226816, "uuid": "dc770f72-32da-49ed-bcb5-7138b436407e", "comment": "Malware payload (BlackShades)", "value": "8a3a1f3ba4f23572de3c13783bcd50142cc33933f5d17be646eb221c36430b33", "object_relation": "sha256", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226816, "uuid": "283bca66-b684-4cf5-be68-84957c04b676", "comment": "Malware payload (BlackShades)", "value": "acd7dcffd0b1b0183d20bf78c46739e57a6f5852", "object_relation": "sha1", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778226816, "uuid": "0e190c2b-c6e3-43d7-9387-1aa8381f047a", "comment": "Malware payload (BlackShades)", "value": "12e5f9dd4289e81b202a9d79edbc3685ff73263916872a54ff3f34d70d790a83a6b62ab4388cf284ab0f9dcf2b55cd65", "object_relation": "sha3-384", "Tag": [ { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226816, "uuid": "3af877c0-9f82-4c16-ba84-edcaeabcb7be", "value": "T153F4AF2375D2C036D4B301B25679AB625EBEFE314A319997A7C8194D0E385C0EF2E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226816, "uuid": "128ca01e-caf8-4181-bc37-ade5509e7d08", "value": "d94607e52ea4c2cdfc94e0d96c087fe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226816, "uuid": "d31f70ed-ed3b-4b98-8a68-959f547a09b6", "value": "12288:0qzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEeB3paPcg8X:0qzcpKIL0TvZzNlNky0wVW0wZxTVg8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778226816, "uuid": "0ace6a61-77b4-4bba-9b08-3115e66a82ee", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778226816, "uuid": "276258e1-06f6-47df-9381-67821b28bc2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778226816, "uuid": "d1a74786-5098-4df3-8c06-b0d95d4a588c", "value": "services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01265ac4-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778236259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236259, "uuid": "7edc9be1-253b-44ef-9c7f-262a714fede5", "comment": "Malware payload (AgentTesla)", "value": "a9bd90e72786958104229b6028106d7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236259, "uuid": "b85d8167-a7e6-446e-92c7-5919ad97f7f6", "comment": "Malware payload (AgentTesla)", "value": "8a50e77e71dcb8c92020b8ca5ba6592c8df6bbb1d1a117f0bff0ef563123b2f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236259, "uuid": "f32adb95-844c-424f-a5d4-65275a4c7b72", "comment": "Malware payload (AgentTesla)", "value": "391553b3b54b5a3f186123cbae1ced296232e073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236259, "uuid": "abca9265-7ca8-4c91-b293-2c5e5dea05ab", "comment": "Malware payload (AgentTesla)", "value": "1388ac4f177affe5a13dcf947a0d8381934181fba8a0ab26272f3934efe615d2b5dd350deec8e1fe37d3067dd7cbdb14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236259, "uuid": "285ffca1-1098-4686-9e6e-ea573474a01a", "value": "T179630DF1C95E352EC9CADA02FFEE2C65C85582489070F60E56B362FAD5FAB40C45B46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236259, "uuid": "7197099f-baf6-4fdb-a308-7ff187001611", "value": "1536:wokLDx2E0OrAA+UbR+cs0mhI7qprnU8plbt8Y8GrroZFnw7MK:wokLDx2POrAAFbR+cs0ma7qprnXplbt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236259, "uuid": "2320dfc9-064c-4653-adb9-ce4f76ce6294", "value": 72555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236259, "uuid": "14c34cdc-c215-4a49-886f-e93fda5de50f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236259, "uuid": "2d781496-8fbb-4d06-84ec-705ee6919564", "value": "BIK1911486_20260507.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0261b1b5-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243562, "uuid": "d22d28d0-60ef-4e30-ab61-a59d503c85e0", "comment": "Malware payload (GuLoader)", "value": "5f97c750ddfaff9e6ad0ed8b36932abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243562, "uuid": "dec5341f-9347-40b8-a49c-8f3ca1f4f11c", "comment": "Malware payload (GuLoader)", "value": "8a66296460548cb5512cfabca9cd3ef2333fbe495ad99ddcccc0701791f30928", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243562, "uuid": "28d4f266-0aec-4b72-9891-1331245ed6ee", "comment": "Malware payload (GuLoader)", "value": "d31c43561cbd38ed87ab829b00dbf1fc1f166e0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243562, "uuid": "a18bc97c-6881-4c5d-804c-0e5ad8107013", "comment": "Malware payload (GuLoader)", "value": "e7f611ec68c11b7b8b499f6bb4950013e9c234087c84b87963aa422cc5781b655d72de40c85eb766e6a666da04e03f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243562, "uuid": "2acb8123-6286-409d-b1af-e5d9d09eb18d", "value": "T16954122973A0C0B7EE254A331FBBA3BA06F0D62D41D5E79307A86B5D7C23BD0481E546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243562, "uuid": "1c896245-4578-4b9f-b066-c2de732bdcd4", "value": "9a16e282eba7cc710070c0586c947693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243562, "uuid": "c4d84228-06ac-4882-8faa-6df191c4f8f1", "value": "6144:4fYEbKkobtvU5+xxLC/RPBoqB1tyeTtLB1U+R69:2bkBUqwlf1tyeTtLr49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243562, "uuid": "747a3d41-cf8b-49c8-a31e-4140a93ae457", "value": 291992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243562, "uuid": "3bfd6a4e-27ad-4f55-855b-b768bb9dcce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243562, "uuid": "367db3f3-558f-4863-8bca-ac05207497c6", "value": "8a66296460548cb5512cfabca9cd3ef2333fbe495ad99ddcccc0701791f30928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11e5477-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246513, "uuid": "81bcaf7b-ed76-4da6-be6a-dacf096dc0ad", "comment": "Malware payload", "value": "75f7e44c911456d11b3500a5365e35e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246513, "uuid": "dbeded3c-6a8d-4a63-9f8f-c01ddeead313", "comment": "Malware payload", "value": "8a7c613f52015c1bf92ff55c80c4ed11168eaeb56db637895346d5c3eec6dcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246513, "uuid": "0fd3d59d-590e-4a82-b97e-014bc5252a3d", "comment": "Malware payload", "value": "276260dce5eab6e64b437d742748f93deab4657e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246513, "uuid": "1f8af655-6353-408c-8aa8-aefccbe6b77e", "comment": "Malware payload", "value": "766c7c8a104cd3863dbcb36354c08b6df1df5d50017d98073129d239d14364e8d13caa3d72c1c23e9538f724190f3f4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246513, "uuid": "ef181a62-a21c-4b4c-aaf6-af9215067dda", "value": "T1B7C44116EA21A42FF45389B1797885467C292D361794EC5BF7801FA930B0AABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246513, "uuid": "6ade1279-9754-44ac-b8bb-56cb6cca9d7d", "value": "2b9b06d416dfc60ab143d46f0fe6ace3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246513, "uuid": "fa171a2a-9370-4204-a4d4-b10c9e7ad1f9", "value": "12288:jcD+uT0uAffv1udBd95nKOSr9lz6E1pZMEF6FRhhtKTUJ0x//:jrhPdudDdqzVpqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246513, "uuid": "114f7f05-d158-4bb2-af4b-73907e9bfbcb", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246513, "uuid": "23ffd893-2fb6-4baf-9f68-af36f7b5f106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246513, "uuid": "1bbe7461-5774-4e51-8227-c066c65063ce", "value": "8a7c613f52015c1bf92ff55c80c4ed11168eaeb56db637895346d5c3eec6dcd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e61986cc-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778236213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236213, "uuid": "b12e7908-3fac-4c5e-a603-9a365351e5f5", "comment": "Malware payload (Formbook)", "value": "a1223ed89a9736e45018324085a51431", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236213, "uuid": "368f50e8-6560-40cc-9658-4eb746226652", "comment": "Malware payload (Formbook)", "value": "8ac694efc62dceb25f56c2bf25e29e97399af497e8742a49dc51cc98def1bd68", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236213, "uuid": "33f3d250-efe2-43a2-9b80-fc975ee90287", "comment": "Malware payload (Formbook)", "value": "70a706a753864cfe1f66f43ff572c8a78ae0460c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236213, "uuid": "bcf76f1f-05d3-4f53-afcf-7bfd2099d904", "comment": "Malware payload (Formbook)", "value": "f6c971dd6fa58ccf18ac2efbc81f16af41172b390ae615990616792efac9d7dbe92002869e8e05f578437cc4df2d5b14", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236213, "uuid": "74ae20ca-d4b6-43b5-9f0d-705de737f902", "value": "T103E55B17C66F574D180A3F61106A5D9AFE89CAFCEF726BC4E0CF90B610EA1110B856B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236213, "uuid": "1280bbaa-1f0e-4505-89fc-12e4d47d7276", "value": "49152:GaXOh9wU7zQ3MSTWPEcYfaI5LuadoRpMVpO05RmP7QJM+hQR2nqfzGDDSXvEFHXT:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236213, "uuid": "4042725e-c7bf-4665-910c-acc4d22751cc", "value": 3123359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236213, "uuid": "5606c8b2-0c6b-4d26-9883-08c332005b00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236213, "uuid": "4fb41167-66ba-4e6c-8ed6-2c6d9495e3d3", "value": "PRICE INQUIRY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6968637-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233986, "uuid": "b10637a4-043e-498a-8b36-3a01dbc5ec86", "comment": "Malware payload", "value": "419760bf65cd6af9840de9663054857a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233986, "uuid": "c3826f91-42ff-4b52-a080-57503a642ef4", "comment": "Malware payload", "value": "8af03cd6ef37b820bcfb85fc2cf605c451e2822bd07c22941f8677c198240176", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233986, "uuid": "6e6d5ab3-53d1-4653-aaa1-c99c49c59325", "comment": "Malware payload", "value": "203d2cf6490d3503428b45fca9d265e904fb5eec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233986, "uuid": "49fc0f5e-1cdd-477d-85ff-dc2f711dcefd", "comment": "Malware payload", "value": "f242606a7190b974ec514de85f63e3383fa9d889a8a9e5713f56345d887cce52f8f5463e5244e09a101f19d71fd1b2d4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233986, "uuid": "98b3dfdb-5fb2-4a0c-8b65-02619554e4cb", "value": "T1D607CD23F5056996D9D6A235F1E3279132301E440793A279171FF02AFDF26CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233986, "uuid": "5f6b9f55-af38-4092-b648-4fe3af8b0820", "value": "393216:cwtWAQsVC93z5quGVxwHVxOzm7XzFkQedmeeBp:dWDa+5yqKy7BheUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233986, "uuid": "4b3a6c7a-4ae7-4b45-899d-e6621cb65dff", "value": 18085453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233986, "uuid": "7b8bb530-7782-4323-bfe2-5ae49ec1bafb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233986, "uuid": "a71394a0-7db8-477e-b93d-a6c35611aa50", "value": "IndeMobile (4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18676c1-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778236233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236233, "uuid": "f8bd9ff4-3e50-46e0-8e35-31e78efb13fa", "comment": "Malware payload (XWorm)", "value": "67d400eadce80b392059bccc3988f92d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236233, "uuid": "78d53141-ce31-450b-85d1-f61c62b44cd2", "comment": "Malware payload (XWorm)", "value": "8afccdede322e2e39f92fdf769cb62f50b0db775a500e941cc77b170a7d8b015", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236233, "uuid": "c32a2c4e-0de4-4d64-a231-2afea64bfa86", "comment": "Malware payload (XWorm)", "value": "3ea730200c753091a02a05327d46e19d50b1be54", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236233, "uuid": "52f77cee-6fe9-4e90-b3e0-191499c82557", "comment": "Malware payload (XWorm)", "value": "a16ad8b3d72e6e60011b0c55550a1d2959b290eef593b7e1d8a521caf23b95785a76ec08be193d397197c2cf679a16c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236233, "uuid": "f75658c1-74c5-4c7e-a336-62ad6f416668", "value": "T1A6965A85530D867E3756EF4D127AC9E0A98E21A65ACACB15700ED274B60DC83E3CF4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236233, "uuid": "e70d5b09-3371-4d79-a6b9-2672156a8dfd", "value": "196608:bRTCrD1bSKY6GwgGMpiUsVChdaQw0m4CamDdxF8viC555JLrc0f9ZVGwpwkEh3D/:bRurD1bSKY62pDsMhdaQwd4C5P8viC5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236233, "uuid": "f9b6af5c-d149-485c-8a2b-07c861ca693e", "value": 8812094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236233, "uuid": "b10561c5-4ce4-49b0-95ef-e515f903276e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236233, "uuid": "e9b35770-9963-410a-a070-f5f3138d28f4", "value": "PO# SD90_N_67563_NU8E_SPEC.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11abcb8b-4ab1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778225979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225979, "uuid": "f0a4f020-155a-49b9-9400-40a12597e73c", "comment": "Malware payload (AgentTesla)", "value": "a7d5969f45190415af9d25caf4f9b21c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225979, "uuid": "f2953cd6-f490-44e3-b19d-9272d4316f25", "comment": "Malware payload (AgentTesla)", "value": "8b8ca853a36d772f8fc6aa0ae71ee1f780d772d19d2ef1a24752ceae14d0fc29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225979, "uuid": "eda183e6-5011-4abf-8ab7-7484821d2453", "comment": "Malware payload (AgentTesla)", "value": "6b0c7a06a74d96181f0495a9a6d61723ff3c4260", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225979, "uuid": "bc9b4b07-d6d0-47d8-a7c0-b7cd1a6ba0fd", "comment": "Malware payload (AgentTesla)", "value": "6324b03985ee8fe3df291fab8062ca82191acc23ef3815e861ba42373d9438cd93a185ce39cc67d9b40d1fcb5f5ffe8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225979, "uuid": "171474d0-5f10-4ed6-8e8d-647fdd1d5e75", "value": "T1FEF539415A3A5470A66DD72CD03A66540A5D200B15C8FF3D34B862BCF2A2F5B2B6F8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225979, "uuid": "fa77d400-2a58-4a0d-b012-ff183994999f", "value": "98304:LytnJ6/W5N5q9UehgVOFw7ki0BzM6Pm+sZQM7fEULOP/wT5toSbg8pRr8aWGTj:Lytn15z8ZuVL7ksQgfxpbtRroGTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225979, "uuid": "aad9ce69-ff5c-4b0b-8346-b478bb36c7b6", "value": 3374184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225979, "uuid": "0ebbc0ae-748f-4415-acaa-da4b836ccb6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225979, "uuid": "50d166bf-3d35-4b80-a163-9698cd5f6131", "value": "SWIFT COPY.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becdc5c0-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238725, "uuid": "641be33e-ab24-4cea-99b1-0f10ff0ad528", "comment": "Malware payload (Mirai)", "value": "71cfbe25b1c4cbf05a8d685baf162d69", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238725, "uuid": "63c418c5-d75c-4b6d-a09f-d19c0777e421", "comment": "Malware payload (Mirai)", "value": "8bc45e24e54d312bd46cc428c4cd2a9bb5487b8e42f0477ee1d735d25c992614", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238725, "uuid": "6219c805-d3bc-405b-97a4-ba5fa273c3da", "comment": "Malware payload (Mirai)", "value": "c7026a51c7e186c0eaaaab45ad4657b8f8f8960e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238725, "uuid": "71508723-ed1a-4b07-9be0-e544e151cafd", "comment": "Malware payload (Mirai)", "value": "c70bb5543808952be0a098c626b9943c403e5ce9baa43d53e54edb02c9cce68b7cbfa5d0482910ecf6cba25b480aebab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238725, "uuid": "74075ff4-4724-4bf6-8a98-3b9beb41463d", "value": "T1DB83194AFC816B11E5D522BAFE5E028933535B6CE3EE72029D105F2533CAA5B0F77912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238725, "uuid": "c398ce1b-36f9-41f2-8ccf-7a522858c821", "value": "1536:Dunq+raLOfKE2PagUuHzbSzxnP2lqli9Dj0PjovY7W6W:VLOfKE2PaNuHzbSnyDj0PjovV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238725, "uuid": "b6afd044-43b7-4d45-8213-f594131621c1", "value": 81356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238725, "uuid": "40254578-753c-47be-948c-eedb2ae9c8db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238725, "uuid": "18e5fe4e-c297-45bd-8d9d-56f3f72c254d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d521a276-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243486, "uuid": "9a2ff3b0-fa98-4d2c-908b-3006a877ebbe", "comment": "Malware payload", "value": "c8d1d72c06cb5e1cfefd3f931e30f010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243486, "uuid": "7aa07221-2267-48bc-a5f2-6817760180a4", "comment": "Malware payload", "value": "8c50db6d4584bd1b4b691cfa85812217ae16e7098ba693948def75db3e468b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243486, "uuid": "b2f310d1-d678-40bf-9e29-9b822ab4999a", "comment": "Malware payload", "value": "a127e7a2fd6bc9b2b52601a4ee78a8bcfe644c90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243486, "uuid": "d6fccac0-5460-45f5-b987-bb35a39682a5", "comment": "Malware payload", "value": "2b82d3d5e0b94ef5a15dc04892b169ac93cc0c5af1e91453eea40ad5e639a738505ef0352e1c4d0787826fdfe176dde5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243486, "uuid": "3f5f28ae-3236-4748-a581-1a5b0fc638cd", "value": "T173350248221DDE01C5961FF41E70E3B807B89D99A412D313CEFA7EEBBE39B116945392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243486, "uuid": "674f3a07-2bfe-426a-a5d3-9550ded84058", "value": "24576:m1FyvSCgZNebNfyHd4xl6Nue3KNyUZRRJohTSJJSHw:m1qfgZ0NKml6NueUyU4hTqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243486, "uuid": "303c2cd0-7464-48f7-9c10-c8d68994e6c1", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243486, "uuid": "dceb7c9f-e8b3-4137-a900-f2d2279c2932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243486, "uuid": "a5612842-da22-4e95-8b29-7bdd13e1e852", "value": "8c50db6d4584bd1b4b691cfa85812217ae16e7098ba693948def75db3e468b7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1013fa-4ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234185, "uuid": "a734cedb-29dc-4255-a758-6331e27933a8", "comment": "Malware payload", "value": "e61432b299f2c5f409bf21eef9038d91", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234185, "uuid": "e983b4aa-6adc-4377-b7a9-523f2c8ee879", "comment": "Malware payload", "value": "8c5520ff9277608007c52c2fd67deba6cfa0432f209a73fa62a567da196f10a4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234185, "uuid": "579a8fb7-5574-48a9-a6eb-a2d5ebb4e267", "comment": "Malware payload", "value": "16aad4287bf7d445e91768c1075f103a0f207597", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234185, "uuid": "9ff15c38-3e27-4e87-899f-b79d524f99e5", "comment": "Malware payload", "value": "4a8c287073c2b1f078b260dc7bff0d64d4637b56f202d2f6bc44b3cd6d3432049261fda7008ab22b88569ddd2cfea381", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "IDFC", "colour": "#2E569D", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234185, "uuid": "5fc70a1e-97d6-4e96-99f0-eb93144e9b94", "value": "T1C5F6BC23F50529AADED6A134F5E7579533301E440393A229271FF126FDF25CECA26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234185, "uuid": "434cf96a-1ed6-466e-9fae-2cbde302d7d6", "value": "196608:8QKC2xli0oT/7zVUsG4Xa1w91x97WnoM3b8QTLe2c2BMIJkg8RGFb/G0g:8BxM3zVUT2aW/LWnHrZLeIfJksb/ng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234185, "uuid": "49e1f64b-c625-4f99-9579-8644022769fc", "value": 15430504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234185, "uuid": "bac82ec7-1e92-48f5-a61a-09ab28bae809", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234185, "uuid": "13b81c60-c43b-4f90-aff9-dbde13270b7f", "value": "IDFC FIRST LITE.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19943cd-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244715, "uuid": "f769dbf4-db82-4f43-8cf1-89ceb5308ca2", "comment": "Malware payload (a310Logger)", "value": "167622c9f0d54ef2b32c8d7ab6dd6438", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244715, "uuid": "da775954-71c7-4fdf-a3a6-f04f56315858", "comment": "Malware payload (a310Logger)", "value": "8c8bee95d659761b709ea90fe333cda157001a4d1d98a2045b0f8ae2e1ca6d30", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244715, "uuid": "e6566820-e452-409a-9b82-b2744fbbd2b6", "comment": "Malware payload (a310Logger)", "value": "962053cced3890e161132a452452aea2125bd321", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244715, "uuid": "352f542c-de3f-4c7a-a77c-f628a52c46c9", "comment": "Malware payload (a310Logger)", "value": "cb3da59bac5f93cb5a4077a67502d314c0a30f628edb6bf210ab4d0020ee562f94fda80fb1045afee0faa78d2057d0ce", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244715, "uuid": "cf4eea16-a572-4b11-b4c7-9b25477131b5", "value": "T1B6944A13EB60A11EF1A389B1B8B5925A68277D351B98EC4BF3409F1A35715D3ACB031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244715, "uuid": "6481c33b-2605-408a-8fe3-5e2eda2b12b6", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244715, "uuid": "4f7ce5ae-fde7-4969-863a-06c59a3d83f0", "value": "6144:x18d1/w5KA81IJ8GpF6nuTmOOUiBUrj59fkwnvbtA+ttxGqrrySjKdMKY:kjYKkJj6GmZUiqrbrtxrrySjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244715, "uuid": "cafa6313-5d9b-46a4-9f60-f17f7f0f264b", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244715, "uuid": "344f7228-62c1-4e0b-a906-daf1d5d41c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244715, "uuid": "13099a68-0637-46de-a94a-86799cdc5b5a", "value": "8c8bee95d659761b709ea90fe333cda157001a4d1d98a2045b0f8ae2e1ca6d30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b76501-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778243387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243387, "uuid": "dbd442e3-937f-49ea-91d7-23f11fb21e9d", "comment": "Malware payload (MassLogger)", "value": "f4351007824c5356d99ae5f8584d5a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243387, "uuid": "0a1efa10-e99e-4f40-a53a-f2072861a63a", "comment": "Malware payload (MassLogger)", "value": "8c9b59561bb5d7286f66749642e2dd63b4200daff8fed69539462d7ff06e59d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243387, "uuid": "176acaeb-5332-41a4-bd09-c25addb527f6", "comment": "Malware payload (MassLogger)", "value": "370ef964ae5fa2a4d5ecaabc0c50e2db5dfc7037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243387, "uuid": "284eeb39-eca7-4aee-a858-1d02428d3310", "comment": "Malware payload (MassLogger)", "value": "518d3511e4caa64530b9f9400e1c0ab724c380ac9820bba76ffe3f256da5b7cbd1a8a51b79a1ad350130daa5416a78cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243387, "uuid": "2d95ca1f-b153-4ff8-9757-1aabc10b11d5", "value": "T13915F1442355EE02D8A75FF00DB0E3B807B89D95A422D3178EF67EEBB9397452909393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243387, "uuid": "23cfa6c3-c822-4379-9e68-808982853e82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243387, "uuid": "f98aa98a-0965-4b02-b264-71508f35c9e6", "value": "24576:xjUI96mUMSEH+/NvqRETjlEIO4Nd9SJJSHw:xlYmU9Ee/kREX2IBqUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243387, "uuid": "9bf8550f-3d8b-48ad-ae04-a10f2e2ffc1e", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243387, "uuid": "f7b6a847-7132-4fdc-a3f5-cbdc911821fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243387, "uuid": "4db05276-e236-44d8-8858-dc6382654897", "value": "8c9b59561bb5d7286f66749642e2dd63b4200daff8fed69539462d7ff06e59d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a758cc-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1778243274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243274, "uuid": "a236f603-302e-4a0d-a782-85b2d099aad7", "comment": "Malware payload (PureCrypter)", "value": "72b16e7f3a8993ce43863134002f6661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243274, "uuid": "d9ed8f27-8ace-4275-96d8-7d24b4a41fbd", "comment": "Malware payload (PureCrypter)", "value": "8d7969e23939c958a13fff2fd43c372b32824e17a659d35cbc026d5cddde9ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243274, "uuid": "cd980f3c-334b-4477-88e7-47ddf6a26169", "comment": "Malware payload (PureCrypter)", "value": "e5ce55059f461e70b912167b26cacb19c94b8d1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243274, "uuid": "b40a924d-127d-44ab-ab4b-9b87a1a1726a", "comment": "Malware payload (PureCrypter)", "value": "98268b5eb055e7b20e2803219645a8a915bf3ce69d01df1a66f9eb35a26f7c1fd882f11f9cd3d3d5e470b7c9e7f6e73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243274, "uuid": "e7f7b81c-1e79-4860-b8d9-b460b31bc761", "value": "T1B005BF069B8B2F89E5FF0B7CC0561858A7F4C41393E6D2AB6FE840F61A67FC5C916250", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243274, "uuid": "98ee8628-edce-4466-be42-d68cf0e51749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243274, "uuid": "3f84d36b-6de4-47d1-bad6-dd22546e9600", "value": "12288:+IITsADdbxnqLJzUnxYMBzGIE8QyZAWvtMrYzuPAWvux:+II4kbxnqVz78GIEJ68Y4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243274, "uuid": "c7336a12-ada7-4b2c-b26b-0d3602a79995", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243274, "uuid": "114f1910-af7f-4791-a3cd-9cd44ffd633c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243274, "uuid": "b33c12de-231d-4396-960a-ca0f379d954d", "value": "8d7969e23939c958a13fff2fd43c372b32824e17a659d35cbc026d5cddde9ec3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb8a37a-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230727, "uuid": "c6a1004d-7026-44c1-802e-b82ad436cff4", "comment": "Malware payload", "value": "778e0b0178141095e2f0bd60f576632b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230727, "uuid": "c4a4796c-5303-4428-aff7-ef28305aeb37", "comment": "Malware payload", "value": "8d7aeacbd40df860b099e502a538f59e83368fba1b5eecedd111566e0f39c6f0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230727, "uuid": "ac12f252-8100-40e1-a07c-b20768dc08bc", "comment": "Malware payload", "value": "50daebae62139e913fee8f21a5df3dedd4ea224a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230727, "uuid": "62b33b18-1055-4435-a561-e88ace043309", "comment": "Malware payload", "value": "beefb9d2bc87739467b7b0816405d84a41ed58b536f6634fdb4e28383ea66b643dac3fec8c1e2d75e6478f636b52d512", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230727, "uuid": "418f686d-b29c-4693-a68c-b6a3dca31149", "value": "T1BBE612B3F7684D2FD8BB04710CAAB122561A4E11CE93E34B6908776C7A779D41F88BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230727, "uuid": "b93994a6-bab9-44a2-bb7e-c2618c871bfe", "value": "196608:vwPzqPR3F1LBTHSQL/NfqkFrrgRebsjRx5Vv2xU6ohps162TxX1orSSz2hEEcS4b:v8zGtF1VTX7pHaD1aU6oQTYSSKGEduUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230727, "uuid": "09c60327-889b-414a-80cb-bfc2aa2bf062", "value": 14743574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230727, "uuid": "cbb597f6-c565-4ce5-83d7-aa03defe8e42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230727, "uuid": "eca72581-682b-4454-af61-9348a427900e", "value": "arabianexchange.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b46303-4ad0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778239463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239463, "uuid": "a678edc1-d021-423d-9a3a-d36ffd091e79", "comment": "Malware payload", "value": "f181113e4c48efd9df438af9c6dcab8c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239463, "uuid": "0c03e42b-582b-43a7-884e-d227da0c5c32", "comment": "Malware payload", "value": "8dd68659fbf0a45418548d5b326ad5e4e6084fa3fed72ac28f3ed325d9ecdc5c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239463, "uuid": "b1c74749-ba47-4760-bce2-44af030700b4", "comment": "Malware payload", "value": "a6c70718da2b7d44e49dd29ce83bfd4a2c4a4de4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239463, "uuid": "52b9ae59-58eb-4c73-b960-349badfe7aa9", "comment": "Malware payload", "value": "83ae61d329995feb81734c4056dd2706dd9f429db3f4a4936c5632e585e2aaf803eaecc1e3a292574b0bb813c9b5e1ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239463, "uuid": "64375144-475c-402e-8819-d6489059a04f", "value": "T1D1217B96949334B24BC78C770B56F2C2950E621357638E4C7C5C9B145FE5423BC80EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239463, "uuid": "702b8e57-f8e3-4404-a7b9-e897a2114dc1", "value": "24:in2DOIRwHKIhZ43RNzJXALLwCOzMnIK4msFxAWVB:qCO1HKIw3RNzJXAL8COzWIK4msvAqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778239463, "uuid": "ae5b8c60-6a4f-4d92-bfcc-3002c4f88a76", "value": 1178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778239463, "uuid": "0d48b3ea-410e-4459-9354-6cd95fe87d7a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239463, "uuid": "4ed31c0f-1245-4297-843a-0af8eb06a3da", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc047e5-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265055, "uuid": "86975a9c-fa77-4c63-a326-2a28aa366c77", "comment": "Malware payload (Mirai)", "value": "58beceacad14de684183dbb81279fd22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265055, "uuid": "ab6e8941-8de3-4728-8187-e97232865623", "comment": "Malware payload (Mirai)", "value": "8e5911c3ef48df76861178b55296b4327fa61a95094ebedf18ba114795db2eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265055, "uuid": "eb29559d-636f-4581-9473-b312a250499a", "comment": "Malware payload (Mirai)", "value": "b1c4f2412d9fe7f3fdd910256985f1e38cf6f45b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265055, "uuid": "c62daa6d-6578-4f1a-86c3-98c5bf3254e4", "comment": "Malware payload (Mirai)", "value": "3811dcee1c0f391b0292142da13460f8a353eb5a2096fa69655bd3d219d375f342bae6dbf590090194fc3baf5a10a647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265055, "uuid": "7d1b442d-b476-43aa-8a34-a608e6c41e32", "value": "T1A40329D6B400BC7CFC1EE77E81174A09FA30B2585592173AA263FDA75C321A48A67F43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265055, "uuid": "07978e58-a927-4afc-8cb7-307e4006d57e", "value": "768:O733+TPqCxso3N+NLjpfXVlAu7G8EYpjWTo0Xu8IW0WV6yiZeN:ODdCmgwNJfFlJK8EYpUo0Xu8IW9V7FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265055, "uuid": "099c7bda-f93a-4735-a235-14c83eea6bbb", "value": 41184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265055, "uuid": "cd036caf-a440-4fc4-bc00-aea05ac11610", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265055, "uuid": "39311b71-53f2-4ed0-a427-44d23d43ca54", "value": "nexus.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce69e8b-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243312, "uuid": "7168ea46-f13e-4ff6-8cd6-973ae0b9e0d6", "comment": "Malware payload", "value": "333bc75ea8c1e8eda875b9c5006c24f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243312, "uuid": "1102b061-ff51-4918-a0dc-60aa17766753", "comment": "Malware payload", "value": "8f483461dffcc3ec1dffd6dd2a55e840e05ea8231f1e42408418f6878958c8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243312, "uuid": "e52e9817-66fa-4d66-a90b-4853b99f3d38", "comment": "Malware payload", "value": "7f50a3206fc0899535f1dae632f844bb4229f2d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243312, "uuid": "f1b507e2-8e24-4582-8459-f3d6c103555e", "comment": "Malware payload", "value": "aa2c429e3a85c1ba8baee18537cea33563d2f8fdca3fc941484411f1cde0f281405a2b5b1846d53ade462abc40a6b51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243312, "uuid": "16afcea5-29a6-4958-b096-8ee309793c2f", "value": "T13EB2C77CD1E2FDC4C75F12F028AFBBC512EA9B17BA2A071CB9DC11051A60754EB34299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243312, "uuid": "248d9c9a-4cea-4fb3-88e2-9a2bcaafbc90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243312, "uuid": "04050504-4c75-4006-b889-bda093a2dd24", "value": "768:nz57Ngy0R+mbFDZJ5rdTc9vFKSicYdsOAFJJrF9J61Q4:zmb9ZJ5ZTc9NXivdsOAFJJrF9J6a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243312, "uuid": "60d83c08-8122-4abb-95a6-e36239a4b698", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243312, "uuid": "93fb83f0-aba0-4f83-a08a-9ea8f183ff30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243312, "uuid": "3bca753f-6bfe-46ae-be25-72185b748be8", "value": "8f483461dffcc3ec1dffd6dd2a55e840e05ea8231f1e42408418f6878958c8c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f77525-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778243167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243167, "uuid": "99769a25-3e77-4507-8c4b-0667c879d986", "comment": "Malware payload (GuLoader)", "value": "857200529728d0e5612ca8c60e0b8b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243167, "uuid": "c00264a9-c7c1-4c80-a01b-040f375ad3a3", "comment": "Malware payload (GuLoader)", "value": "8fa37075a67ff2c04945fbb4ea35cf97ff33bff68665448415427508e36b6032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243167, "uuid": "bdb00bb9-2516-4970-9f0f-cfe17fb86a5b", "comment": "Malware payload (GuLoader)", "value": "cd787161b0537aa2b010c5daee2b7951b52d8a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243167, "uuid": "186b0d04-9ca9-473d-8b55-c548201b2d01", "comment": "Malware payload (GuLoader)", "value": "9284502c41fc7996e9bf1809097b425cc1054b75d11f25dd6d9b282dae0adfced1e1ede1d630e1a054dc6db0b40b520f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243167, "uuid": "52f0bc34-da9f-4730-8843-a38fe22689b4", "value": "T144441211A340E487DBB55730983AD7B71FEAED204159BF4713E27F2E3C612E0A82E55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243167, "uuid": "3fa3bd90-f5fa-4695-921c-21fac0dbaa61", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243167, "uuid": "f112abd6-0cf8-4cd7-8cee-c98f776a81a8", "value": "6144:JlHXelTPyoK48h+29eMuSB5aj1EUd3xBBcv7ncdqz1:mlTihvHfij1EUd3xBBcLTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243167, "uuid": "277e1737-05f9-4c63-bd38-49f2c55a9945", "value": 273400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243167, "uuid": "ceef7562-50ba-4c5d-a953-424510473873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243167, "uuid": "093037fb-33b4-4d11-9eaf-686e7c4d16a2", "value": "8fa37075a67ff2c04945fbb4ea35cf97ff33bff68665448415427508e36b6032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1254ff1-4aa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778220233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220233, "uuid": "fb544634-07e6-46be-99c8-3a148784e50b", "comment": "Malware payload (Mirai)", "value": "496f850b952315922d102d1f9e9e032f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220233, "uuid": "6a8ac563-9743-4f00-90e4-1b57843ffb11", "comment": "Malware payload (Mirai)", "value": "900fa056c8cbdfb7d6390c5557dfee104e2e8ec7ac43fcf37ded680499dcd1cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220233, "uuid": "2b6f76ba-a3f0-4a98-a655-7e89bf7ddc86", "comment": "Malware payload (Mirai)", "value": "9f1d86a95a6fbdf2953d0c2fa58bdf67c7c68e1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220233, "uuid": "441fbbe7-3a82-4264-92b7-09c25df3ccaa", "comment": "Malware payload (Mirai)", "value": "fa6a1e2085ecafc9ece422d533ebe5bd9468e243307716f47eab7a20eb74d331e4bbec8e43896373a65cca89978b8d16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220233, "uuid": "0ce2fc19-3f30-4115-9fcc-47ecfd56f5b2", "value": "T1FF53029111E5F429C56283F662008F06338ACA91BB06DDDC34CB132B6D9AE5F5F966E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220233, "uuid": "9df24f76-6419-4ce1-aba2-99ef9e0d1328", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl6CCELkg4azHH:XrREB5taUVLQlwtt0/ELGazHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778220233, "uuid": "3d529ee0-4bed-4f77-84e6-6d87ee3f2091", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778220233, "uuid": "b2f7f079-1184-4a71-8e7b-bf59e0ebc7c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220233, "uuid": "28722735-037e-4d25-9aaf-67080543748e", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1f1377-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243122, "uuid": "f239cef3-65d8-4713-a37c-103710603104", "comment": "Malware payload", "value": "26cbe986bba2349fcd56e8618eb491e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243122, "uuid": "7a365d7c-28c1-424c-a8ec-bc7782cc01bb", "comment": "Malware payload", "value": "90915d4ba46cd3e06e3bce8ae4dd01a9ff65f982b31b115426c859bc46282023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243122, "uuid": "99b56a1c-36c9-45ab-8637-ce2fb1dad557", "comment": "Malware payload", "value": "adc9d68d11fe4dc9a5b5637b1641996d6f40a087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243122, "uuid": "37a2ef75-631d-4c30-bc78-61cffdb26a2a", "comment": "Malware payload", "value": "1d1bc880153ad95557af910b9f7006de00d1782b5a83cb31c95bfd4927474811c79ff4cf5215282884ea0fef1548ba64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243122, "uuid": "877cb2c1-d999-4ab2-872b-24d3da4770a4", "value": "T1A24502482759DA02C5D22FB40D70D3F447B89DA8A426D307CEFA7EEBFD387526905292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243122, "uuid": "76a6b253-eb62-4c7a-bd22-f71f42281160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243122, "uuid": "720bb1fc-4e48-4045-9e35-0fc3e8a756b7", "value": "24576:vSJJSHwcjYiVFMnttLrNmpn7AER9K9U06hO:vqUwNiVFMnttcpn71LJhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243122, "uuid": "d4078e23-d1e3-499c-847a-eecb205a63f7", "value": 1183232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243122, "uuid": "208da78e-7126-4b3c-b16f-bd23c72e30d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243122, "uuid": "c8865bbd-42b8-42c6-aa29-c9cbec2f8ed3", "value": "90915d4ba46cd3e06e3bce8ae4dd01a9ff65f982b31b115426c859bc46282023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8883e0-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245782, "uuid": "4ad46e18-f2cd-4326-9cfd-2fd34ca72e63", "comment": "Malware payload (Formbook)", "value": "b5d7265c8dd5e243217ba5fe96b89c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245782, "uuid": "ced0d479-f312-4ad9-a122-d08e6926fd53", "comment": "Malware payload (Formbook)", "value": "90e5738f4dbb734726dc3b1875060db5dfe7fb161cef9c65ad6e06804e781ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245782, "uuid": "98d85c02-9bbc-47db-883e-ff2e45f76ca4", "comment": "Malware payload (Formbook)", "value": "09e40740d222e86c1a727ab9450ebec3164ab94f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245782, "uuid": "14a29199-7746-491a-a61f-4dcb7c8232fd", "comment": "Malware payload (Formbook)", "value": "1d3bf1139cce81cfa06786915d0d90f6ef697247a61b8af70111e9849114065bed83ab835fd58f0d03172cf978d0f8f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245782, "uuid": "32876465-8526-4761-b46d-05032d68e51d", "value": "T10A35125971A9CA03E4A61BB80D32D1B117706EDEB421D21B9FCE3EEF767A7040995323", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245782, "uuid": "75610e0e-3490-4761-b8f6-0a60da639a0c", "value": "24576:HKmPBOElOcpzYYTHx3FezOwSlDybS4nGxR21cTDxXd:HP1lOcOSHb4qn4OA1cTDxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245782, "uuid": "ac626da8-f7c7-4788-a76e-9b76e98361d9", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245782, "uuid": "6140aabc-3f39-4a72-b31e-c4738c86baa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245782, "uuid": "2ff55c78-1a2c-4e1d-8b89-1ee6385e38a8", "value": "90e5738f4dbb734726dc3b1875060db5dfe7fb161cef9c65ad6e06804e781ba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eee25ed-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265058, "uuid": "8c8984f5-121a-4bba-9e46-0d59b80d977f", "comment": "Malware payload (Mirai)", "value": "17f7c7f48471b1f0ef8393f6558bf62f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265058, "uuid": "156a5d31-c98c-4551-a5dc-a01a6be65737", "comment": "Malware payload (Mirai)", "value": "90f9c3f1aaec0a842e717a7a7c1219391b735efb73bc03054a866a15db0412f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265058, "uuid": "fb806760-83fb-409d-8ce0-88fd07f3b19b", "comment": "Malware payload (Mirai)", "value": "a9d5740cf2539c8c3d49079a71b1b68214715b93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265058, "uuid": "09967c93-5ad6-45c9-919c-b1fa4d0f0e7e", "comment": "Malware payload (Mirai)", "value": "eb187cbeafe2ffd5ffabc6c77f6b129f8300ff10641ccb019c7428abb7dd1e9c191cf0d81e20b93a4f12ff48673a3e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265058, "uuid": "476486f1-1110-4a93-b5cb-cc6f6aeacc6a", "value": "T11C43F14CDD84B6D4D6890C3B94C81AF6AD58B0F468D247DDA311CA81EA2D58FED4F560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265058, "uuid": "f5ca1680-8679-4495-9136-b7fad6917fac", "value": "1536:ssbn2fyHCAYG2EOpJTAlA57h7YW6oWPxvrEu:skn2KHMG25cKNhJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265058, "uuid": "2700e2bd-86bf-4beb-8012-cece1830cf79", "value": 58036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265058, "uuid": "48be7676-96e7-4cb9-bef8-4ea3efc1543e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265058, "uuid": "1aee3820-4310-4ae2-a26b-e5e5d58fbe45", "value": "micro.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2fde5a8-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233175, "uuid": "261d5f3d-975f-4356-b334-213032765585", "comment": "Malware payload", "value": "aff4eb20ef7eb181d8249df60855ddb0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233175, "uuid": "f3bf05dc-2078-47c8-aff6-810f8c443b6d", "comment": "Malware payload", "value": "9185cda615670b1928acc5419dd309c27eeb42f706c549b058dd48c6c877b0f5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233175, "uuid": "7846f18b-75da-45d8-a009-b6db6dd999a0", "comment": "Malware payload", "value": "54768a212103e6bf8d2abd8d2b55cad7e3bc0564", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233175, "uuid": "1be5b125-f57b-4b53-af95-327d366a15a8", "comment": "Malware payload", "value": "3f37a3ae9e93bf3257410b2a4c28614bb3d83e2c47e58d8e0aaace93e1cc84f20e1e8c58266155382cfc0af75d3a5080", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233175, "uuid": "5689b37c-69d6-4464-acec-bce9ca4497b5", "value": "T1C727DF63F244299ACDE6A230F4E707D132260D514783A76A571FF136BDB31DD8E26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233175, "uuid": "9eee2bc6-2466-4cbb-aca9-c61d3a25908c", "value": "393216:UQR0yoR8c/3guvgH3BW71+nOZ6Fj7mlU1L92WU:gF/xyW73Z6Rm7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233175, "uuid": "fc9c14f4-ec71-4c57-98b6-8b343cbe724d", "value": 20668824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233175, "uuid": "22ea4e67-4a12-4cab-85ed-db01d653ed4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233175, "uuid": "0904566a-4571-4bfb-94ff-b98d67cdae49", "value": "IndeMobile (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5709532-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244722, "uuid": "c96e441f-de4f-448f-827c-f64df8bb18b6", "comment": "Malware payload", "value": "b844fd8e22298e2dee0278e964bf5ee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244722, "uuid": "5c174606-8d1a-47a2-8ec8-a31c87642a47", "comment": "Malware payload", "value": "9188427274af8a526f6ef01d4f02496b309620b1ed9dcd626a3f4a0779c65d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244722, "uuid": "b96e1057-9070-4355-a97f-818bb2030b38", "comment": "Malware payload", "value": "1d21734ae9bdb3115ec1adf11606b8742e4d2409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244722, "uuid": "52624ae9-1b09-413f-9dd0-8ef1d4c47042", "comment": "Malware payload", "value": "09e666de8808e8bf770beaf0a0e3e5ed311039eab130948af93f5170ece1828d668578334e7c537e9a0b7011164c58ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244722, "uuid": "6248d2bb-60ca-4535-b1d6-bd36c11ec9e0", "value": "T1BD75E1112E811B85E2AA0F7D82664A9073F49F96534BE61F6EFC71E00E73BE6D727401", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244722, "uuid": "4fff166d-2d28-49ef-8df1-8baa25ae3b0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244722, "uuid": "526e52a5-b69c-471f-93e8-16ea0f1e8fa5", "value": "24576:miQ5ddGR9ObtuKnZ/w0/eS9BrVXqI+qR2uuIU:miYddGR9ItuwZ/d/pVaIvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244722, "uuid": "8a9fe1ae-8bf1-4d30-9c06-a4be177c20b1", "value": 1678336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244722, "uuid": "c821077b-925a-4b63-acea-3dd43d33e603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244722, "uuid": "7a211354-a49b-442c-8ec9-9367c5e377bc", "value": "9188427274af8a526f6ef01d4f02496b309620b1ed9dcd626a3f4a0779c65d9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3598fdc-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245980, "uuid": "62f96b35-5e76-434d-adda-d36bd7422a67", "comment": "Malware payload", "value": "3c8464d83b60422a95ae80adbece8554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245980, "uuid": "1e90df65-f3b0-4022-a417-fd4dca1efc7d", "comment": "Malware payload", "value": "91c109766262b4cd1391b877e71f489ad81aecc8bdedff3aeb3d76cefe371f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245980, "uuid": "b0a07037-d4d1-4095-886c-ae591c6df4a2", "comment": "Malware payload", "value": "3e67ae450f3058938cb719a7c1084f6d43d09f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245980, "uuid": "aa01c637-74fe-4c04-9ffd-143d3988bb80", "comment": "Malware payload", "value": "21036c05c44a2f7e4ff257dca2916f6f4313ed72fd9f84827cf900a5476d4bcc4cb4c3093a98b8a5b1cf5e0c54787d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245980, "uuid": "10e009ad-87ab-4a89-8ccc-e0af71b79f70", "value": "T116B2C43DD6E5BDC0C76B12F078BBB7C112AADB137D2A1B1CB8DC04561E20354ABB4A58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245980, "uuid": "ed6ecb13-04e3-4987-b26f-2c5b34022108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245980, "uuid": "b55bd2f6-fa3d-4bc8-aa48-483e8b7aef6c", "value": "768:8z57Ngy0RpgbFIGRFzptUGwuB3eLhG4Z3ZlSTHW63dVLrPKQQSTq7Ls4:ZgbOGRFzpeGwm32hG4ZE2M2QQSTE44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245980, "uuid": "e6060a57-7306-484a-9093-ffab453019ed", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245980, "uuid": "6d52a524-d69e-4d22-b215-757d84821593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245980, "uuid": "3011505c-0a0e-45e6-9619-2dc149451ff9", "value": "91c109766262b4cd1391b877e71f489ad81aecc8bdedff3aeb3d76cefe371f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9cbc1f-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1778238429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238429, "uuid": "3fecf269-6a7c-4349-aaea-1a03a70631d6", "comment": "Malware payload (RedTigerStealer)", "value": "ac5dc13ffdcfad9ad71575a5e7503021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238429, "uuid": "2668760a-3208-4b16-9d3a-d43d58191c65", "comment": "Malware payload (RedTigerStealer)", "value": "91c4c89a72e0ca6e0a63b2fd84679a897a3d18dffebd0d57bc2cc83cd49e5883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238429, "uuid": "e2a3737e-2ef2-4d94-afdd-91de20c043b2", "comment": "Malware payload (RedTigerStealer)", "value": "f8581d5092f9915b7d2fa6d588e72f42e05146d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238429, "uuid": "6bb38119-ef0f-4f23-a99e-0ec975b2c844", "comment": "Malware payload (RedTigerStealer)", "value": "72109f02f7337a432d010feebb96d9bb8e47a8a377cfaa8219d8c61e3c7b9453b5d1a422d8eee14dd46ed456cfe7d19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238429, "uuid": "a11c5a46-0ab8-4ea3-b7e1-8e1f795a8cb7", "value": "T181873354EAA409ABE6A3553ED15ECC9157BEFED02761C49F0468E5820FA33F20938F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238429, "uuid": "815ff4eb-821b-4624-b97b-a3d99a868542", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238429, "uuid": "fdba00e8-89af-4c13-b9e7-4f8ccab34f2f", "value": "786432:fSGY0W0b4xKL0YFrHFFMW+NjBOjTNGCgK/2ImGQSlmeKBUtA:rYxhxKAYFzFFMNNlK4C2QQSlmeKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238429, "uuid": "ed03da15-7af6-4671-b863-8fd3958e77fb", "value": 37722772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238429, "uuid": "f40251c9-1450-4ab9-a35e-d3c6013ba49f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238429, "uuid": "a8dd36e9-409f-407a-955b-daefc6c187df", "value": "Fuck You.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfe01b8-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246696, "uuid": "cdf8469a-d3f1-448e-88e5-7aead3e9d022", "comment": "Malware payload (XWorm)", "value": "18ddccde32f839b794c6bdab6cdc0cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246696, "uuid": "8ef0cef6-c689-42a3-8f2d-3d7006066962", "comment": "Malware payload (XWorm)", "value": "9284545d6d4a27ef2314218c18aafb6c77ecbf7be2f79333f238b40314d238f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246696, "uuid": "f68f0ea6-bfac-4a0c-bb94-8c1b0e664629", "comment": "Malware payload (XWorm)", "value": "5f1c9425e5e09bb81135d97472bff78d8503e36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246696, "uuid": "bc2fcfd2-1b2b-4601-a92b-607df2ed6bc5", "comment": "Malware payload (XWorm)", "value": "dde9305eae19421a41ceb4f22a8fd5624247820b9e382b25bdcc6c4cd7e543d0cd85d3b74c181b29fec6625a9a3e10a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246696, "uuid": "02c1b1ed-dafc-46a4-b391-1d24414cf11b", "value": "T14A65016EA7E1DF02D7991DB9C26E08104BA2F18176F7FB2E2D9405523D433A47A913F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246696, "uuid": "ac953235-9e7d-47ab-9a0b-aa9c5204c0d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246696, "uuid": "93396d97-df8e-4e34-bc7f-4bfc3b8a8c1c", "value": "24576:ZMc8JdsvZVrTfeZStayG2Ejlkb3r1CaDBPEeogVGYJlzwirU8yjSWSvkSTWocInv:1vr0SYyG2E2ZJDACJ24UrLVBmrMmsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246696, "uuid": "f0b5c3ab-f431-452e-a2e4-119d0135d3ea", "value": 1448448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246696, "uuid": "99c243bd-875e-452c-87aa-7e064f7994d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246696, "uuid": "72ee8d89-8ec2-4b8d-a492-7d4d81127c8e", "value": "9284545d6d4a27ef2314218c18aafb6c77ecbf7be2f79333f238b40314d238f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be5850e-4abf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231982, "uuid": "9ce12d47-db64-4ce4-8a2b-7e379a8c2a86", "comment": "Malware payload", "value": "615b71d5ae0fa4de320980ec08574afb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231982, "uuid": "69f121f2-ae7a-4c69-8aaf-b6fe0e26e8c0", "comment": "Malware payload", "value": "935277c9a313396d8a8f3306d986480e882326a531c91c395fbac321cb11e730", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231982, "uuid": "3d6cb071-1cc6-4431-ba52-f886fdce910f", "comment": "Malware payload", "value": "a5595bf153512bfa80595eb29b19c64e34dcf026", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231982, "uuid": "7a8d32c0-08c6-4f93-a36c-e54d3af68113", "comment": "Malware payload", "value": "5e707349d5a66bf7a57b33a19dc3f74cb444acd12ce6d2eb528393036c8a98e8fa980489d82be8e517a6e90c7b2fd3b7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231982, "uuid": "7d8e07fc-0f29-45d9-9301-cb774d94ed22", "value": "T163E61273F3685D2FD8BB01710CAAB222965A5E01CE93E34B6908B79C75779D41F88BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231982, "uuid": "512aef9a-6fad-467c-9928-f0f82e00c608", "value": "393216:iFGxtwJ+llL93PAHLnp+6UepXOLT5xNL2SP8EIZUf:iOGmLlPeLjUxvISP8EIOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231982, "uuid": "2cac34e6-a06b-4856-b125-c540385154f5", "value": 14153177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231982, "uuid": "3c6b3a9e-4423-4912-b0ba-436c275a648c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231982, "uuid": "177f72d2-d77e-4994-9199-443834dbcbbb", "value": "c3exchange.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecc1c13-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245865, "uuid": "388c71ad-48f1-4553-9a9e-9172ab6286c2", "comment": "Malware payload (MassLogger)", "value": "a4908b7907a1085cd1b96acd2e9ac640", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245865, "uuid": "f2f7e0b3-a6b5-4206-9caf-684b8bd8b5be", "comment": "Malware payload (MassLogger)", "value": "9353b23043743ebd6f1e9ddf137b304ebc126c811935dbad68b17359a2a726e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245865, "uuid": "e6821e90-370f-42a5-94aa-9e819bad769c", "comment": "Malware payload (MassLogger)", "value": "232f592c548ef066c83b0df1ef952de20826c2ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245865, "uuid": "9c6ff27f-b248-4f3d-bb7c-e27d90c12e38", "comment": "Malware payload (MassLogger)", "value": "3be0f5a0d4a9599179b1ce22268e475688db2236cb9012c62ed1fc5a2650d26f5aac8e0d962d9c87e0399e8c0455c347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245865, "uuid": "1b4b560e-1dec-436b-afbe-70a94f30954a", "value": "T195648D82BB86EDE7C6154631887B43197774F2E11B839B071D38A1351E276F0BE8B61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245865, "uuid": "60db5fd4-e6d9-45ad-a72b-fa3033cb7569", "value": "be445168aea972d960c4ac9bfd4c68a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245865, "uuid": "d92ab034-d8e6-47ee-bbac-b7c0af0b74ff", "value": "6144:F/5ZNpyhZk3HaQFqm6ysBty77JPwkAFO/3X4gnTcBjB0:F/tVHOm6JBcH+y3IgnTcBjB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245865, "uuid": "83187a42-8264-4c42-a81e-4730012af038", "value": 328668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245865, "uuid": "f92a9467-5810-497a-9de3-58013d91cbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245865, "uuid": "b6781480-137f-44a6-b219-fabe9101880b", "value": "9353b23043743ebd6f1e9ddf137b304ebc126c811935dbad68b17359a2a726e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043a2541-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778236264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236264, "uuid": "6859f18a-4939-4ad4-a6af-39780f48aeee", "comment": "Malware payload (RemcosRAT)", "value": "114b87875ef2c16cc8b621ff1ddb7896", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236264, "uuid": "27207980-232e-4d83-a98c-815101c9c815", "comment": "Malware payload (RemcosRAT)", "value": "93afb66abe4307999901ead3c516616b813e1044825edfe0cc6ded7f2154693e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236264, "uuid": "01c69bff-5a64-4b48-8a76-88bfca160def", "comment": "Malware payload (RemcosRAT)", "value": "164a889230c096245de288e93e7c4dc1410451c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236264, "uuid": "dff834fc-6baa-42f2-830b-c92deea0c6cd", "comment": "Malware payload (RemcosRAT)", "value": "cc5db946a6237afbc2e098d625289372479b507bce351e498a92a8561060a0a8cb910f23159731a6521c8d6678109f36", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236264, "uuid": "bb79a02f-a627-4b06-b5bd-997004d18f5b", "value": "T141365B17C66F974E180A3B61106A5D9AFE89CAFCEF727BC4E0CF90B614EA1110B451B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236264, "uuid": "707fb403-1eba-4aa7-bb89-931e8e890be8", "value": "49152:SntqWKW2jmBoVGbd4b2i3SmqTA2b36dUpTBBCM1mUQW1QdVmHa/K0X6HPRgzaRAc:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236264, "uuid": "db2a3ce5-0ebb-4583-a702-bd39883e80d1", "value": 5008055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236264, "uuid": "411370d1-60d6-47e4-b101-f2c9af54184c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236264, "uuid": "636cd215-41e8-4da5-89d5-d14b55f2545f", "value": "Ordine 264418.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356292de-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778236346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236346, "uuid": "cbce4991-dcc8-477b-801a-622801648416", "comment": "Malware payload (PhantomStealer)", "value": "6a1902ccd7c5c116fd85e3e65cb62133", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236346, "uuid": "fe5f6992-1ba4-488d-ac95-e2f651ab623e", "comment": "Malware payload (PhantomStealer)", "value": "93ba470ae5367424b516db4b763fa3b21fd42a82b15f2882aae526d72e8f1049", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236346, "uuid": "e5f5cf2e-58ab-425f-b0e9-abba224858f5", "comment": "Malware payload (PhantomStealer)", "value": "0c99a4e6891766b5b61a823ccbd3b59c3b20605d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236346, "uuid": "e79b54f5-d5d4-4872-8914-8f1fb3318a91", "comment": "Malware payload (PhantomStealer)", "value": "1557ac48cee2484e2cf1cfdd8384f9c0e15fc5f6f7285761704c9569def6d8a09493f951da2c58d726f228998ae538eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236346, "uuid": "79c3ffe3-e718-4f07-99b0-c6e05a16ae8e", "value": "T1966382A3266DEA2A1536D781BCEC7CB0C9FA41D63B23EC161DD4C5DDC92740846096FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236346, "uuid": "243af9db-e62e-48fd-bf82-aabce2a8a584", "value": "1536:LxpBXA4zTa5L/abSpsUjQgXE+SssnsEEQ66meRr1fmoix+MxRUWGFRoraBc/PPCe:LxpBXA4zTa5L/abSpsUjQgXE+SsisEEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236346, "uuid": "5b09cf99-aeee-4851-be63-9eab88d4d314", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236346, "uuid": "6237e902-820d-4ce8-adcb-2fd32a1f5198", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236346, "uuid": "5a27a90c-2ea5-46d9-949e-dfdd4255fcd2", "value": "Remesas Aceptadas.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10eb6a84-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242728, "uuid": "92667ccd-e01c-4da2-aeb4-4be0a022e289", "comment": "Malware payload (GuLoader)", "value": "b94c1f1b142c41557dc650f98d8ec5c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242728, "uuid": "a8986aa2-3e80-491c-99f9-ca7c4d867c67", "comment": "Malware payload (GuLoader)", "value": "940560773b60d2646cbc4e12922df8038654b7c14f815907b14d64f84b328d5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242728, "uuid": "769ab43c-1d87-48d1-976d-42e1ce63b1c4", "comment": "Malware payload (GuLoader)", "value": "28da4d8be36cb1d0e13650bfc64aef910664a635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242728, "uuid": "5a5473c6-0974-473e-a906-384107f0106a", "comment": "Malware payload (GuLoader)", "value": "bddec32b681b5d0f727517977451d19556d15b3ec1e4dbbdcec66f8f6b23399e2ea88a8c3a57df72c4afc87bc1e333e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242728, "uuid": "2d8b751d-5975-419b-84b7-f96f7a8a5eff", "value": "T1E62523831BF0D489D8960D341FB64327FEA2E44B7AE5934B5328DB4D2FA354434AA3E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242728, "uuid": "f21cc561-3da4-46b3-8776-ddd4a89d131b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242728, "uuid": "31802fab-48ae-45c3-8891-a01872c6151e", "value": "24576:3xRqLgr6lINUekv8T+bqbCtgRQ9VaI9D4CUwpwu:BRqUWlINQuCtgSM7wau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242728, "uuid": "761b13da-6c4c-4de6-9177-ad3a2ed5fbab", "value": 1038232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242728, "uuid": "32b334a5-0e44-459a-9b26-e10fa35e4ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242728, "uuid": "2fbb5781-f403-4270-8d3b-255e9475a556", "value": "940560773b60d2646cbc4e12922df8038654b7c14f815907b14d64f84b328d5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f66d145-4acd-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778238135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238135, "uuid": "a9b91ae5-21bd-4e7b-a128-11c7741fa9de", "comment": "Malware payload (Vidar)", "value": "5ef1d03e3658d02691abc72ca20bf8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238135, "uuid": "59af88f8-e64b-4a3b-a6ba-fb0276535128", "comment": "Malware payload (Vidar)", "value": "94414ab6e5666294d0299824c7e55e30db70f01e320733f6afc61017441b15ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238135, "uuid": "24198bf9-ccc3-4a44-bcf9-ff2303e8ca36", "comment": "Malware payload (Vidar)", "value": "b62c86109386d04a420227537b5b1808d9177308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238135, "uuid": "5c7cfc9c-a946-4aec-9169-3fabfff141af", "comment": "Malware payload (Vidar)", "value": "5e0d1ada795b109239ec35b8d4ff6db6bff4c5ea05f376e09f3db23d399a5325df7d0e70f6c1f2a82af41b2b9f73fed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238135, "uuid": "b88ba85d-c485-4af1-bae4-eee3826ad6bd", "value": "T1EAC57C05389105BDC099B73249F27A82BB35F8180B3667D32F91AA783F33BD1197675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238135, "uuid": "9db0c17e-3a8e-4c3c-baa1-70f81ccaaf81", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238135, "uuid": "50d7cf7b-d7f2-4c13-837d-e15126b62a8f", "value": "49152:3xN8ul/t8yKpGRlkruBla+tUPcCNgiV3hF88RWqASqJOOam/:3GWLC/d7LRz9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238135, "uuid": "334dfa32-dd49-4b13-954f-56702b4f32d5", "value": 2586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238135, "uuid": "b967f76c-de3f-409b-bffe-53c682c5e6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238135, "uuid": "5e89e39a-9f8b-4cf8-bf95-5b0df902b3e3", "value": "ludex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04f7edf-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778244337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244337, "uuid": "242f65f4-c8f1-4d50-b3a2-b698d81aa780", "comment": "Malware payload (RemcosRAT)", "value": "25158ee2ab1db17e8a906e3213c9921d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244337, "uuid": "da51fd30-6d04-4fc4-9a8a-37e48835037a", "comment": "Malware payload (RemcosRAT)", "value": "9450682b34c6fb23de85e9f0f9c294d24f3e3d566d116889d0aefdd91e446dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244337, "uuid": "d70f8e63-748d-4c6b-a93e-3d1cc76b3fa9", "comment": "Malware payload (RemcosRAT)", "value": "9e1f6f78eceed505996a9e77ddf660d2db178f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244337, "uuid": "4e566cb5-7dcc-4403-99af-f46c83ad6686", "comment": "Malware payload (RemcosRAT)", "value": "4ee15e1824e3d27fd9d340bf4c3922dac2ee10680691049fe443a166ff71244d652efd33d5063e9dad0c77d26d600367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244337, "uuid": "9b7d03ed-5d2a-46a0-a033-dd8cf1f5ab21", "value": "T10A551224B929DE17D8A643F80A35D77417B41D9DA420D2078EFEFDEB7879B4A680C213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244337, "uuid": "65f48e44-01e9-49ed-ae9a-b5e37634da48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244337, "uuid": "9c3d86da-2e62-449f-a19a-710c924dee24", "value": "24576:V8+v9xj+spl5JsRbEWOIkomUc8QRpIJPo0Tyn6kK9sW6k0+p/:Hv7fbJsRotrp8QjYaWsBk0+p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244337, "uuid": "225c0167-56b7-418e-b511-e5e72025a2c6", "value": 1297920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244337, "uuid": "95ac562e-81d1-4980-af43-1023802f68b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244337, "uuid": "aad8c7f2-403e-49e7-949a-7762d9602694", "value": "9450682b34c6fb23de85e9f0f9c294d24f3e3d566d116889d0aefdd91e446dfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ef3640-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243600, "uuid": "0f0a4d34-1864-4ffd-a4e1-9684f0fb9d74", "comment": "Malware payload (Formbook)", "value": "42b32d738f21e3923b65caa4d5391136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243600, "uuid": "3726d8df-a73d-4c41-8555-b052e0521171", "comment": "Malware payload (Formbook)", "value": "94d710b32d1ba165af39fd3463b00aa03f790caa8fc4c3eda10f28d78ac4dd84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243600, "uuid": "ce8173e2-c132-4da3-b532-73bad0bf216d", "comment": "Malware payload (Formbook)", "value": "01f2f6dbe0f04d2f4d518e7ebd8617d3b519c0e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243600, "uuid": "12f37938-6fdd-475b-9f97-da51478f5a5e", "comment": "Malware payload (Formbook)", "value": "43db3523069e3b8002bf0194511972ef08988ff8d7f66d2f47e6e5ad4ee9187c321c5b22d7b0cf353fff6d1ce1c2dff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243600, "uuid": "fe5061c5-6c4a-45b7-87cb-ff219e9912a2", "value": "T18F45F1452715DF02CAA2CBF40D71E3750BF66D985411E213CED77EEBBA38725AA04A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243600, "uuid": "7abc10a8-6d2e-48b2-934b-0c986d44aed3", "value": "24576:SuRSJJSHwWwEKb1Q8aGfnICBdsI7JxT8dkNLa9lrmy8i7e:SQqUwW8cKICBdD7zVNIL8i7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243600, "uuid": "22db3b25-f6e6-400d-8e86-7c17ce42bf4e", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243600, "uuid": "f8c52b35-eaaf-46db-a1a9-f853518c4dd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243600, "uuid": "6aa1402e-1202-4717-a281-2204e6705002", "value": "94d710b32d1ba165af39fd3463b00aa03f790caa8fc4c3eda10f28d78ac4dd84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a88848e-4ac5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234664, "uuid": "9826a3de-fcb1-4f5e-a939-49fbdab873a6", "comment": "Malware payload", "value": "bf7acaa8e793d0724f57dff459080a30", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234664, "uuid": "a92d34e9-8a5c-4101-96b9-aeb029185322", "comment": "Malware payload", "value": "95236ef71738807ce60ef7d042699decb7156931931682cf46e6adc991dc9ecb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234664, "uuid": "ab76bb56-2c46-4968-bf10-cad2080be3a4", "comment": "Malware payload", "value": "90eea0d687fac4c09e2e4ca7ad41d3d2e2e222cc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234664, "uuid": "15ebebe3-541c-4eb2-a0b3-29b3941c3365", "comment": "Malware payload", "value": "0e2f493dd16fa3ca3ad576eca66a64a6b95af1bfa5f66149962b9fd748c384f1024e40b93fdadeca8955c39bd663d9c4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234664, "uuid": "88a1f51e-cc3c-49b2-b334-14075ce1cd3c", "value": "T176963359E42D9C26EE8534BD7D0543863D31387C5320E14B6511CB3EFFE3682EAAB9A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234664, "uuid": "0c4bec0f-a55e-42aa-b6ac-16e86602fb13", "value": "196608:XQHJs4JJ2aVZXrWZJZUDgpQgChPuNapmhTcCc0pz+Gr9CM03W2/y:XQ6OSZ/fpQJPu3hIuZ+se3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234664, "uuid": "78300dbe-0430-4a86-a0d6-6d4638e218c3", "value": 8733164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234664, "uuid": "7f85aa41-bb7f-40fd-97de-8216d5ef38bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234664, "uuid": "f7efd458-8c12-4c19-af4d-1d1c611f97b8", "value": "iMobile Lite(22).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97c3a39-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243467, "uuid": "7547d40b-1b66-4153-b7a0-249209677f71", "comment": "Malware payload", "value": "12430ad49e533cb39cda7359daeb8d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243467, "uuid": "734106e3-6931-429f-a2ac-53d2a8ba35e1", "comment": "Malware payload", "value": "95337bdf60e71e4d5cdcdadd67c5b24c2e7cb27b266adb36d578ed9cdf3ae56b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243467, "uuid": "ff7c64b1-7f4f-4f10-975a-584a723ce81a", "comment": "Malware payload", "value": "f6535fe09645b048554ebd9e132f03fb00798ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243467, "uuid": "d18147c3-d8ed-40f5-843f-bbc70a041557", "comment": "Malware payload", "value": "074fc6f7295349de89dc16295a55d41fb38dc35b7f67361be682c6980544d4f19237d5db17bbd0893bc99136248b7040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243467, "uuid": "45b217ef-3952-484c-8d29-38b2a7dfdf15", "value": "T1BD35D0241D962F91FAAE0B38C062025577F4E92B46A7E35E2EFC54F89DA33C6CD1B510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243467, "uuid": "2be87591-5250-4533-8042-abb4d700877e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243467, "uuid": "6d9dae94-abed-45d1-8b3f-b1d229d6cede", "value": "24576:9U0WNO6FWs7Kjff6D+ZTUPxVLJkEW8VsjF3lepUd:6KjfyeoP5kEWQCcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243467, "uuid": "faea94d5-23b1-4002-8ca9-47b94e4b46a6", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243467, "uuid": "3a211914-9e84-4847-914b-20e46748c2a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243467, "uuid": "79b82e36-c90c-4434-8aae-ae0837773822", "value": "95337bdf60e71e4d5cdcdadd67c5b24c2e7cb27b266adb36d578ed9cdf3ae56b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278d7d39-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231169, "uuid": "8de5de77-c4a4-4f61-b746-1d61157854af", "comment": "Malware payload", "value": "6581679b9405714821ada55562bd77c6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231169, "uuid": "4dd865ae-1f26-468c-9bf1-2df5a7e5e122", "comment": "Malware payload", "value": "95b75076c52d87f8ba33929d22ce739a6e9cd65903d31aa3fb563aa7138da0af", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231169, "uuid": "0d7c402c-baf3-4244-a120-bc9a83d6da67", "comment": "Malware payload", "value": "8439c30ab1f6a428049abcb9c731a617fbadd4c8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231169, "uuid": "618260e2-a424-4545-b785-da014b6b6105", "comment": "Malware payload", "value": "63389bcc02bfdda278cb0c0dde5a2c8e16cc1953b81955b6248ccea7602aa0ab0906912bafc848eafb9b9493e7f5adce", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231169, "uuid": "fd1fb088-1ca8-40e7-b464-3c1c21ef8e03", "value": "T13EB612D6FBD4492AD8778072C96D12F1225B4D568B835F87B904320C38B7AD84F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231169, "uuid": "d926845f-87a4-4fc9-b125-2d2f423f0e59", "value": "196608:uavXX2LthRaFOd7ZM6NufY9XjU6Q7dE2eNSZGQLNwHoYF/xkMHAA:JotjaFOd7ZMYfhUROSZGmE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231169, "uuid": "a08326a6-b7f4-44d2-b997-189a3b94442f", "value": 11434100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231169, "uuid": "9612e582-9410-4c22-a586-63cd4ad7b9a5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231169, "uuid": "96d509fa-4e22-40df-8ce4-6238b8c9cd95", "value": "iMobile LIte (32).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4e4764-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778243446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243446, "uuid": "14bc4469-3a4c-4ae4-b83b-688e75d64b11", "comment": "Malware payload (a310Logger)", "value": "e62cc4df2da75490e24d30af66b16463", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243446, "uuid": "e351fd2f-f6a1-458b-81be-41b8e1d53966", "comment": "Malware payload (a310Logger)", "value": "9638e8e1bf099a7574ec22ffb9f07bf6bdc81cd8eb88855806c27ba24e0a6755", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243446, "uuid": "d2d67b0f-1b07-475f-a5e9-dcb436afdb12", "comment": "Malware payload (a310Logger)", "value": "153c5d0745f0b394f1da9922405157dcdcc736fc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243446, "uuid": "c1e58170-8ceb-4533-bde6-11039ed232bb", "comment": "Malware payload (a310Logger)", "value": "2920599206ec4457bc7f74a0cc6cfda98ee19b5d5c2ea209a809f8e5a0378bb1a9ccedc0504dcb897d9d5c564595253d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243446, "uuid": "64c3abc3-79a1-4533-840b-77b9a7aac223", "value": "T154845A23EA50A12EF1A3C9F1B9A5A25728263D395688EC57F3415F5834721E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243446, "uuid": "1ecbbb7c-730b-484c-a8c0-4d4d8b33c9ac", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243446, "uuid": "bce4f1e6-4fd9-4da1-a6cc-5c20d823b48c", "value": "6144:F8d1/w5KA81IJ8GpF6nuTmOOUWTg9iNE4EnvFEsvyF6GCyHxxB/7k:ujYKkJj6GmZUWvCv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243446, "uuid": "bbee7af5-ffd7-49cb-9b8f-0ffc18791b98", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243446, "uuid": "8e6e0a92-2a62-46b7-9804-cd390034dafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243446, "uuid": "f69d52a2-fb62-471c-823d-8366e97a1eda", "value": "9638e8e1bf099a7574ec22ffb9f07bf6bdc81cd8eb88855806c27ba24e0a6755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee16236-4aca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236792, "uuid": "4fa22089-3a88-4000-8c13-e1dbc250314f", "comment": "Malware payload", "value": "5b0b33dbfa6153308dc7009a4188a0fd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236792, "uuid": "08e7cc12-29c9-4988-9573-01d4b781cb17", "comment": "Malware payload", "value": "9698e5693c96919a8b00c9dd3ed8e7d6b3ff619cb1fdda898151185bc8e4fd67", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236792, "uuid": "19d0bb4b-8769-448c-a30d-2e56131ff16c", "comment": "Malware payload", "value": "0832c5c468e75702284062c2005d7540ba022aa6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236792, "uuid": "1f81dbe4-3554-4878-9ff9-c929a013b353", "comment": "Malware payload", "value": "ba360d4ee2fad46c7a432c36ff354330d3c8efd487e031b8275672c49676f2f58f6c05c3c889e97eb74268bb030bfcd0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236792, "uuid": "c95d4df9-a1ad-4a1b-8790-df28983f74d7", "value": "T11872CE8125E80310F2F6FF39CA7BAB45053BBA80ED31C75C8D508C4C1954A41EDB1F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236792, "uuid": "abd545e1-3a1d-4e6d-961a-8f34561ef035", "value": "24:8d/Cf3DwdfCPiXnSpVT6ADABxb1En9ZdcMjdoRrCUJd:8lCPkdf1XnSpEs4b1Ug/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236792, "uuid": "cb908f82-afef-4466-b130-1c4de7d4f8b4", "value": 16236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236792, "uuid": "6a94c472-0995-4aea-ac74-548b450899d3", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236792, "uuid": "71b9724b-ee02-4975-97cb-e70f8ba38d33", "value": "Scan_002.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1b911a-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243871, "uuid": "34931311-4705-4eff-820e-ec6c24618b72", "comment": "Malware payload (PhantomStealer)", "value": "cf9bb6c7a2917bd3291f79f633ce25c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243871, "uuid": "733af480-cca1-4805-8789-466997b2c900", "comment": "Malware payload (PhantomStealer)", "value": "96a979276dbeebe0e9a4df5b1c9952fec06f526405f4c006baed99819ff9612e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243871, "uuid": "a8c4fbbc-7f6a-4036-8b68-bc700723a120", "comment": "Malware payload (PhantomStealer)", "value": "f06a9e16e06636a865e8c081e76c781a4af1f610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243871, "uuid": "2bc2dd25-30cc-4dc6-a985-94ee2f4bcdad", "comment": "Malware payload (PhantomStealer)", "value": "24fe53124b9dc93c8f0f3196f565027e42dd23fcfbdc9ecfee42eedb385904598c89f1ad63b8de91fe3511cc46355a25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243871, "uuid": "509ffa3f-c96c-4b3b-ac82-077678ce15c2", "value": "T1F085CE42B55F7C85F40A0FB21C79FA341219AED97420C9096EE2BE5B7BF53523026F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243871, "uuid": "56e3670f-3937-42af-ae00-69aacb859449", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243871, "uuid": "758cb44f-1de5-42aa-ba9d-30cf6a3efa2d", "value": "49152:khvt8xDtaCWaLUWcJSq+NW8OTIC68ewTj:khvtaaCvcJSq+T867w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243871, "uuid": "954a8ff7-5d2d-4d9a-81b6-06a04000798c", "value": 1851392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243871, "uuid": "8bbfd37c-4888-4c3a-b09e-24002c783c09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243871, "uuid": "c6f82dbf-b556-4d97-bf9b-25f642709dc2", "value": "96a979276dbeebe0e9a4df5b1c9952fec06f526405f4c006baed99819ff9612e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc035ed-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778246538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246538, "uuid": "ddf1aa3f-d595-49fc-99d6-094d70ca7d9c", "comment": "Malware payload (DarkCloud)", "value": "ad6ca50d88c361007ce62d79cc695a01", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246538, "uuid": "ec56e1ef-2927-415d-b3d3-c8817be37e86", "comment": "Malware payload (DarkCloud)", "value": "9770fb0112980d9fcbdd3bee3e28755fe550fca7688fd80154e4dcce7d066882", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246538, "uuid": "e835cba7-a349-4948-b19e-44dd28a8a335", "comment": "Malware payload (DarkCloud)", "value": "0b75ef355a26076c2fd8f6d990ad336558adfb25", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246538, "uuid": "db443529-eeba-408f-a0a2-fda972b82252", "comment": "Malware payload (DarkCloud)", "value": "0577d7dafc7d060b78fc2ce7831a9d8a77df58f1f78f83693b9687fe1e1ad51bb9a170d3e214befbd4637ba7cb8bfbb0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246538, "uuid": "cdcf47dc-8e2c-4688-874f-78e87d00968f", "value": "T1B865128D61F08F8ED3180EB4E0BB94241BF1988675BBFB9D699483B39D513E6CC526D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246538, "uuid": "919475fb-bd99-4638-8313-8bd3c7fc9edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246538, "uuid": "10315375-fc5b-4665-bf32-ae54bd9ab448", "value": "24576:n3nWrMqePPNoN0+yDEg19IE2SpQK8mmY9sekH7cGQHt2jeamcGY9ontIRs:n3PqCNoN0DXHEkmY9i7F2toeVY4tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246538, "uuid": "6cb51423-c8b9-423d-a8c8-942a0841b151", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246538, "uuid": "01db8ec7-7b37-4ecb-8da9-0cec51231619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246538, "uuid": "4f82b53c-daec-4e9d-af8a-be3ad3c4e8eb", "value": "9770fb0112980d9fcbdd3bee3e28755fe550fca7688fd80154e4dcce7d066882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ffbc2f-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232777, "uuid": "86e1bb7f-6a7f-4157-aba0-cd698595305d", "comment": "Malware payload", "value": "1032451904fb0a800ce730455acdf564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232777, "uuid": "6bb96766-fff2-4202-9ce4-7d13c171fc06", "comment": "Malware payload", "value": "978c7007dc6208bfb98456c55013e4252ac68fc25cb026d0f5ea68303a8a6972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232777, "uuid": "27a7d900-dcb2-49b0-938c-7855736880d4", "comment": "Malware payload", "value": "56cf46a06f7a32e29f7766460f70e27752d93830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232777, "uuid": "965c0fdf-3031-43b9-a516-b518872e9e65", "comment": "Malware payload", "value": "740d953f101b0167d7683aaac71fc54ff62b6e5991d961e52004793628d7e3eea3c2e427a9dbb9b596ca7fdba62a2ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232777, "uuid": "709490cf-05f5-421e-95dc-5b5a9b2a0c18", "value": "T11115AE1AA3BC01E9E463C274C9565617EFB2B45B33309B9B43E18A5A3F13A715F2E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232777, "uuid": "a31476cb-f17d-40f4-b211-ce2cd288e09a", "value": "24127059e20107086e94294754acf4f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232777, "uuid": "e61c1ffa-85f6-41f4-a01b-87df65dca25c", "value": "12288:EU8tj5iySiinbpu8SpdgWcYMUS1lvsiPGUxZ8Wj7JbAYGTEMK0924:atj5iP9pKpFDRS1eiP364h0TEMm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232777, "uuid": "7d2f55b7-c286-4b49-adcc-f624af5a5981", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232777, "uuid": "728dfa01-ecda-4b45-a9da-30198e599f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232777, "uuid": "650cf61e-f56a-443f-877e-83c6ae8a4e22", "value": "1032451904fb0a800ce730455acdf564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84663887-4ae3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778247646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247646, "uuid": "63e58dcd-08bc-470e-946a-9ace47b0cf7c", "comment": "Malware payload", "value": "ceb0f03acaf84f64935018a8533be0f7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247646, "uuid": "cc583d4b-b959-4e7a-aba0-ae2cabaea79a", "comment": "Malware payload", "value": "97ea4f4e188eb17cf843b09f210c13beeeb700d893eb3bd2b92f43d701234b73", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247646, "uuid": "0474ce18-7c8a-4f7a-930d-a7fb3a859693", "comment": "Malware payload", "value": "5024ddd2d3a3387c704dce7a9d09ab969fd11ce1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778247646, "uuid": "80d8768a-98de-4946-9f1b-8ab4a9265718", "comment": "Malware payload", "value": "e5b61e4650cca0841a18efe849c9dff75315aef21ba4cef2ba30704adbdcf4cc51b30ed14ef85572bea0946323f24859", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247646, "uuid": "fdb5d089-23e2-4f7b-b313-3e7752a26210", "value": "T11E137D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247646, "uuid": "3f39d678-5ed3-4eb0-b607-5b045d41d7b3", "value": "768:bxXRWNGxVv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bLlxOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778247646, "uuid": "8b552f02-52bb-4deb-a4da-6b921ba02ad7", "value": 45440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778247646, "uuid": "02e8f624-cd32-4d23-81a0-cd7f0ddd4f4e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778247646, "uuid": "1aaf8b9f-19cc-40e6-a296-96271ff7053a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38ffa66-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778246437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246437, "uuid": "7b2eea97-2a6f-49f2-91d3-aec4b77a4c4b", "comment": "Malware payload (njrat)", "value": "44e9de5f55e4a3971c0d3e109d7c8d0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246437, "uuid": "b6c29be2-1e6c-4ca8-9a03-376cb2962836", "comment": "Malware payload (njrat)", "value": "982f9ea4a70028d95563859c73bdfb6022f4e9d9ca4b20ab7667f2c13984b602", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246437, "uuid": "a82eb295-c52d-4b01-ac2d-101038687630", "comment": "Malware payload (njrat)", "value": "4f2cc02fd61fe0ddd1e2590c53cafe34e0d86530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246437, "uuid": "e324baae-c2a0-4f6d-a322-b867209fba0a", "comment": "Malware payload (njrat)", "value": "51aa830b0b9711a24c407da850909264f2dc65de509c227382f746e47e1cd9203d4b58a8f0bb0e530f69ba7aad166a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246437, "uuid": "9e4a2ee3-ddf4-4ce0-8a86-890ae4aa71e2", "value": "T13525012A73949F40C0285D78C5E3862403E6BD83B773D34A3E5576EA6E723D4CC96AC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246437, "uuid": "bdd9f29e-74c6-4581-8596-7d6e65ebc77a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246437, "uuid": "51b37658-f462-4c73-9601-d7a85854d357", "value": "12288:60kmfr1Nyf1b4bCbUfyS2ttNoK/P1nFBZGLQVo1pC/LC/B5PpqF9G4NqtHlBl1q0:SCq56aS2hoMTZVo18uZpmDkXrmWE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246437, "uuid": "76c086ad-c9ac-490e-952a-e57ceb0a7674", "value": 1055744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246437, "uuid": "01f9f42e-6022-43f4-bd44-bb2975d63cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246437, "uuid": "cb4299e9-d3ad-4575-a1e0-5d144a31db71", "value": "982f9ea4a70028d95563859c73bdfb6022f4e9d9ca4b20ab7667f2c13984b602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c4a6c9-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232968, "uuid": "1f3b8e97-8609-491e-96dd-b0459c941f4e", "comment": "Malware payload", "value": "afb0a04bdde7e6ef70cafc2e0d8f45f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232968, "uuid": "f2a393ce-1be9-48a5-9d9f-21c1c5d3b0e2", "comment": "Malware payload", "value": "9838418dce693f2a5c41df3ddaef3127ce964e47d13a4f288fbbde7c72b895f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232968, "uuid": "3ebfe021-3c76-4a1e-bfbb-e67c9c1b328d", "comment": "Malware payload", "value": "949889530986b3943caa5951c53bc3b0abcc1082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232968, "uuid": "d4d3f0fa-f8e2-4b3e-abe6-b51c2a705179", "comment": "Malware payload", "value": "6fc5f84f4fa5e6be44ab9c30b30559319f75ec1e18a34190a0d7aa178285b4f49ff45f037e6fd93fafc31682332203ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232968, "uuid": "99426e56-a546-4478-b251-78fcc669cd0c", "value": "T175746B05B6A40CF9E967813CC9A34A46D7B2BC5607B1EBCF03A046965F277D09E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232968, "uuid": "1f922d2f-6715-4168-8a9c-7c74e5be7bc1", "value": "d04feef9f2f0dd0a18187fe3826aaf2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232968, "uuid": "f9fbabe1-8240-4ca6-9b28-343328335559", "value": "6144:ItTTELfJ7chjuzQkc+olqr4Tb5/uDzKhuc8CgC:ImEjkqsr4TbZoKoc8CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232968, "uuid": "84da272b-4d64-4a28-9999-7cdb806fb2b8", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232968, "uuid": "af7a7874-69cb-4563-9a36-2d75aa02d0db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232968, "uuid": "e3c508ee-7fa0-4cf6-9282-3a1e6f5eb4ab", "value": "afb0a04bdde7e6ef70cafc2e0d8f45f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea64499-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245999, "uuid": "3b736245-62da-4e73-b2a9-2efc0be31e75", "comment": "Malware payload", "value": "e49887d8fa951c1b04eca5519946b716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245999, "uuid": "56f322f0-ee1f-4b4d-9069-001b8c7926df", "comment": "Malware payload", "value": "985d90e2067b0db89cbe55c067e961318989b0db0d0f930fd102e625cf62383b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245999, "uuid": "bceb5b7e-7492-412e-b7a1-b872509f7709", "comment": "Malware payload", "value": "a75e2b74f8d562b18b1f16540c53398d48d12ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245999, "uuid": "62910ebc-6950-4bac-98cf-b31fffe5c703", "comment": "Malware payload", "value": "8ca904819a81818f6f2ed571bfd0c9e41ced8371758d142e1a05ee679ee6a1a17443b0f6e40d41b750490b853bb6d483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245999, "uuid": "67790654-e59a-420b-9a49-2836236d95f9", "value": "T1B503E096B6A8FC78F47A863104752374FB2339602E3387AF052D747A7C765916A50B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245999, "uuid": "75f4c1eb-bc17-4406-9d20-9886c5b7b277", "value": "4b2df774f65211b4962a056c4da67248", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245999, "uuid": "fc63b8ed-0739-4c37-8196-283efc01a47e", "value": "768:bO7LbZgoEUd7spY5cEnyt2hNEY4WZaBblEf6xjuVxjGnp:S7LbZgTQ5cr2hNsLEf6lkAnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245999, "uuid": "8e7b88f3-fb46-445e-be4e-051d1bbeb03f", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245999, "uuid": "4e28fd5d-ac96-48c0-aeec-32bb8fcd8fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245999, "uuid": "a1d50f9d-0af5-4841-9d88-8ced2fc41b1b", "value": "985d90e2067b0db89cbe55c067e961318989b0db0d0f930fd102e625cf62383b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132cdedb-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265065, "uuid": "06da4379-5189-412c-805c-76f231cd0755", "comment": "Malware payload (Mirai)", "value": "89587bd11b072b5386775beeff13406e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265065, "uuid": "499f003f-5257-401f-a5b3-f263a2e30dee", "comment": "Malware payload (Mirai)", "value": "987c800ce2f8a0299b56754ee37e7a858b95f15f08b526fec7a6fe631ddfff8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265065, "uuid": "f94660b0-cd11-43fe-a2db-e381d304d705", "comment": "Malware payload (Mirai)", "value": "156e61cd49e1b7c4adf54529c06c7525c80f9384", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265065, "uuid": "d7b666f0-fb1f-4c6c-bdbf-c132ee56668a", "comment": "Malware payload (Mirai)", "value": "e904bb638cbfde42a440f0975be3cd94e4d3142c05813770ef22cdcae9e0ee8ba937cd6556a51ced476faa06512f2372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265065, "uuid": "3c544842-ae3f-41c8-9ec4-97732d3db3fa", "value": "T1AFF27CB38D3E3D6CD2165A74B524AF3C5F63E905D6471EFA846683229407E9CF82C2B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265065, "uuid": "e48b7ce5-2ac1-4ad8-a6e8-ead81076aab0", "value": "384:nUcJHAanlda/C9RfmRfGReBxNrTNeRB3ifZeOiIGNslLIOaFqLAvsl6Cvmf7DtaB:nUcJga7z9R+ReRwheKKouy4ANiCcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265065, "uuid": "8a21d579-cf8e-4366-9af2-8a9b80b0bce8", "value": 34316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265065, "uuid": "ee756c35-d3a5-40c8-b315-d833c3a5443e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265065, "uuid": "aa469b54-4e83-4c61-afef-ad379e8e5f33", "value": "nexus.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa4befa-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265059, "uuid": "ebf6490f-92e1-45f3-805e-c9f5d524653b", "comment": "Malware payload (Mirai)", "value": "fc642a62ec6040025808cf2ebf6dfcc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265059, "uuid": "c208831e-17c8-4fe9-b75d-d0d489ab7a2c", "comment": "Malware payload (Mirai)", "value": "9893e5c61fc7ed96fde42b86d2143a80365797ec899eb4379cac5e0a43940fa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265059, "uuid": "81b83406-2757-4f01-9619-b1aa1e17335b", "comment": "Malware payload (Mirai)", "value": "816b496496a9d9eb3807ba3bdaafafd767eafca6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265059, "uuid": "c5e2db1e-f710-489a-b555-31f5a599fb69", "comment": "Malware payload (Mirai)", "value": "167df8ea8259a25b4df161e26fed4ae6fcc6b6bf866fd909daa724226b5e9045e61976eccc7f14172aed87f4ea5c7464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265059, "uuid": "1dafa19e-9e2c-4741-b2eb-446b0aeb4230", "value": "T1C983B549FA649B2DC7E272FFF74912CE332B1B98B7DA71259E305A4533C8BA65424130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265059, "uuid": "3a743040-e852-4d86-98fc-4375fd53461f", "value": "1536:/lnsFxdCK/9Y9KqCLcQ99CHXtecGX79hLQTMciJSkNSxrPgf:aEu96KqCXyXUF9SkNSxr4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265059, "uuid": "7404507b-3acf-4c89-aab0-11b79f981687", "value": 81708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265059, "uuid": "9a08000d-2f51-424f-8388-42368dc25817", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265059, "uuid": "2d20f749-7d1f-4760-a626-d5181a7e8eb7", "value": "nexus.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b9d9c3-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1778231086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231086, "uuid": "7af22d91-ef35-4a8a-82e8-d20a71bd3345", "comment": "Malware payload (VIPKeylogger)", "value": "0c9c168a5203abe9d49d2f43c0ba1e4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231086, "uuid": "ed27cd97-d793-446d-975c-558801623e75", "comment": "Malware payload (VIPKeylogger)", "value": "98c5bab55da8da9b5c85ae5fe6b082f524fe82aaaff379f9d19b2bf7f8c23a47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231086, "uuid": "6864e23f-06ba-492a-847a-399167de3026", "comment": "Malware payload (VIPKeylogger)", "value": "734a584b9f725319992a4ccd532d8e7e77d48d1e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231086, "uuid": "32343b29-cd6e-49bb-82e2-631a2d71bb9c", "comment": "Malware payload (VIPKeylogger)", "value": "1dabc3e770f41673b7247134f19d647fef2b39c93446a5b7836e46b1bbe72a72bbc1f9ca119372587206a9af00c4d0bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231086, "uuid": "c2a295c2-edcb-4fb3-a6d8-dc014760ca11", "value": "T182D2B68C3EC3B270436174AB292FB52BB57E1C40B55C58A4C1ABE0F1F868729E577D28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231086, "uuid": "d7dbb847-b366-4a8c-abed-0604f2fa23e3", "value": "384:1EjrakGMGJ2VmtCcZB8+MKvsA/Pbnh+lfJmRn3H+EkvYRnFqp1tHpgZQjmxp5JCe:1EjOFMGMVok+MKv3PXn3+Ekv4qVHiJCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231086, "uuid": "91acbd11-3628-44fb-8c01-b61f3ce671c5", "value": 28758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231086, "uuid": "e2373538-a129-45b2-8b70-3c3ba37ad800", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231086, "uuid": "838d604b-f528-4e9b-9b64-24360f82bd54", "value": "New order 2x40HC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb48d65-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778246024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246024, "uuid": "92a7f26b-bb68-4896-9319-c939fbe65746", "comment": "Malware payload (AsyncRAT)", "value": "1eec60d4caaf19df2b784111c4559648", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246024, "uuid": "6beb963b-a5fe-4524-98de-cb75b1b0ec79", "comment": "Malware payload (AsyncRAT)", "value": "993d9460098137391a6f1775c070d535c47138a06a88c2c5250c99b79f28dca8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246024, "uuid": "6d5463fe-58c8-43a7-8842-8776b777c93a", "comment": "Malware payload (AsyncRAT)", "value": "b0d4ab57cc981367843b008d9279fb9f30f68351", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246024, "uuid": "b45fe9e7-be38-476e-bde4-cb5b0e279781", "comment": "Malware payload (AsyncRAT)", "value": "8a6d0a86d1ea61a59285d43394f7d165e3aee9679440031cde19c8cbb4aac5597b3ef8d5510efc6d528705b90e9d9886", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246024, "uuid": "a8f1da3e-e858-45af-aee9-4fd0f3feafc0", "value": "T1D2051228929BC803CA961BB60DF1D4B023745F8CE623C6136FCA7FDBB5767954691382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246024, "uuid": "275af2e5-f817-4349-a26e-45b53ee6d4ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246024, "uuid": "4e91315c-e9d9-46d7-9d28-a3ee9c1b715a", "value": "24576:gXpAkdzA3BSTSloNe3bsxibuD8x98UJ7ba:gZhdQBpOe34h8xxJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246024, "uuid": "f475e725-56f8-4d7a-8347-42c5ae3344d2", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246024, "uuid": "582f8cbf-79f4-45e3-a079-a328284ff25b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246024, "uuid": "c33cce94-9734-420f-9f5d-aeb966ac4586", "value": "993d9460098137391a6f1775c070d535c47138a06a88c2c5250c99b79f28dca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9583b606-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244239, "uuid": "e77b9db0-581f-40f6-8719-b3562aa3e81f", "comment": "Malware payload", "value": "0b0b823f842d33098c8ebba7cd7e93d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244239, "uuid": "32092a40-cfb1-420d-a3f6-4ebc4ed76790", "comment": "Malware payload", "value": "99446a0be47d814a344b5c88c5559d59a63d0ba4ce249ae7797b0c45482d3267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244239, "uuid": "8f8ed37a-56f7-454e-b3e7-d519609cc4ae", "comment": "Malware payload", "value": "6cf0ad39b1a182a9ff9338d87f07d142251501da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244239, "uuid": "a9925832-56ce-4ba6-83a7-966773d05957", "comment": "Malware payload", "value": "d4a1dcf6eb83d4e0100a6c999cf86da984596164cb2d816f326c6eeb6b7a8e3ea614ec6c22b333a40f0d32b6c9aece63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244239, "uuid": "fc49c4ae-a136-4826-bf5d-2aae6d708764", "value": "T18F836B4AB7D89FD7CBC905BC68336B600770DC365582F7576E8231AAAEB23D056024DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244239, "uuid": "944e673d-c024-4e5f-95c6-74c4dc0f836a", "value": "1536:I04nDfXs3HfKGBcMlLlSC4WeQK5JbsTbNuBa6WaqkSZZZ3g5Tpbp:I00bXSHTLojbQoJbsvNuBa6WEUcbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244239, "uuid": "66d99a8c-648f-48f4-a500-ee3009e5730d", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244239, "uuid": "c4dfe492-1337-41bf-a958-09a08d6fbaa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244239, "uuid": "0c317a56-b87d-44b1-8d34-f462cbe5a43e", "value": "99446a0be47d814a344b5c88c5559d59a63d0ba4ce249ae7797b0c45482d3267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f21b12-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778246313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246313, "uuid": "363992b6-6d49-4a15-8d76-a8b305d9dc0e", "comment": "Malware payload (a310Logger)", "value": "0c771fdbe87fbc3f77b4adea0ea67f76", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246313, "uuid": "a3c09de8-4770-4302-aa60-80bc47f508db", "comment": "Malware payload (a310Logger)", "value": "9a462718c1dc77aaafa6dae799ebd8a27933551ddbaaa112f683ee4195d347cd", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246313, "uuid": "2afb4ec5-5749-41ae-8d7a-cefdcaf4ae40", "comment": "Malware payload (a310Logger)", "value": "44357b0ecf2587cd5e7343f949acd3ba36d5674c", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246313, "uuid": "e5fdf5ce-21ca-463a-8007-c090dbc0ee3b", "comment": "Malware payload (a310Logger)", "value": "6ae3df747c2a089f28bb0b09077c96d8e888e808fe82811ffd00665cfdedc3228c6c719120418b9ceb342e520a474962", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246313, "uuid": "6a570975-d526-4a84-bf71-c6d8f104fd40", "value": "T1FD4522582269CA07C4822BF91E72E0F163B90CDDE425EB475ECB7DEBB4B67200594727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246313, "uuid": "2f4188fb-20d0-4485-8816-0e4dccd0a597", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246313, "uuid": "85af13ab-87e8-4c6c-8c55-4acf7bb4092b", "value": "24576:5XUfiSJKACXZQamZiB5GCIcK17JxD+keRgolTGgG+8PFsqxJKo:5h4C+akCRUt+LRbNGtPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246313, "uuid": "b11ece2f-1bdc-4c52-b8d9-879f8daf80d3", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246313, "uuid": "d429e210-901c-45ca-a723-1fa85f34cda9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246313, "uuid": "18d5a2ce-c9b5-4a01-b7d3-902ced284d35", "value": "9a462718c1dc77aaafa6dae799ebd8a27933551ddbaaa112f683ee4195d347cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74cff33-4aa2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778219868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219868, "uuid": "d06570e4-6337-4442-9f60-f223d4920852", "comment": "Malware payload (Mirai)", "value": "e910f80d46ed09d6c74862ede2042130", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219868, "uuid": "44b6b219-9dfd-470f-be12-7ca71f8d75b0", "comment": "Malware payload (Mirai)", "value": "9a87db9dd846b6e4a5e7538a4d9aa8a0ce5f15e543da9aa01df80cd09e705746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219868, "uuid": "ad958555-d49b-424f-ae48-99728a3dd9f9", "comment": "Malware payload (Mirai)", "value": "550e3028a305e91e3a0c5a59f4908a61b5554ba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219868, "uuid": "2566d813-48e2-450a-8aea-73200f23a204", "comment": "Malware payload (Mirai)", "value": "2d0104d00a8144787ebf3e7317e702def1da006950f2be31048350bfd324ca8047d80103364f0238458b94f96782c62f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219868, "uuid": "88e914a6-165e-46d2-bfad-70cc1cf0168d", "value": "T1FCB3E085B210AE55C02272FCB1870A90D3B16D7B4B9A150B4473F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219868, "uuid": "95096d71-2e00-4005-b4b7-8bb6194af200", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwuz:aevXCLr59hmNwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778219868, "uuid": "c8a2bb6a-ec72-4865-8938-e7d85ce2e10b", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778219868, "uuid": "69e8b07e-410f-4689-a3d2-41dce5c61f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219868, "uuid": "4b5a5bfd-b2e0-4810-817c-3c27f3834977", "value": "xnxnxnxnxnxnxnxnriscv64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c740001f-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245611, "uuid": "3eea9bfe-c103-4b5b-8927-14f549886c7a", "comment": "Malware payload (Formbook)", "value": "f8ccccca74ce59436fdbf92730c8a26f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245611, "uuid": "65602ee3-fc7d-4d44-8987-5a5106571c47", "comment": "Malware payload (Formbook)", "value": "9aacadaedfc7a79b8e077b37a8d2b89c83b2b7e213200a613488d9e3124b64c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245611, "uuid": "2c90cc85-9718-4d93-8df8-e0d94c6ac725", "comment": "Malware payload (Formbook)", "value": "e85d97d23b3f5a3d6845e9b5b543299f7e3fd16c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245611, "uuid": "d41689e2-92c4-4702-83d0-fc500fab6281", "comment": "Malware payload (Formbook)", "value": "e25db15b1a5781e4c2c65e2b804a5d1fe949807d8ffb41e9456bb71f91dcbc4c7cf86d8e01dde559bcc4df7454e267b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245611, "uuid": "d56d56bb-a579-445e-b555-c9411bcc25a2", "value": "T18925121423ADC902E4762BB85E35D0B81374AE9DE820E64A9FC87EDFF4BB7160565343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245611, "uuid": "618dc0ee-f09b-43de-bdaa-d7a639b3c201", "value": "24576:C6J2m4wmcUTVZ/fWutwRncoTAtT4aUbtXU:VEwLYP/fWuWNf+4zbtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245611, "uuid": "f0c86997-27dd-4542-b338-5a4d0f0c313e", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245611, "uuid": "06b0288a-fde8-4ee5-8224-e1c549060fae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245611, "uuid": "6018021b-f8a5-4a2d-8767-ae5dbb85e300", "value": "9aacadaedfc7a79b8e077b37a8d2b89c83b2b7e213200a613488d9e3124b64c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c49d7fc-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1778243203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243203, "uuid": "da72713d-bd54-4ff7-8b06-ef352ffb9b88", "comment": "Malware payload (SnappyClient)", "value": "e6e77c8b9bb9ab8fb0801abc5b6c4284", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243203, "uuid": "28164d3e-5a9e-4854-9b1b-7019d14d6ba1", "comment": "Malware payload (SnappyClient)", "value": "9b17471d781015895c8c3fb8ecdb4db47249a32ddbb910b8441e3297897b0da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243203, "uuid": "3e95561a-97ea-48ee-8db9-7941b39433d0", "comment": "Malware payload (SnappyClient)", "value": "7cea8f14fee37e004608271298ea2f81afece3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243203, "uuid": "6426f6d8-03bc-4898-a733-6bded3cbf97e", "comment": "Malware payload (SnappyClient)", "value": "457c6701a3ce2057baf544f9f01f863d4fca1f26bada40d2f674a90ce1b2f616d327f87fee120bb0a4dfd4f171663126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243203, "uuid": "87b17a61-9546-475a-a471-b78dc21face6", "value": "T11276B7069C764656C174D038987B142127F978C85B90ABCB7EDDB3242D8B7F426FA2EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243203, "uuid": "0982b63f-dec3-47fc-bec9-6dfca89f6859", "value": "170d5847fc2236d4b12875aa9c605807", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243203, "uuid": "9f7abc66-60eb-4763-92ec-cd8d370b597d", "value": "49152:bW50cLxvfBZmsdDfW7n6Orwww4NP8C0ETlevtrRyDw8cssPo5C:bW5ZmAVupFg1Oh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243203, "uuid": "0324f3b4-d00c-4689-adfb-bd7c32f57b7f", "value": 7543808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243203, "uuid": "c8ffbd5d-e48f-4d83-bce5-deba4e1e311b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243203, "uuid": "202a2fbb-da55-4307-9a0e-7960481c4698", "value": "SecuriteInfo.com.Heur.3021.2209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08dad24-4b33-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778282053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282053, "uuid": "fa6fd099-c1c9-47d8-9480-1ee19bccc730", "comment": "Malware payload", "value": "a7656278ab461f6923db32479d9648b2", "object_relation": "md5", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282053, "uuid": "59816e44-18a9-41b7-ab47-f29109b4c921", "comment": "Malware payload", "value": "9b901b800fc56eb162a592a528f69e703f4ee46e3618c67d078e4fa1e1c89476", "object_relation": "sha256", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282053, "uuid": "9e1c15a7-67c0-4cc0-926e-545325180897", "comment": "Malware payload", "value": "19098b84ac2137081f268edbe8397090bf406149", "object_relation": "sha1", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282053, "uuid": "f3676ede-10b2-40d0-adc4-0b12a2035b2a", "comment": "Malware payload", "value": "dad2226bce3443fb81b1e7dc07aacdf38968c17318d514016141ae6d1cd32a5f425c0e27d17dd79d0dec78c4676cae65", "object_relation": "sha3-384", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282053, "uuid": "6f9cb9e3-377f-434b-8301-861c714a3096", "value": "T1BCB3595B62E630F8E17782798AA51A46D772B87207219FFF07A0460A1F237D18D3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282053, "uuid": "8f7e975a-aec3-40cd-a58b-b8ea15379d69", "value": "0d677b8735ef6e4e0d38abb484ab9abf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282053, "uuid": "6ce4c40d-454e-449f-b1db-8ed21d94731e", "value": "3072:8PcTESX5Zcec80TLcgRit6WJyEbNH5BNeyLV5X7:8PcTFXbcBGgQ8WJr79VZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778282053, "uuid": "d4ae4099-319c-4ece-9992-1bf9cf54597a", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778282053, "uuid": "df25e175-1244-4a0d-b6dd-10cd9562b5e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282053, "uuid": "54acf0ce-e115-4dce-8436-e9e25cf6f473", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173aad51-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256482, "uuid": "3fe0ba39-0052-47f4-98b2-9e95973c8e17", "comment": "Malware payload (Mirai)", "value": "284d529d29c06868b3b7bbb753a2fba9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256482, "uuid": "80de9434-9e02-4c02-a248-4ac82a9e18d3", "comment": "Malware payload (Mirai)", "value": "9bb1791962eea553760bc577d807dd0566cf0760c9e9aea8d9d3c21b2705b4db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256482, "uuid": "cce8b5a6-c620-4a54-83c7-d29a509b15a0", "comment": "Malware payload (Mirai)", "value": "37e12250eaf5ea1f177c7ec4ef9fc10b9b92c319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256482, "uuid": "a86e9c9b-2b90-47b0-8f58-6a0910665612", "comment": "Malware payload (Mirai)", "value": "0f8a00f4fd54c5210437aa6481c9cb8be8827b2b9e1c8b721f4666ddf8d12e3b4c311184a02e32e8f2ba42124d501ca3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256482, "uuid": "a4c06217-ad2d-4a53-afc9-517e41ede9bd", "value": "T181B34B56FC829B12C2C613B7FA6E418D372513F8D3EE31079E126F25778A85B0D27A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256482, "uuid": "5fc131a7-bbb6-4056-a8d7-87e39cdafea4", "value": "3072:fqpejv7A0WPmohM48R9J7ximB8NU3rwbZnN:fqpejDWZhJ8R9J78mWUbwRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256482, "uuid": "7bceff21-f572-48c7-9c6f-a1f8be80d31b", "value": 112172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256482, "uuid": "e463def4-47a8-4afd-b0fa-c6a00062c0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256482, "uuid": "406f1289-53b2-4d94-b3ab-a80e67690753", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35157416-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778245795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245795, "uuid": "81195550-9330-417d-83a1-0b04e276e82e", "comment": "Malware payload (GuLoader)", "value": "f088b29f310b57220d1673a4c9809b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245795, "uuid": "533ed75f-3f57-4e0b-8f51-873068c60943", "comment": "Malware payload (GuLoader)", "value": "9bbe2aa09c6f16d7ad691bb1bc8d318877e4f353a4c5bea01e359fac9ba1fb69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245795, "uuid": "46520f06-f1ff-46d9-9af0-2e3994b7a192", "comment": "Malware payload (GuLoader)", "value": "78097c2040ec2f1affcfd9b314451f450167c4c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245795, "uuid": "a81e4b5d-2912-4c21-add3-95e9dbfc5c77", "comment": "Malware payload (GuLoader)", "value": "b0e1683656c8e9cc19cfb981cf39a8197d79c5ed74c93cdf9cb5958a7f0ec74e497a9ca9426e4a9a6568e298f05fa2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245795, "uuid": "d371d68c-27bf-45c3-8544-bf47f304f71f", "value": "T1D2E42340F185C8A3EF7113748A155E334778B858A0C69FCB2758BE5A3DF9850DA2A773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245795, "uuid": "cb0b0678-3eab-427c-991b-1f3f5d41bcce", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245795, "uuid": "f1a68847-6732-4f22-b6a5-41bdbf703a5f", "value": "12288:0X4jwQRolxVJNuVhO/329lV4xfmCQvQcAR7iU4q4VEhAoo/tw0wlgO4:u4jwQ8JNuKmibQvpci0HhYlw0bO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245795, "uuid": "15bb15dc-c627-4b8c-aa3e-4727cc8d49e5", "value": 657173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245795, "uuid": "bba24ff0-6ac5-4ef7-bf0a-5119e9c90be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245795, "uuid": "9c39f07d-6e8d-4639-8f0d-1cccf30016d6", "value": "9bbe2aa09c6f16d7ad691bb1bc8d318877e4f353a4c5bea01e359fac9ba1fb69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be213183-4ad3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1778240871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240871, "uuid": "cc31b322-6bd9-48e3-8a35-a8de8f09137b", "comment": "Malware payload (Vidar)", "value": "ed4beb75ba0f04b491ed3441512e6cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240871, "uuid": "3da733ed-15f9-417a-9563-e0bb1194c4d1", "comment": "Malware payload (Vidar)", "value": "9c39bb683f3912fd62a9f4ae4876e721ca32149cf29e72331cf40fce976e0e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240871, "uuid": "71558abd-71d1-47fc-851c-eb84325aa574", "comment": "Malware payload (Vidar)", "value": "f3ba6cf2f2560010ae5905eaab4f874a08d4ca6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240871, "uuid": "d4e3f0d8-eb15-4b13-8b47-fd9518c067b8", "comment": "Malware payload (Vidar)", "value": "befabedefef89524b46bea85348bf40803d261e2668f7a709eedc7eecf08680ea0adf7a5762d8a32978b71aef9674b2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240871, "uuid": "52e0630d-5e13-4049-9b93-8f52e7003c8c", "value": "T13EB56B427C9048BDC09AB33188F662957B38B8480B3637D32E616E7A3E77BD05D7A745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240871, "uuid": "a8f1a745-e34f-4f10-939a-966e35918bbc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240871, "uuid": "39d7529b-4c7e-4749-91ec-26eb133972ef", "value": "49152:I2w5sbu8olhHZnDaN5biOnd6b986Epjs:I/+49ZnDaN5x4twjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240871, "uuid": "c827a1b9-3761-47b7-8470-055742dc32c9", "value": 2393640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240871, "uuid": "80a5a91f-1dcc-4085-ad60-778652a01afa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240871, "uuid": "183d3553-e590-46ff-89e7-93d9df56dc2f", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5c5b1c-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243205, "uuid": "37742fab-5999-4a7e-89ba-1d441518f4bc", "comment": "Malware payload", "value": "f5c4aa4ac3baf5ad6ae42e6ad03d8747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243205, "uuid": "df552c5a-9fde-41d8-aff2-fda0b208cbd6", "comment": "Malware payload", "value": "9c4a88a2d861c6fa3c5b742f06fdb67cacf933915b131bdc92fea31dbaa742cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243205, "uuid": "e020c379-83d4-4d67-8a47-2e98146b879d", "comment": "Malware payload", "value": "75a069313ff98d326a33e3eda2b3aedf14be759d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243205, "uuid": "f1525a7d-ce5e-46a4-8488-31683f179da2", "comment": "Malware payload", "value": "fe8163e1cf73b34be0420240f4b6c9f529e8f78b4ca92d07ad5d3b2d8ed0739169881ef5f075642fa382a92ca9911b13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243205, "uuid": "b05e85ff-894a-48c3-a4a6-885c4a3abad9", "value": "T183433C78D5C4ACC4CB5FA371705AA3C503AB9E07683A169C9ADD38670F732946A3D339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243205, "uuid": "44ab399e-2a70-4a81-9d95-19d5a7bc95a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243205, "uuid": "b31982df-dd9e-4ad5-8342-8daebe777161", "value": "1536:hvbJpojRfqU4taeWLdVMACQA2eUJ3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW:hvb4jRfwtaeSd5wDud7r6GiX8QiQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243205, "uuid": "2efae509-c832-4ff5-9ed2-284396eba034", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243205, "uuid": "9d903444-94bc-4a8a-aa34-52d153a787bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243205, "uuid": "2d4b7b3a-ede8-4acc-b484-3b3f15bd87e1", "value": "9c4a88a2d861c6fa3c5b742f06fdb67cacf933915b131bdc92fea31dbaa742cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6628b9-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778245807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245807, "uuid": "c70c46b1-20af-415f-aab4-40c4abcf9df6", "comment": "Malware payload (AgentTesla)", "value": "6d182f5c44b88a48941a357421269236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245807, "uuid": "854cd302-6028-4d57-965d-1fb9936eb542", "comment": "Malware payload (AgentTesla)", "value": "9d195832da9b639bdd4fed66ae46abf2b1c502dd04968298815612b5f730bd60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245807, "uuid": "dc5993a1-283c-4ba1-a024-f904760fdd68", "comment": "Malware payload (AgentTesla)", "value": "fe83ff5b3763f4a4cda2f530f308746a7e0938c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245807, "uuid": "0cc6d0c6-3ed4-4b10-be6f-b4c31872e271", "comment": "Malware payload (AgentTesla)", "value": "c1cef2320d5d6f4ac5572cc9cb3c68d0437463aeeb4478b21a8b015b1d660077d173dc0947dcc3875f9caacd884e908b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245807, "uuid": "70f07f2c-9c83-4468-89d6-b117ae6fd429", "value": "T1113400027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245807, "uuid": "2ef051d1-b836-4e52-870a-d560788553bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245807, "uuid": "9c319bcd-a5ad-4d9c-90e9-673fb05e1694", "value": "3072:962TDq6CyK/CLQSlYeJas0WTHo9rG8KaG5jnThzSwufzz:Jq6CyKKrg4sq8KaWTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245807, "uuid": "e5730bdd-231b-4e35-b73c-e7c4e09e901f", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245807, "uuid": "0aa5bc03-d6ae-47a6-ab71-e2c3894094d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245807, "uuid": "e6b12079-9194-40eb-b4c2-093176f33c21", "value": "9d195832da9b639bdd4fed66ae46abf2b1c502dd04968298815612b5f730bd60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38aa6bef-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243224, "uuid": "f27bf893-8cba-41b2-97cd-37c37f126485", "comment": "Malware payload", "value": "a454df678618b534623a923b6c112f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243224, "uuid": "d273c3fc-19c2-40ef-b678-b2a4d578e8fd", "comment": "Malware payload", "value": "9d77594dca11ff596916bebf541fcc7af7bf92f915a765088845c7fa8e28d51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243224, "uuid": "744190d0-ba73-470c-8b6f-514204a93ca1", "comment": "Malware payload", "value": "d3c660572abfedfa77048d810598b228ed17d6c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243224, "uuid": "ec5b63bc-2479-4cbe-afc1-4c51cd271f9b", "comment": "Malware payload", "value": "89bef7dfddda5696ecc05a10ea10de8630d8bc98d23dbe2aca58a5cf346f4147b01a4ea2fe32259b7fab421a29db939c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243224, "uuid": "698706bc-ccae-4985-9381-986849ae415a", "value": "T1D4D4AE67B6624E22D3851337C0DB9D0093A497C672A3F70E758413AA19073BECE4B7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243224, "uuid": "42d21b50-071a-4d39-8f5f-9122640fb825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243224, "uuid": "d03959aa-a5d5-414e-b5a8-20d5ba8eedad", "value": "6144:keUeq23ckyvBveMnzClAWaia994b0TFl2Qv3fT51/BrihF5otdrEMfcuWwqJVNiD:+PzCufqEf/LVM5otdIxDwEMeJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243224, "uuid": "b9409432-9fac-4acc-a3a5-d98bb0f39ab5", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243224, "uuid": "cbd1b241-b2e1-4884-9813-7c6eb60c4277", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243224, "uuid": "6674dec8-b4d7-4313-8be2-53a766fbd5b0", "value": "9d77594dca11ff596916bebf541fcc7af7bf92f915a765088845c7fa8e28d51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7494c5e-4abf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232296, "uuid": "e7169b7e-2bc6-43ac-9bcb-71cc6ef89ead", "comment": "Malware payload", "value": "26ee7d061025d192ad00b72ce2639536", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232296, "uuid": "ecdac858-99dd-4c08-8ab4-5dcc59922c75", "comment": "Malware payload", "value": "9df10232d4f88ee647da3f00cc01d6524c530c897f3fbe764133f9de1f41910f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232296, "uuid": "0ba6fc03-55bb-4095-b1c5-0fe2db85fb8d", "comment": "Malware payload", "value": "c101d2a01e0fc4ca035cfe434782426c19494bc8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232296, "uuid": "85d4c421-d4a9-4811-b3fb-252f2b8416e1", "comment": "Malware payload", "value": "b398125376eb31bea6bff9593ad303546a5ea21295bece2309c3a80ca57e88830fcb0890afba2c955271507b90d63790", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232296, "uuid": "ff9b803e-7a44-4bbc-81a5-3ddfbb5103f8", "value": "T1E5E61287FBC8986AC0F35732C5755AA144474C264B83DB839E58763C68BB6E05F1AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232296, "uuid": "9873eae6-0fc0-4f2d-a21b-54a30e67f279", "value": "196608:J0zs4+kdynqGWizpe5rebEui78nBPu5X+Ud06eRLFZh7H/bYDQlNMjpP1x4:cs4+fnIkIWEzQBPu54jth7fbY7pPT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232296, "uuid": "61664955-ce61-4db7-b44f-bdefd1f87f1d", "value": 15168982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232296, "uuid": "c91e38d6-aebd-4301-9dd0-ca2a5d518b1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232296, "uuid": "7b86574d-a799-4531-a80e-0432f8c82a98", "value": "stepapp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e8168e-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778245769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245769, "uuid": "93fe5270-164a-4697-baa9-115272a14808", "comment": "Malware payload (Formbook)", "value": "9ac9cf68691abe04970d0b9651643bd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245769, "uuid": "059bfb53-010f-46c4-a6f0-7b734a33c451", "comment": "Malware payload (Formbook)", "value": "9e5e756ecb8314faf536b2d8bef187f369567abb706d6211a93957bf0a271462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245769, "uuid": "8463f7b6-4129-4ce0-987f-a3cf41f5ce9a", "comment": "Malware payload (Formbook)", "value": "e5162767d73dcfb0c4633242cfea8ccd75701270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245769, "uuid": "6437d4ce-ece2-4bc2-9d02-2f15785554b9", "comment": "Malware payload (Formbook)", "value": "c896686c395ce9240eaa59abc9b8477a95e6f8a9b46e78487547339e2e4709e18cf4d0d481c04580a5c4446fc4369198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245769, "uuid": "9075dc40-4fb8-46ab-8aae-3eb886bdcfa0", "value": "T170351258166CCA42E46B07F818B1D2B00378AEADE921D54B5FDA7FEFF1BE7405609302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245769, "uuid": "5be43632-6bcb-4280-85bc-1f08ca7efbb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245769, "uuid": "7baa12ad-77ff-490a-9473-ca57f4903070", "value": "24576:BXcwXViOKAUPejCwktU+l+U5QO04fiAycbV8naMw:BMwX4mewkO+0mQOJfiyVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245769, "uuid": "9b2d528f-0005-4158-82e8-bb71b49294dd", "value": 1062400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245769, "uuid": "afcb128f-4a6d-422e-94a4-86d66b557684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245769, "uuid": "3d2edf11-b12b-4eb8-8759-fee1e59ae3db", "value": "9e5e756ecb8314faf536b2d8bef187f369567abb706d6211a93957bf0a271462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89f3f47-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778236218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236218, "uuid": "c8b6e33e-2739-4e59-8af7-b3c8085bcd9c", "comment": "Malware payload (Formbook)", "value": "9744dc7fe3effb3eec5a3aa31178ab95", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236218, "uuid": "775d4f38-0fd8-4459-8fe2-6eaaa57405b4", "comment": "Malware payload (Formbook)", "value": "9ea9adb1f6a80c0f0cba35d3e9b5fa6860d6d39530133bf4641cd012bd024197", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236218, "uuid": "47d0933a-f6e5-49a9-b02f-a632672641bc", "comment": "Malware payload (Formbook)", "value": "31541f738db4663686292b536e9b466679a449c4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236218, "uuid": "52bdd8bb-cee6-44a7-b1af-cb5cc6e164f5", "comment": "Malware payload (Formbook)", "value": "0858655bfd09e1b507c738fc0887bd9fc68d0ea61d87eaf591fa29cf9064389473315c63b382b1b480b95ad08ea54c30", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236218, "uuid": "83786eb6-6c46-4885-a43f-eaf3c0dea7df", "value": "T143E55C17D66F9B4D18093B61106A5D9AFE89CAFCEF727BC4E0CF90B610EA1110B855B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236218, "uuid": "23bcadc8-235d-4581-94eb-639bfc522b03", "value": "49152:BRhb4VejGx7O9u51ZUZkB91zMMcaSAOcFOMoeh7UpaBhw1BcL:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236218, "uuid": "a23837d7-f6e3-4764-9371-ac73cd289a0b", "value": 3123359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236218, "uuid": "3ecebe36-b69e-4fa2-89f0-3e931e5f0b65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236218, "uuid": "b0460a62-ca0a-4677-9232-0b2932e027bd", "value": "NEW ORDER #34-9C-042.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3076a1-4aa2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778219686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219686, "uuid": "ee425ce8-b625-4d90-8f86-b7065f20ef45", "comment": "Malware payload (Mirai)", "value": "5b847f3a162bf7b3dbde9d3f8cef5285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219686, "uuid": "794a14cb-f25c-4503-95e9-9db34bc3b274", "comment": "Malware payload (Mirai)", "value": "9ef3b008a82d078940a2223751c1c9d8e32148711cf403e5d6efb82d7430311c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219686, "uuid": "d8422173-5ddd-4544-ae7c-ee2ddd7f35fb", "comment": "Malware payload (Mirai)", "value": "9047cf819338cab6a8473da7f0d2a66d0f8fc5a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778219686, "uuid": "00056392-1822-4369-9bf1-da9088bf4b1c", "comment": "Malware payload (Mirai)", "value": "c0ace665e75b6ea8c169052b083ebd4fef0cfae741d48a1cb1fcd77e1ce04b674bbc200e6611e3b197f12dd21d4d33bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219686, "uuid": "66f19e64-b67c-410c-b6c2-ce1cb663c612", "value": "T17E6301B872EB8474E0D9A532264F21207331E76AE47B53D92A89B59CF25259C0913EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219686, "uuid": "fbe26ef8-52a6-4184-b4c8-f1860b081aa9", "value": "1536:hltrI7mDmde7Lletk8cghgLFPjihgulh6DoI1AOrPD:hl+YmdkLMk8c5PdulI1drPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778219686, "uuid": "654dc782-7951-4769-9b7c-184528393443", "value": 70848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778219686, "uuid": "7e0f04f0-b758-431f-addb-59bac7faf973", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778219686, "uuid": "f1431a39-3e55-445b-86dc-1882753edfeb", "value": "xnxnxnxnxnxnxnxnpowerpcxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbe5a82-4b35-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1778282716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282716, "uuid": "82a1648a-2242-4cc1-b1e0-dfa36d5cc9cb", "comment": "Malware payload (RustyStealer)", "value": "93fa4fa73c6bf8bb32dabe280f1177a4", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282716, "uuid": "c63ae494-c645-4e95-97cc-6e174f1fda7b", "comment": "Malware payload (RustyStealer)", "value": "9f2ea59c627897be4ec0827992bcf23e7e276d75b5235ad85fc89be634012a4d", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282716, "uuid": "2c4500e0-e227-4a18-81cc-bea59990856d", "comment": "Malware payload (RustyStealer)", "value": "4169c551451f344b0224a8e7aa54a04ce0b35ec2", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282716, "uuid": "01ac5845-b223-4bd1-a841-388c08c4d8c0", "comment": "Malware payload (RustyStealer)", "value": "59a84b594099d048e969a66d325c0ee9d8765a66fe8e3b58c49c3abdf35d82984d8c877f2adc56f81ca219370ca8c5cb", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282716, "uuid": "3b334629-9d98-4106-b007-857aed725f93", "value": "T1E8C57D03E2A480E8C4AEC178C71A9627EB72B88A1534B6DF67E44F553F27FA05B1D315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282716, "uuid": "f0b7480d-5185-450f-b102-377a90c9330c", "value": "d7f9649631d0ea4ee1229146ce522178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282716, "uuid": "8b6cd5aa-58b7-467f-bee5-e95b1ddaa5fc", "value": "49152:1OnvUt3DlwG2fAjNe1B1LOJlO0OC5a3Fuk5TvEpcX:1p/wrfpB1yHGFt5Tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778282716, "uuid": "bb8510b4-712b-498d-95f7-b6416ed5e1ea", "value": 2674688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778282716, "uuid": "4572a9a7-4f6a-4ae7-a08f-278e23ebe183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282716, "uuid": "499863b8-f48f-4634-8338-fb2e2e3e1422", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d90546-4b02-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1778260914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260914, "uuid": "06e98292-852e-4091-8da5-39828d7f43f2", "comment": "Malware payload (SnappyClient)", "value": "5e0336d5e40873b81d0116e130cfa023", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260914, "uuid": "0f26f4b0-542c-4f67-b574-84e72103147c", "comment": "Malware payload (SnappyClient)", "value": "9f848db15f173db2f435c3f51fcf5acb843161173213721161619c5a9f9de8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260914, "uuid": "de7fe336-ec43-436a-815f-8221fdedeaa4", "comment": "Malware payload (SnappyClient)", "value": "e7f2416539b131e7dd071e2e189c1ae2f6c5f6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778260914, "uuid": "f55509df-fd56-4492-b4b8-99fd44214ab8", "comment": "Malware payload (SnappyClient)", "value": "7aea210c9e9e89ca4f3fdb54e310f962befc06e506a72fb6805b6139bb950b2f7e58c688859a95097679e1a27fe374fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260914, "uuid": "564e0ff1-65fc-41e7-9186-d6c1f2363c41", "value": "T1E7769306CC75CE55E6B8963054A721262BBD3B485F109BC722C8B7283C57BE4BBB536C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260914, "uuid": "69727160-56dd-423b-a254-29fd82226179", "value": "8ef5b4ee406508dd84af5c923ae5e63c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260914, "uuid": "4bc988a0-5239-4949-b604-838175cf3160", "value": "49152:YH9Tt+PTq/qVanziYhM64tDvNouzFuuJDz6lxswYLZZZZHcB8cshqgj:YHMVa72vHuuB6krj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778260914, "uuid": "76565c2a-fbba-44f0-a245-1a8a34a71955", "value": 7795200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778260914, "uuid": "70370f36-4f11-4204-836e-cb2bc7c7cafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778260914, "uuid": "6c33621f-ca74-416e-9299-8080ea9d5715", "value": "SecuriteInfo.com.Variant.Lazy.721682.11219.11068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3125f7e7-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243211, "uuid": "76204906-4f64-4ecd-97e3-0af90701dfd2", "comment": "Malware payload (AsyncRAT)", "value": "96b0214d01229658591dca4bc093c260", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243211, "uuid": "3b3f668e-0291-40a1-b620-7d3dd29ab27f", "comment": "Malware payload (AsyncRAT)", "value": "a008a15a228ccb6d2ad23aa65b6ce1c2ddffa33747d63bb9770dfc85ad9a66a7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243211, "uuid": "02bd7a11-c466-4fa2-afe6-c9712bcdb54d", "comment": "Malware payload (AsyncRAT)", "value": "9603d417a1c20af9cb5ddd132a777cef34bf2ce4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243211, "uuid": "24967c2c-ecc8-4d00-a4ba-3cae367df897", "comment": "Malware payload (AsyncRAT)", "value": "86e34c5771c63b4d878285741375bef790a9d0fb95d158aab096a318ecdb4e1fe4b8170dc6c99f14f3a9663cf742e713", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243211, "uuid": "713d5415-bffb-464a-98bf-621f2b998b49", "value": "T18E25E05923A8EE01C4A75BF40870E3744BF56C589422E30B9EF6BDEFBA397016905397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243211, "uuid": "43ab5cd6-1376-455b-8c43-efb67973f67c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243211, "uuid": "f13bcf58-4310-4d76-821f-3c4d04459ac7", "value": "24576:N7AxGSJJSHwhR8hkqEx2bthjMZJWPVJW05q9njRqEYFd:N0xGqUwhGhFEYfqJ8W0unj63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243211, "uuid": "faa9e509-5757-4792-886d-4e61dc603bb5", "value": 966152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243211, "uuid": "43c360ea-649e-4639-9f52-eb2b0211e733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243211, "uuid": "9ce5cdb7-ba91-42c7-a774-ad532b759a93", "value": "a008a15a228ccb6d2ad23aa65b6ce1c2ddffa33747d63bb9770dfc85ad9a66a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125adb38-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246166, "uuid": "708fc718-caa8-410b-be82-c8f6310f30eb", "comment": "Malware payload", "value": "9f4d247483ef7a3e535767af9b503d89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246166, "uuid": "0c31e8fb-dcca-4e3a-9926-79f0dcb5e671", "comment": "Malware payload", "value": "a01ed2565f49b2b3e03f7309ee5760ad619ab135cf8fd4c41a32873e4b3152e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246166, "uuid": "da3983a0-cc2b-4594-820b-fbf83e7c472b", "comment": "Malware payload", "value": "e59c243cbe3b0f12f4fc813b3e7da02d7d604790", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246166, "uuid": "a8fe5e81-370f-46a2-9147-6b382a5852a4", "comment": "Malware payload", "value": "aad1f56264f8cafd7b79101469930016f651e07ad8ca5a8998a83588d7350ce630a6525d795d45f389dd8db91d429ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246166, "uuid": "41655bd8-c384-4cfb-8d1f-87caeaa7bcaf", "value": "T1CAA2823ED5D4ACC0C76B22F478EAF7C201AA9B07BA165B9CF8DC54910B40354EB7818D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246166, "uuid": "cba9d933-fba6-4fae-bd15-0e7443051a13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246166, "uuid": "546d0d42-2b30-49f6-b309-d5f1780d723b", "value": "384:YGz57Ngy0Rmg64b1PkFSsjIj1SR6n8TijqATxcaUMgUJlKLAoS4yh28typERsQ70:Tz57Ngy0Rh1bFAsj0oNTaaYUMAFd1opV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246166, "uuid": "99fc22c3-9ce7-4acb-9dc9-2d27202ae3bb", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246166, "uuid": "3eef08b8-2754-47d9-a7b2-363bf2b4ef53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246166, "uuid": "e6c0151a-5c7d-4a07-adf9-f6c68ee6288c", "value": "a01ed2565f49b2b3e03f7309ee5760ad619ab135cf8fd4c41a32873e4b3152e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3cfc38-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778242611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242611, "uuid": "9b6fe481-a521-40b4-bca8-4c16d67ab788", "comment": "Malware payload (RemcosRAT)", "value": "34d4da69e43f2bed1aa0ed5179dd3307", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242611, "uuid": "bc0995b4-3539-4ad5-924d-ddcebd75646c", "comment": "Malware payload (RemcosRAT)", "value": "a0637414c70533289c87f6bd6ab7708de14f91eaf7643f67c66a1ebc4bf1c4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242611, "uuid": "604693bd-1d17-4791-a578-123557525399", "comment": "Malware payload (RemcosRAT)", "value": "f1c4a7359b60c88496361972d9ce4d8cd47489af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242611, "uuid": "d809f036-7163-4059-9398-2fc12bc56583", "comment": "Malware payload (RemcosRAT)", "value": "4eed92afa33dbbf326feda7adac7112cdeaeba91c338b717ba507a628364a761f8cddc3bfdef62fea79b4981951e44ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242611, "uuid": "d88e181c-59fb-471e-a6ea-ee0cc3f72f39", "value": "T11C551298321ADE02D8925FB44971E3B063789EDCB420D3478EFABCEBB5BD7016515293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242611, "uuid": "27a0720d-eaf9-48e2-9d6c-3f5c9c477f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242611, "uuid": "cc944012-4463-48da-ae43-27a77f06cf4a", "value": "24576:I7/gmtI3RCcxb49Tmnryu1KKua7rqFfFSw7JqSDGpSYCYxS:I7/gMI3RCcxc9TwkKuAMk03GU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242611, "uuid": "9907d443-2726-4c20-84e5-91a6b327a07c", "value": 1346560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242611, "uuid": "22c6cc6c-0251-4992-a728-c3b7edd22ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242611, "uuid": "dd4ecca7-dacf-4a99-aa44-a0a25fb2c330", "value": "a0637414c70533289c87f6bd6ab7708de14f91eaf7643f67c66a1ebc4bf1c4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb43af56-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778244383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244383, "uuid": "f544539e-9ed9-4e7b-b8c5-b866f85d2b93", "comment": "Malware payload (PhantomStealer)", "value": "9cc0d5893656d5b1dddf86f16b9d4ab9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244383, "uuid": "b4fad6bd-57d0-4195-95b3-eca6e79bd0ab", "comment": "Malware payload (PhantomStealer)", "value": "a073c1ccefa9613ac2cff88a9a7455f15b9b834c2bb5f93ee523e06f1c895847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244383, "uuid": "a53b927e-b355-45a7-b77e-1d69c6511c8f", "comment": "Malware payload (PhantomStealer)", "value": "b8783c8f0903115abf75bdf74e33f38a0acbdd61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244383, "uuid": "d3be65a8-0dc3-4244-9860-4e2693f4432d", "comment": "Malware payload (PhantomStealer)", "value": "53b83c57e047a44aa256b62832eaabbdec7e5a89273035a25bfef97798e209c20bdb3fc4046c7b8c5502502de9287000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244383, "uuid": "91248c75-cc7e-43fe-b452-9be01d71a860", "value": "T107651205A3ACCB45E8F65BF919A5C53417F06C9DE920C24A8FD1BEDF713A7141A88B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244383, "uuid": "ba82c0a2-da7d-43b1-8cf2-a1ff4046b977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244383, "uuid": "c906101e-c1e8-4bd1-b8aa-9566c4ae79e3", "value": "24576:sGRX0gC4Iq9ZzrgdYZzEMrf2jxH6k4CnnSqAjKK8K7ATUXrrzb/ZLCnqKOEMdPy5:BEF4Ic5rg2wMajqqGd8uUUX7leXOEMdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244383, "uuid": "24c447cb-3ea9-4b0b-a1f6-b8bfa174fa7b", "value": 1532416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244383, "uuid": "d8fa46e3-5a6d-4509-bf9f-4c1954aa10c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244383, "uuid": "19cdbea4-b857-436d-9118-37435acb1152", "value": "a073c1ccefa9613ac2cff88a9a7455f15b9b834c2bb5f93ee523e06f1c895847", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e61f532-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1778243368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243368, "uuid": "edaf8aba-b073-4452-a188-8382539cd503", "comment": "Malware payload (SnakeKeylogger)", "value": "8930b1d130b0f6ca3f60cb4499ed6aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243368, "uuid": "ec8f9d04-5076-4513-a964-d1609cd48f93", "comment": "Malware payload (SnakeKeylogger)", "value": "a0ae3275aed9137a9a36c7dc0e8ab950281ae8bb26573ad7233be06f2ad5ea6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243368, "uuid": "0830ac35-195b-47e4-b101-b76f2b620be0", "comment": "Malware payload (SnakeKeylogger)", "value": "998638776fead3362c2e1477a49c8f9c71c34864", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243368, "uuid": "6b74a0ea-c9f3-4423-ae0c-38baa7199ebe", "comment": "Malware payload (SnakeKeylogger)", "value": "f0e07021518b86a77676d8b2324d339807cf864bd0232a830b9109f8900991d4d3dd914efb1af368492105cd87544824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243368, "uuid": "581815bf-b473-4470-b97b-d19cb2c77d40", "value": "T12035AE0273D1D062FFAB92334B5AF6115BBC79260123A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243368, "uuid": "bc27b261-7163-497a-b93e-1ffd3b3d2940", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243368, "uuid": "78b30ab9-a63b-4a71-92dc-0999089a51a9", "value": "24576:P5EmXFtKaL4/oFe5T9yyXYfP1ijXdazr5W11b3PACm3:PPVt/LZeJbInQRazVO1b/AC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243368, "uuid": "7126a440-f263-4b4c-8bc9-9251c46c1e0a", "value": 1086976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243368, "uuid": "5c2c79bf-ac55-4601-b00a-7e9164d18f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243368, "uuid": "ae0947e6-4727-491f-8b42-71749d860b58", "value": "a0ae3275aed9137a9a36c7dc0e8ab950281ae8bb26573ad7233be06f2ad5ea6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c891e2c8-4b11-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778267517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267517, "uuid": "fb2cba30-f850-4c7f-bf1f-2882dcd446f6", "comment": "Malware payload", "value": "c637625cb33464c548bdcd7f1598c7eb", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267517, "uuid": "4aa6ec48-f6da-4a11-a3fb-cf5f4ae635eb", "comment": "Malware payload", "value": "a0e40b9c3895d8ce0283c07ece42dff634b9a13c882ab326eacb71f84961be35", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267517, "uuid": "2cb00b84-9845-4b93-8d42-5a75c669d193", "comment": "Malware payload", "value": "aff7d0238e666774faa6f348e6680c3f702dd4f0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267517, "uuid": "258bb99c-403c-4959-87ad-2d0d4eb84c13", "comment": "Malware payload", "value": "babddd8ce7188e81005e22836637223d04ee7fa902b5c52068f9a24e43470e6e54e2826ad4a1556cf17cab57d2a2c556", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267517, "uuid": "cdeb1a17-83b2-4a00-af7d-04e2cd9155f9", "value": "T1A9D320CA4E8F88FBD75B6464457F5C079AAE9313060EC5D17ADFA9843F23D94306A8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267517, "uuid": "a945dd5e-6d8e-46f6-b331-e65e5d4b44f7", "value": "768:1qUTsgoV6gH9XdqPG9Tg9XkUcS4CAosvbPXSshaCcF58ZBRmo4ejtyhuyVxKbK9+:QOsgAdNAGBUtDi2fGk6gwty1sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778267517, "uuid": "b9aeb27d-c7b9-42df-9eb9-739d25d5cd7f", "value": 136936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778267517, "uuid": "22ebd6e5-7e48-4edc-94e5-3f493305ad62", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267517, "uuid": "493b2eeb-976c-48dd-963d-05a95b57d0ee", "value": "Core_Journal_Office_2028.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf1a09-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243419, "uuid": "080b4c59-5444-483e-817f-b50173fe8bcc", "comment": "Malware payload", "value": "25eadbd8cea0cb5de3ae91d891b76a52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243419, "uuid": "00c04fc1-6510-4a6e-847d-29d275b0179f", "comment": "Malware payload", "value": "a1383a7b511e4a631275cedbd1638406182aac8da25ef0ea4291b559368c3a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243419, "uuid": "a23b9dcd-ff56-43b6-a73a-ecbcbaf3592b", "comment": "Malware payload", "value": "26cfc68da1f7b5814a58a8cac1c96e279f38c941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243419, "uuid": "2dffbb11-0928-459b-95f0-fa10f30729c3", "comment": "Malware payload", "value": "c52007faa4844f44a3ba2d9356244833bddf77fb40658a83e0659da83a25d09820286977cca1b980f23aebfc5656d832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243419, "uuid": "bd7addba-b972-44ea-92e2-bf816d4ff166", "value": "T170C43216EA61A02FE49389B0797995867D293E321380AC5BF7801F6930749BBF0F571F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243419, "uuid": "c5ce98e4-989a-447c-a575-9efbd7396515", "value": "c85577bd19141690c8f69c349f8bcc2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243419, "uuid": "7bbdfdf7-fdd4-47bf-bccf-5844e4cd596d", "value": "12288:n75kpZwbfXELffkSfkIJm7vf1Ian0Dg6acWIk:75ky8LffavNIaN6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243419, "uuid": "7b1205d6-6ca8-4450-a966-4766038f80a3", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243419, "uuid": "bbd0b56f-3536-4710-ac95-cd8bb687d74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243419, "uuid": "4eebd40f-b920-4399-9d7e-448f75b1a8a9", "value": "a1383a7b511e4a631275cedbd1638406182aac8da25ef0ea4291b559368c3a98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b177a66-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246288, "uuid": "80736902-f649-4e14-8cc9-26e73468d5ab", "comment": "Malware payload", "value": "f4beb445e052f627b4fbb695e40b41c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246288, "uuid": "d5ce8641-9e04-46fc-880b-17eca1a4c201", "comment": "Malware payload", "value": "a160dd8e45c7aef88ffada52207b622651a2d951d7b4962b3ac9681fc7ca0095", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246288, "uuid": "bb89906a-27e3-4348-aaf9-da5d4cfc3917", "comment": "Malware payload", "value": "010df52852ce367b033db07959f9efb498163b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246288, "uuid": "3be8a638-164f-4367-9ed3-d8cbb4e3e91d", "comment": "Malware payload", "value": "438489ae722b13cb747f6d3c5f8076d4b899b7e90617a2f145d35dedb87691597a622ba5806d28287b95e4d8996583f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246288, "uuid": "42aa0858-fac2-4556-b48a-70f8924c5604", "value": "T137351229622CDE07D9760BF50831D5B027A41EACE961D14BAFCE7EDFB07AB144A24347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246288, "uuid": "2ab23ec8-b34b-44e9-919c-ecea430e6864", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246288, "uuid": "300f3c2d-d69a-407a-9b2b-7747dd409151", "value": "24576:lBsJJgOPHugOQ0/pyeIzxzwFS/1FAm3I+M7keQ8gX:lBUPHzm/jmxkFYFnItVVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246288, "uuid": "cbe0780b-f0bc-4c1e-8082-e571c1ba3114", "value": 1077760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246288, "uuid": "2543aae3-e3e3-4b1a-9382-c8039ad6069f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246288, "uuid": "d1286a1e-4e68-4dbf-bf77-71b4f978c2eb", "value": "a160dd8e45c7aef88ffada52207b622651a2d951d7b4962b3ac9681fc7ca0095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c1fa70-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244076, "uuid": "05ee9d0c-05ea-402b-b9a9-c301cc03a7d7", "comment": "Malware payload", "value": "ca7d8df8b68e69164d04375f80778317", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244076, "uuid": "36eabb73-68bf-4ff3-b314-56d522363b52", "comment": "Malware payload", "value": "a17340d89441d26f04348a349d9b23cfc50faa7005ee37cded01de96235e4dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244076, "uuid": "c758ef7a-7206-492d-8e90-e5c1ed99b5a2", "comment": "Malware payload", "value": "736339a740c7aba815c7a189ddfc636187e7e4e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244076, "uuid": "d4e642f4-487f-4b03-af31-461ff7056f3b", "comment": "Malware payload", "value": "c7af4aff23a780b4a3b73aafa83b4af8da57ba6009512452c677e4c50bcafab68dba18ec5d5fce7eafcb63a1d8bdbac0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244076, "uuid": "c16dbbc4-d979-44b4-9bad-c3fb2e4b5c8f", "value": "T1BEC45316EA51A12FF45789F179785A467C282E761680EC4BF7801FA93070AABF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244076, "uuid": "a39d5bcb-f30c-49fd-bcc1-0d05932999e7", "value": "a4ac17fcd6db5254a622dbf162af6d45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244076, "uuid": "96f88cd5-f19b-4f44-882d-8fe655da947f", "value": "12288:YbamiSWD6ybFqzSx7Yn1AUuQEAPfrGHpg3qZvrRAefwieoFe6Sjx:YGmiSWb2EJroixe64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244076, "uuid": "52ea9fd1-21e3-46f7-b40f-c539ef42d1cc", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244076, "uuid": "dea9c6ac-bcee-4c01-a8ea-ed7d663330d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244076, "uuid": "6a550d53-8e4c-437a-8ba2-3090618a2e4e", "value": "a17340d89441d26f04348a349d9b23cfc50faa7005ee37cded01de96235e4dd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790c304c-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778246768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246768, "uuid": "783e25aa-0eda-4138-b02a-39f651a64a45", "comment": "Malware payload (AgentTesla)", "value": "64d56f1f80b68f27e57ad000065c16a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246768, "uuid": "2cedae32-7742-40b0-a5fd-6c0c212c8ee6", "comment": "Malware payload (AgentTesla)", "value": "a2544365eb8d51efa9c27d98abfe60bc5e97ed6d232986f419fb3ef78c2b5696", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246768, "uuid": "fdcbc011-4f26-4e46-9a08-009c500ae7ca", "comment": "Malware payload (AgentTesla)", "value": "b4a736eb7c96af4a897186e97e4dd448b9d0560f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246768, "uuid": "db0132f4-8604-4f2b-90af-6142703bb5a9", "comment": "Malware payload (AgentTesla)", "value": "dfa61ef03e3bce416c3e52f50eff503a8ea651b17f580284667349c5c765c006d58cf4f2915bd6b77f8767714b445a9a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246768, "uuid": "ee3b9fcf-d2c0-416d-a03b-5a162a86718d", "value": "T19515BE71AE126F50D63D5BBDC0D20558E7F89C078312D79FAEE832E96A73AC6C913811", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246768, "uuid": "dab6476a-cf03-4560-99b7-416367adfb60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246768, "uuid": "daab8f7c-0b94-46e3-b94d-6377408dd920", "value": "12288:QE+fgKBA0VAWjL7KcXdnxmv5odwAKoGXa91L9Mg:HMeOnLGcXdxddwAKoGXaD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246768, "uuid": "1a03c03f-8345-4a5c-ab63-36e33f503ca2", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246768, "uuid": "bceeee94-4849-4dba-b2d2-b2abef2cae7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246768, "uuid": "c6e5b03f-8c05-4c20-bcb3-01f9dd3387cd", "value": "a2544365eb8d51efa9c27d98abfe60bc5e97ed6d232986f419fb3ef78c2b5696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b19289e-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244114, "uuid": "bdba7c28-05a9-496a-a173-dd27330d34ea", "comment": "Malware payload (Formbook)", "value": "26ea39c9869fffdfda7389295c32d5ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244114, "uuid": "a541d3b7-1452-427e-a6ed-8aa5aee78d1b", "comment": "Malware payload (Formbook)", "value": "a25fae26922ee1223edd81a29e05e84bbd4dd43eaea8596397f6be2d159f6eeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244114, "uuid": "dcec2622-a778-49fe-8b58-9f3c3ed660f6", "comment": "Malware payload (Formbook)", "value": "de4d05d255d833deb9af33d807b001ecf165d0c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244114, "uuid": "ca279bfe-5419-4f40-a0bd-566b9960ed46", "comment": "Malware payload (Formbook)", "value": "18f47170a3d487ec2ba9bc22827bceeef9ffd97ac1d69d6c4b7123864b4eb20b3c1053e62712bafcb94c7b2e637d94a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244114, "uuid": "5f3fd852-85a6-4a96-b8e5-c3be96953b85", "value": "T1F945F0513A4FE681F8AD0F741566FA3447223EDAB410D24A4ED4BEE77BF27863426312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244114, "uuid": "87abe22c-4dde-414e-a47e-7ad69ea51959", "value": "24576:/Y58+v9o/pjPAXHu9P3SVi52jCbNc1i54Kb6dInXaO/61RAdEmwRgIYNJ9:ADva/i4PC22jCXeoInHBRgnNJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244114, "uuid": "0074a1af-d509-483d-85f7-b869fc8e34b6", "value": 1197056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244114, "uuid": "d6564612-48cb-4fe7-a482-e65e45550f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244114, "uuid": "cd8b8310-d0f4-4a33-bf17-3540d9919236", "value": "a25fae26922ee1223edd81a29e05e84bbd4dd43eaea8596397f6be2d159f6eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da460d8b-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245643, "uuid": "7ab7da8d-e4e6-4138-a420-1b7eaada8597", "comment": "Malware payload", "value": "d18fb800d48da3b8d947fff1ecd90dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245643, "uuid": "41fd6da2-1cab-4845-9d6b-4782aba69cb0", "comment": "Malware payload", "value": "a32b45c8240a177cc27744197352f389f7f715145fd94f5bb4940dabdd8d6ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245643, "uuid": "b6d1923d-e44f-4a31-bc1d-d783fe09355f", "comment": "Malware payload", "value": "7fa336ee206cb94fd8023b73a3b0a99ac81dbfd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245643, "uuid": "54767935-68dc-40b2-9b57-cbf88ae3a751", "comment": "Malware payload", "value": "bf393e2cf57d669b30172c052ed13a1b9a73bd95499f1be34117bebf899bf27b0d4a6ce425714c05d52742fc5d1c15f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245643, "uuid": "50df69aa-c333-4573-81ed-f0fcecda5c23", "value": "T146532B78D9C4ACC4CF5B9371606A93C103A79E07683A579C9EDC38670BB33946A78379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245643, "uuid": "d01523c2-efcb-4ebe-9b50-2699dba7eb3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245643, "uuid": "c1deab49-49dc-4a47-9b0f-70212a30f89c", "value": "1536:brUbIVWu5JelMMaxEhUnOmuK5j3wDu3Y6Uk9jg+rr6GbOsKpeQiQKW:XUb6fOMhrOm1cDud7r6GiX8QiQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245643, "uuid": "ab0fc469-46f4-4230-9758-6c1331af6b8a", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245643, "uuid": "cce58bc2-b923-4e09-8c97-5151793768d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245643, "uuid": "c4b1e6e1-1caa-4c59-8a50-86f9b0f5f42d", "value": "a32b45c8240a177cc27744197352f389f7f715145fd94f5bb4940dabdd8d6ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a01108a-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245749, "uuid": "bd51465b-fa33-4302-85ec-f78428e9f927", "comment": "Malware payload (MassLogger)", "value": "577e9c9c69c263f914808f76dc6c97bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245749, "uuid": "8635e7a2-ce2c-48b8-984c-587d32901cdf", "comment": "Malware payload (MassLogger)", "value": "a3f214c6164670ea3078620afc2719cf1bba7d93cc5f8d090c7e49b23b782d05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245749, "uuid": "d844b86c-e5be-4fc1-a916-6577b9be82f5", "comment": "Malware payload (MassLogger)", "value": "24b86118226250184c6a4291a6215e4f13706f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245749, "uuid": "ad104e67-e560-4910-81f6-9d9848a535f1", "comment": "Malware payload (MassLogger)", "value": "6ba96d67c6c1df93a1a63a84444d2e091240a35baf65f7ebdd54a57fbde66c27edc682e791f4697f20cfe97bd3583cb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245749, "uuid": "3731d8d0-2f17-4bcb-a43b-848f3e9591a6", "value": "T16905121023ACD609D57A2BB00D71E0B027B89D4EEA21C65FAFD87EDFB4BE7001659356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245749, "uuid": "bad7fc3a-6a95-400a-863c-826779ed9469", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245749, "uuid": "fccc6288-7241-4ce7-9a13-8f32279b0475", "value": "12288:lqwhbgI8o5lSBClgrlbVdy3pqyfwukaSKe4JZZMRemVn2DrozfuA0GOZAjtC:lXUo5811VSV5kTZ4JQsmVnoo9Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245749, "uuid": "539b27b1-4060-4fcf-bb5b-720bc1b9efa5", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245749, "uuid": "a274449b-6185-4fa6-93f8-a2570434e8d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245749, "uuid": "1d956545-5f69-435a-82fd-c5c5117c0c1a", "value": "a3f214c6164670ea3078620afc2719cf1bba7d93cc5f8d090c7e49b23b782d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f47f5e5-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233410, "uuid": "3f2be19f-0d29-4c0c-8956-bf42476ea5a0", "comment": "Malware payload", "value": "7beaa91c547dd3ab4069ee95a5a6eb16", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233410, "uuid": "c66e1bc1-b4df-46d4-832a-42e99c6ff253", "comment": "Malware payload", "value": "a44b8169cd3bfdeeffaaf0bbd1895b4eee0573c9fc4dd10d37e90f28ff4ed38a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233410, "uuid": "1172762b-12c1-462a-9863-0628cf56620b", "comment": "Malware payload", "value": "2289552dadcffc65799fa774938d3688b991dafc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233410, "uuid": "ed81778f-bac4-486a-a551-dfb1e1a784a8", "comment": "Malware payload", "value": "279efa016b2a772165a3ff21cf5d0d1a740921145d606bc0ab46861c7d6cba265dfc5d7d88f8effa88ab9f6734b0b27c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233410, "uuid": "e9bed8e8-1ea2-45f5-9833-26055aa10d17", "value": "T11507CD23F51969A6CED6A135F5E3079136341D480793A229271FF026FDF21CECA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233410, "uuid": "81962ee1-bb53-411c-86e7-dccfba691ae2", "value": "393216:0MFcIF4SMD4G8lzuUKWwqmcWgQqNeFzOPxbudDn7notBa:3F4SMEp1uUKWwqmcWgQqNe8YD7notBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233410, "uuid": "1017d890-1c24-45f7-a916-d46a1afce144", "value": 17884769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233410, "uuid": "60edcd4f-080e-4433-87d3-17f6181719a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233410, "uuid": "57cd8c46-5464-4a82-959b-b1e56d65fa3c", "value": "iMobile Lite (50).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e607dbb-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778243770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243770, "uuid": "05a90dc0-659c-41f2-a203-30a21794968b", "comment": "Malware payload (RemcosRAT)", "value": "10943b7830349118d4ae13961f7bb40d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243770, "uuid": "1ae50b6d-29ce-4499-af37-6eac3bc03621", "comment": "Malware payload (RemcosRAT)", "value": "a47587b04f01f2758101fec327cdd4ca164c1317c8c5344277e171606610ab5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243770, "uuid": "4d786a86-5a6d-4580-9178-d6dd49554911", "comment": "Malware payload (RemcosRAT)", "value": "c80d359e73489800968a7b1b31e965e9d6b3b810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243770, "uuid": "abc5d744-f0ef-4e63-9453-a466870e450c", "comment": "Malware payload (RemcosRAT)", "value": "36b7cc16ee80d06fe3fc3098e27649fa88e7fa1f0db41a6407f9790db251c287206860a0a3d0ac97a926dc03c3004e70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243770, "uuid": "2620db8a-b112-4078-8c44-3ee3ce07b125", "value": "T18A6512842355DF02C8A32BF45970E3745BB59D81A522C3178EFA7DEBBE3AB0169052C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243770, "uuid": "0bd66bfd-acfe-4356-9c8b-ad98f4f9f96a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243770, "uuid": "91f8989e-abc4-46c4-bf53-f0829662dc22", "value": "24576:M/p/e8GJ+17oO4s5UgfRwk+z3xMkpd/fXPcSAtAxHnRtlySaXxmSJJSHw:M/p/e8f17oOj5UgZPmB7pdfFAtYHnExd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243770, "uuid": "abbd60b4-0cf4-4bb6-8d63-7d09f0f1e385", "value": 1411584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243770, "uuid": "c9ca15bb-f567-41c9-a20b-160081df5576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243770, "uuid": "8911e9ef-82d4-451a-8b44-f29002a84a92", "value": "a47587b04f01f2758101fec327cdd4ca164c1317c8c5344277e171606610ab5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edb0a38-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778244040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244040, "uuid": "8a806d09-90a5-4aae-a453-4cc72f6aa064", "comment": "Malware payload (PureHVNC)", "value": "67b5b124cc551464579c77eae74ee215", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244040, "uuid": "aba8b0dc-d561-4a7d-9179-e3225efbf572", "comment": "Malware payload (PureHVNC)", "value": "a4e68348deeefe53cbff09f43e9ab72019a16c8d0934a268cab37cb41d154f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244040, "uuid": "2af0b8f1-cbe2-40b3-a88b-74aee96552a8", "comment": "Malware payload (PureHVNC)", "value": "1a3e617dc0b852a478f9e5025c0852f556f7c7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244040, "uuid": "60269165-4114-4ae4-a6e7-2d585ffbb467", "comment": "Malware payload (PureHVNC)", "value": "05eff2987e8d5457857787b1a08af2c3a45bb54f3a25c2a294ba8c3506d16db15936caf9e3f60f2619f770fb6fc4078d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244040, "uuid": "f79200eb-2f3b-4b00-83ce-72546f8d81e9", "value": "T116E3125A57E093A2C07F62739D731644A67397EACAC93F0F5DA1E4980F2F364B246B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244040, "uuid": "48a493c7-0482-4020-bde8-e0ea8a86391d", "value": "3072:aPBW694B6el1m1vZHRypqfH8aBXx9lGsVcNxXzK0vZsvvIWrvP:ChuD2RyUv8avQzK0xMQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244040, "uuid": "fe9aaa0d-7a64-49af-99de-c3e3ce3b5e65", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244040, "uuid": "428945c5-e3cd-47df-a168-429daf54b592", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244040, "uuid": "6daf00de-1ec2-4e19-9b87-a8d31120c5b2", "value": "a4e68348deeefe53cbff09f43e9ab72019a16c8d0934a268cab37cb41d154f7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e088bb8-4af3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778254427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254427, "uuid": "16aa87cc-bd11-4637-919f-d2f6f62ed7fa", "comment": "Malware payload (RemcosRAT)", "value": "24a69368c9526215886bb54ae092ad75", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254427, "uuid": "4ae11e73-aaa1-409b-b95c-596d08a81294", "comment": "Malware payload (RemcosRAT)", "value": "a4fe0742166935045dce6216e82d814cee38daeaef183aae74577c381df3f91e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254427, "uuid": "63f2d740-3fa3-40c9-b936-3c40855f5b38", "comment": "Malware payload (RemcosRAT)", "value": "46ba7b2a86ab28ba0da6f7df3652d52152c55183", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254427, "uuid": "40735d04-3725-48d0-8e61-7d0b14fbef25", "comment": "Malware payload (RemcosRAT)", "value": "7e9cbd3f651681460acddff02e596a5a17ff90e6d937ad9418542fc5db0f8b3c814430d78b976b26167fa9690625294b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254427, "uuid": "04362c1c-9e56-42ca-85e8-0b8d30fd0b73", "value": "T11D265B17D66F974E18093B51106A5D9AFE89CAFCEF726BC4E0CF90B610EE1110B852B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254427, "uuid": "0b38b3c4-b921-4d33-ab9b-34e7cfa61b41", "value": "49152:a4ps1yfeORnXCwI/DduiiccEPnAxtTB1KWIdScqA87YTZSoiUx9nn67U1qXdSPWh:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778254427, "uuid": "d8cd9667-d649-407e-a741-e06f19661b94", "value": 4743414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778254427, "uuid": "e257b043-6194-4ebf-b24d-e15db772b958", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254427, "uuid": "2605080d-5b2f-4f48-910f-a1d0570a68a7", "value": "Request for Quotation \u2013 INQUIRY#40152026-May 08.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d89f23c-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1778245916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245916, "uuid": "8eccc167-ed0e-4ebf-b011-5917e97d8839", "comment": "Malware payload (MassLogger)", "value": "76a34f16e1b2777916f553ca5838bd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245916, "uuid": "50988c73-8868-49de-9824-4e82aa26d05b", "comment": "Malware payload (MassLogger)", "value": "a53b0f944d906d684172cdc0e5ecf249b70d541f87e1e477d55f22d24ca7a000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245916, "uuid": "27ba5834-9361-4f1b-8ad4-9da4fa252fc8", "comment": "Malware payload (MassLogger)", "value": "5b6746ae19fcbd09c777c5a8119c988f4868aecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245916, "uuid": "62f18bc9-bd24-4f9c-8a10-4fa42bec0246", "comment": "Malware payload (MassLogger)", "value": "f1cb923471af08b0937f4aa56bd36dda400a6bd33aeeb3fa6315a1986faf30957356007de101ccda86bb0a01038f4d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245916, "uuid": "d6477662-2ec3-4e07-be35-3aa96163ba89", "value": "T1A3151264622FDD06C4530BB42DB1E17427749E88E622CA471FD67FCFB93A7681A86303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245916, "uuid": "6788083b-0f16-4cee-90df-a4f5e0f063cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245916, "uuid": "380f80b7-6d8a-4382-b974-dc33ea18df94", "value": "12288:Zqwhbgz3SAqOyW9e/LmB48a7NKfcrh9U5ye3vqdKjf4gKRoVyzv1OQCovnNpiJmp:ZX3AZyW9uu4DYcr3k32owUV0vuinq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245916, "uuid": "aef23429-adf2-438f-a265-7c5b20989186", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245916, "uuid": "67988dc9-b9bc-4067-8eb1-fcea0d1fd252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245916, "uuid": "96e3bebf-49ed-42ee-be21-a20162079658", "value": "a53b0f944d906d684172cdc0e5ecf249b70d541f87e1e477d55f22d24ca7a000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14646fb-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244795, "uuid": "5bc7a7f0-6855-4992-b3ed-8d431be076a2", "comment": "Malware payload", "value": "d2e7e42ad22369140635ec2af9e86ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244795, "uuid": "f441b757-9edf-49de-aea9-4b83f14eefff", "comment": "Malware payload", "value": "a5e7ef1ba1a4e97a841384d1adfa30c389e65dd85f4f00bd888bd2c418259778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244795, "uuid": "62e2465b-6e5c-450e-a914-2d799f4edff3", "comment": "Malware payload", "value": "a9ae837a97ccc0933eff6948637e1294bf37d708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244795, "uuid": "14b57742-c372-436a-9e42-4273c3b1060b", "comment": "Malware payload", "value": "e4b21b0053531c69282ab7228bc467e257af2089d87d68562c419fc0eff0a15b6085a83a431802048f33ea49344a37da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244795, "uuid": "e747f0cd-217d-45d5-a32b-82740b972d24", "value": "T11E0512141269CA06D57A5FF80EB9E0B813B86C9CD835E6179FCABEEFB0763540650327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244795, "uuid": "39f87f54-1639-4f34-90b2-2d1e87e61862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244795, "uuid": "101f053c-1635-4111-9883-d17e67b1648b", "value": "12288:3qwhbg98ORlZDPGyGkdcye6UuAerD52laFlvKtfYWNhw6ZN3ezbUUwctg:3Xa8M5OyPdcyeP60laFZKtrepzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244795, "uuid": "36b22d25-1354-44a4-8d08-7de21cc3e1c8", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244795, "uuid": "273dd45c-ac7a-4010-920c-e8a91362ec5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244795, "uuid": "92c48b8a-4145-48a6-8d11-2dd75af2613e", "value": "a5e7ef1ba1a4e97a841384d1adfa30c389e65dd85f4f00bd888bd2c418259778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35aa3ac9-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233770, "uuid": "e588a2ac-b1d4-42e4-b43f-b5fe15d5e598", "comment": "Malware payload", "value": "69ae845999b8a06417387269d1bf3c31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233770, "uuid": "80f77c9b-c0c8-47f3-accf-722b366f420a", "comment": "Malware payload", "value": "a5ed719f36aa37d2b67db3ea56a7a8c03ba528fe1928f8cd6b33e1c9ae9de2e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233770, "uuid": "dd0d5183-10d0-4c72-a262-303445757b12", "comment": "Malware payload", "value": "ade92beb43235cc65d1c592d061ab2ac55bf22da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233770, "uuid": "4c707270-6f65-4a37-b51b-dbdf7bde4c09", "comment": "Malware payload", "value": "6c1a8ffae90c6e3bf549937aa10921a036bd0dc346a38c28674a3dcef540934b8f890dc8e8ebb781b260d82a4608fa7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233770, "uuid": "37630401-7a14-4f29-bf4b-9857433554d6", "value": "T1A5E633A35B462221C3A7E2F63764197D1377766321B0A6E9B37EF906D84E4013F3CA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233770, "uuid": "b4aaf995-368e-4adf-a0ec-c689a2ec8b5b", "value": "a413ffcb413e398d1f798a0daa527855", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233770, "uuid": "631ed9de-6e67-468c-964a-545624b28d3c", "value": "393216:QPAfQrUN11gUSAoEO3o3Jx/VJWuI4y9b:Q4fQAWUYEO3o3JFVEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233770, "uuid": "98601643-a877-4cd4-8111-0c7249087965", "value": 15027025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233770, "uuid": "ca5c0574-33ea-4886-b50a-73ee870afd3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233770, "uuid": "7ac40e01-b1ee-4adc-8048-05bb5a419c85", "value": "Isass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "654caaed-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246735, "uuid": "189b7805-163e-4a08-bc54-16facf209e2f", "comment": "Malware payload (XWorm)", "value": "c7d679e60c3b15c26740053dff821f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246735, "uuid": "e8e127f7-025c-4042-be09-6ff49bbd3c12", "comment": "Malware payload (XWorm)", "value": "a627ad4b77737b244bfbd8bd1ba428e8f4c7ad9c2a35b3518a6f59cf9479de99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246735, "uuid": "0ddf5bc5-f304-4f17-b3bc-f2a64936c2ee", "comment": "Malware payload (XWorm)", "value": "7edf254cd8a1eba5facc8018d4c1d5298a449ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246735, "uuid": "a2ff9357-bdeb-4512-aec4-d651a1ecf8cb", "comment": "Malware payload (XWorm)", "value": "e2cb4f594acc68866362d7153c507028f60fa6cb38114d735e3ad38ea2a22de9b7830b6bf5fbeed214a60f16a0228bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246735, "uuid": "9a1ac377-0bb6-4f1f-9919-cc45dec15097", "value": "T1C8858C05F3E216BBF6A78730C6954336D671F4C013A9EDEB0255A41CAE3B7D26A36360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246735, "uuid": "3455fd94-53b1-4abf-89f3-0ac675e2185f", "value": "b3fe9ff157cd1279a3c0074c55838402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246735, "uuid": "14dd8b14-393f-4389-98e7-caba5cd7dd2b", "value": "49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3Zzic7LZ:fmIAkJo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246735, "uuid": "f6554110-acdf-477d-8b2f-ebe61b1c0cf7", "value": 1809648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246735, "uuid": "7dd53f88-92dc-4a21-9414-f973b4ae8f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246735, "uuid": "02431bee-9398-40c4-af31-8d5037029e06", "value": "a627ad4b77737b244bfbd8bd1ba428e8f4c7ad9c2a35b3518a6f59cf9479de99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7483e73b-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243324, "uuid": "ebf93dc6-3716-42b8-aef4-e14ff2cb3428", "comment": "Malware payload (Formbook)", "value": "10f4986534c515f599cd1ecb069a104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243324, "uuid": "7fc70363-b989-42ed-8388-4be1770dbcdf", "comment": "Malware payload (Formbook)", "value": "a62a7f478eff9ecbdec36efd57a7fd6e9f1b0732db64965609b9836e13e1e796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243324, "uuid": "4e4cccd8-9f7e-41ba-a602-87d6878ef710", "comment": "Malware payload (Formbook)", "value": "b28b48b5625db61edd08959eade55beba0595ca0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243324, "uuid": "43aac647-2188-4872-a906-2cc9343868b6", "comment": "Malware payload (Formbook)", "value": "ff006f404dc775f7484fd1c375faf09ae49c4bed6435db9d9392a5045ca6535f1e97e5123cf4f2288a647180984d1cd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243324, "uuid": "a4f1a97b-0ada-44de-afe1-4fbe6fb0d493", "value": "T19D45BF0273D1D062FF9B92734B56F6115ABD7A260123EA1F03981D7ABE701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243324, "uuid": "56d6bc14-ec36-48cb-8710-2e03f433d073", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243324, "uuid": "fc1086a6-00ac-4c80-b0c1-defeddb81bb9", "value": "24576:l5EmXFtKaL4/oFe5T9yyXYfP1ijXdaZhTlS7HgmOkMqE:lPVt/LZeJbInQRaZdQ7ekM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243324, "uuid": "455272f0-8ec7-4592-b071-6e0d30eaab1f", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243324, "uuid": "7be4f329-696a-46e2-82be-d3536b0c6115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243324, "uuid": "7d015f3f-e91d-46d3-8bbf-8a28dbc2e1ee", "value": "a62a7f478eff9ecbdec36efd57a7fd6e9f1b0732db64965609b9836e13e1e796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4d5769-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232872, "uuid": "d2d5fe22-d4e1-498b-85b4-784d384163e8", "comment": "Malware payload", "value": "4a5bb3171a72114133e82b43e916959c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232872, "uuid": "d1a4ab3b-04f8-451a-9382-9e55290d9b7b", "comment": "Malware payload", "value": "a77159ac51e32c65c3f1a2b12e0adc42a33263758d9d422fc5226b3b34c52956", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232872, "uuid": "385d9513-19c1-4478-8e2c-3a66d96f4dfe", "comment": "Malware payload", "value": "11d0112b1552f31c968e47b6c825ce7bb137af96", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232872, "uuid": "2505dde3-1f0d-4040-a594-e139228df8f3", "comment": "Malware payload", "value": "8974340aeb54030d4677c3b2fb367ea32feb9d9e530c364e656913ee488f000f62b86150ff7287938c60a4f0af70ddad", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232872, "uuid": "344c2471-271e-460c-9d32-e0470e8f912b", "value": "T1B6F6BD23F9096AA6CED6E135F5E3579532301D480793A229271FF026FDF21CDC666AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232872, "uuid": "f84a6590-4db1-452c-aab0-07111ce18974", "value": "393216:Nie/0e62YG2yrG0T6WNdobnxoGOOMZpXnNSm:N0rLG2y9T6dbnwXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232872, "uuid": "a5bc590d-2f1e-4f6f-9180-42eb03f181c1", "value": 15980101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232872, "uuid": "18ff091e-7dfc-4ecb-8478-866507278d1a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232872, "uuid": "881e361b-88cd-4316-a76e-8c924a6e750d", "value": "IMOBILE LITE (45).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292e6f37-4ac6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778235038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235038, "uuid": "7aca7b80-56ce-4309-be10-24166db4df83", "comment": "Malware payload", "value": "963cfe8482b330d62897c22ecbf442a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235038, "uuid": "c46c066f-5ff1-4c6c-bf9f-0f8d0b3e0b1f", "comment": "Malware payload", "value": "a78188a50f25e9b28f52c297dc4137c81f8da60d1a1422735378f1416a36bc92", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235038, "uuid": "8d1de7ae-86ea-4d8e-b3d5-17c4fedad9bd", "comment": "Malware payload", "value": "be0c18cb63da62106ef4455be9422c63b1c6ea4d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235038, "uuid": "f17c98aa-d46e-4213-9e48-bb280f024b13", "comment": "Malware payload", "value": "08cfb493c1f519d4ead100d886fd87d40e63f893ffab1cd617c73e6eacb7220396dddb0069bd6a1252ac1c17f70d96fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235038, "uuid": "b5aa868e-733d-49f2-9d96-6b736b168816", "value": "T1EDE312D8DF488527DFF5F73E398BB774B7E24B2A40AA3052500D04215E1B6AA294F31B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235038, "uuid": "c6684f2f-44e6-4a88-b17b-40d31d59e6f0", "value": "3072:XU1gB8vO96wlJRkTZuI/9n0sMPHx1N2t5wztSlC56y1eXLpq/Cykx:QvOwyeu69nPI7N2Dwzl5GL9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778235038, "uuid": "1d36140d-b1d6-4faa-b3a8-3e63988ee389", "value": 148970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778235038, "uuid": "7947da9d-35c6-47c2-83c4-0f1de4744240", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235038, "uuid": "4ac7d955-63b8-4251-8e6b-92327202643e", "value": "DeviceSync.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a71f25-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomGate)", "timestamp": 1778236209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236209, "uuid": "40634bc2-53d9-4570-9f9e-32ac48d82423", "comment": "Malware payload (PhantomGate)", "value": "4b0bd9ef4645eb19e94d85edf87f76e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236209, "uuid": "4476ba70-312e-40a9-81e0-b3ff33e87081", "comment": "Malware payload (PhantomGate)", "value": "a7a353f9a9a3214cbe2e481eb2f1ccc7666b0ec30ef3745fc5ba3d464bda4ac6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236209, "uuid": "c60c1c35-da68-4537-b51e-b1f910b3f2f8", "comment": "Malware payload (PhantomGate)", "value": "ddf6bb96fa4e52ad59824c31544406c2da2fcc91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236209, "uuid": "c97f1a16-a973-482b-bc80-d3423aa7cd44", "comment": "Malware payload (PhantomGate)", "value": "67b39d4d1717aa5c5141bf6e7c28853bef1024b1ccce1766d43cb317dc8d2310d3c842b7e9956b6400f1a3e2a630932d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236209, "uuid": "2228ffec-0d68-4e6a-939c-09ab632d6c03", "value": "T16C5312D0B9E34558456C89C88D964C2DCC213EAD0FEE0F39514D1EE9E9FD78285FA8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236209, "uuid": "6e2413ee-aeb5-4d69-a37b-dd1cf1ae6acd", "value": "1536:sG7EHUhgyvXIPfvxHY+zHHE5fYTlBz0cPmGT1NEC0LZF37Wptx/gQEoOm0O+lX7V:sG7EHUhgyvXIPXJY+zHHE5fYTlBz0cPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236209, "uuid": "80a9f2ef-7c01-4a89-9c2a-46b75a9a3b54", "value": 64315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236209, "uuid": "8ee0e0b9-2714-4f5f-a33f-42bcc670530b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236209, "uuid": "0f527e42-7dab-4862-a5c2-89b6ba461f94", "value": "NEW TENDER 362026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec5a731-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243637, "uuid": "263734c9-1f8c-4cf0-8834-2730557e10be", "comment": "Malware payload", "value": "0f9742bbce196c205dee6da11860e403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243637, "uuid": "3333233c-fa45-4a9f-83fa-56a9111d70c7", "comment": "Malware payload", "value": "a80300248d76a5f64cc7f9740ad57aa9d50c81729317e6ee69779559212eb3a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243637, "uuid": "f1b2ade9-0ddd-4ec2-b5a4-927560257471", "comment": "Malware payload", "value": "fb708ba31bae2f79f34b0cb3ec232385333bfa6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243637, "uuid": "3eb4f28f-638e-4d1b-a10c-abed2f48dfd4", "comment": "Malware payload", "value": "312e32c4768dfd7648beac796dd97d0d0f98a7f5dfc087d2981d9709c078904b063839ee7b175898d245dcd524e1eeac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243637, "uuid": "5de3190c-78b2-437a-ad0c-b2849d067f2e", "value": "T1E3E3026BE7F55A41E867023469B653350135A786BA01FF1FE9EFC4D20F36B09239A340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243637, "uuid": "f82cd3a4-0f5f-4d9e-bd40-849bf8711782", "value": "3072:6qhNlI6/0n8yCgWtajnDjmO25PnmxthduuiCn9fo1tl:6iz/0n8yCg22+O29Itntoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243637, "uuid": "84ac4a20-2e72-4385-9b79-5ad74d29a2a3", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243637, "uuid": "cff86eab-7c39-4e01-8fb8-e9e7bd7b6523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243637, "uuid": "80716cb9-cdef-4a32-a96c-ccb6f5637670", "value": "a80300248d76a5f64cc7f9740ad57aa9d50c81729317e6ee69779559212eb3a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66aa3d17-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778245878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245878, "uuid": "0de10fef-f55b-4913-864e-cc72c0a73ea5", "comment": "Malware payload (RemcosRAT)", "value": "d48babad484a7ec561d6a7ab5d3c3f7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245878, "uuid": "809dab7e-78e6-4749-b09e-fbbbd9d5901f", "comment": "Malware payload (RemcosRAT)", "value": "a81d45cc8ed0559b688616b6d2c670d64bb6a5291a1841843f8421b4ddb993e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245878, "uuid": "11a2c599-e741-4c9e-a922-4774b25d72e3", "comment": "Malware payload (RemcosRAT)", "value": "c0d3cdcd781762961b2d8de632584cde2c37c3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245878, "uuid": "df670641-256b-4266-82fb-f2527161b1c3", "comment": "Malware payload (RemcosRAT)", "value": "0c435fa828f5c4479e4eeeea35aac0f4cd53677f447d16d9fcf1093fb32c96f3fc465acf248619aa8225d18ac397e864", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245878, "uuid": "d9903bdf-6403-4805-9b13-f38d36d3ba8d", "value": "T11655235462BCC946D06A4BB80924D93427B8ADEEF925D6078FCD2FEFF079B450666303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245878, "uuid": "0a23fcf4-502a-4f1c-9a17-977164c6a6bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245878, "uuid": "9f9c2c11-0f77-43f9-a470-13754cb7c3bb", "value": "24576:RQothtCD9VzABQByQ9+gcw+q/QYE1jiE+hm6IJoovFMvX:ntC/PByQIg9+q/QZ1jf+hm6IJHv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245878, "uuid": "1dd5e350-7287-4d26-b51f-c0519b4b6ced", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245878, "uuid": "4f8e765e-5844-45ac-a4a9-9d49beae665d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245878, "uuid": "818f8b69-c577-4704-99ab-85bdcd17e3f5", "value": "a81d45cc8ed0559b688616b6d2c670d64bb6a5291a1841843f8421b4ddb993e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc09b213-4aa5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778221164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221164, "uuid": "8c3c4b8e-d913-40bd-991b-8d640c114fa9", "comment": "Malware payload (Mirai)", "value": "53a2c96f340f6c898e1b2d841469622e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221164, "uuid": "8d5d0122-ee3f-4efc-909c-9da8cb854b5a", "comment": "Malware payload (Mirai)", "value": "a89f4e3750d5285d7364bd9325de08f5f41df1fa96841d23fff9cebaae7823c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221164, "uuid": "5b2a77f8-08ca-4440-bd81-8bfd0ffc046d", "comment": "Malware payload (Mirai)", "value": "ece6b94b19c5a130bda22079c374019c65158579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778221164, "uuid": "55d69cbe-d5d7-4040-965c-5cf3aac552e1", "comment": "Malware payload (Mirai)", "value": "723f8dd97ef9d1ea2c2da1c54d746ec3929e86979b000b47ffffe526454866c489fa9be85f2b94e4cf1198551e9a261d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221164, "uuid": "c0ecebc9-7860-419f-990c-6d8d443504d3", "value": "T122148D68FE8E78D2D2C7E37DAD4A0FA2302779749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221164, "uuid": "8c647c83-cfc5-427f-85f5-e1af0f3859e5", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dy8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778221164, "uuid": "770821b3-81be-49a0-a620-dddc9ee84656", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778221164, "uuid": "5711a6cd-fd56-4a29-91a3-7a856fadec17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778221164, "uuid": "aab557d8-d55f-43d7-b293-68ea7c089442", "value": "xnxnxnxnxnxnxnxnaarch64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd17aa8d-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243070, "uuid": "c772a6de-982b-459c-ad00-4e898ce04852", "comment": "Malware payload (AsyncRAT)", "value": "a6cb14d43cfef23ad3d91522a5ca91f8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243070, "uuid": "cbe4b151-01bf-4055-8da8-6b776a804096", "comment": "Malware payload (AsyncRAT)", "value": "a948e5dd9e175501f7d345e44e76d93b45cec7d03df65534e8c87d8f02dfa0b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243070, "uuid": "75242ea8-4f15-42a4-82b0-edab2d0c795b", "comment": "Malware payload (AsyncRAT)", "value": "f5d4f96bbaf3399a3016395f1a11d591db992dfa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243070, "uuid": "b3f60f02-eef7-4ce4-9652-1a2e35eb6c3a", "comment": "Malware payload (AsyncRAT)", "value": "17e1ac27342f9094609937d8d107b6326b095f84308585265965b604c24b785dd90ce6ae16d9918806c277f932215062", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243070, "uuid": "e6a07d53-603f-446b-b064-93dbae177c00", "value": "T1C115F144234AEA02C5C22FB41D70E3B85BB85E996412D3138EFA7EDBF93D7467905392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243070, "uuid": "3fc9dd03-dfbf-4224-9f3d-7c03f4c43c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243070, "uuid": "5e7324a6-55f1-42a5-95df-c9bcf0b549c9", "value": "24576:qSJJSHwvmvTWnnIbTR91iT8ICqOveYXxt7mL8RMh5:qqUweLWmlKOvNXjmgRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243070, "uuid": "75697bba-cc19-4b52-9761-83c545c34b72", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243070, "uuid": "d7cacfde-d69f-4437-af99-6732ae6daf92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243070, "uuid": "4252f5f9-1b56-4496-9513-d4b65176e422", "value": "a948e5dd9e175501f7d345e44e76d93b45cec7d03df65534e8c87d8f02dfa0b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e69ef8-4ad6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778242003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242003, "uuid": "85791926-f0bf-4cbd-b6c3-5e40d29048ae", "comment": "Malware payload (Mirai)", "value": "30e9b44e7e501634f991ddefef35b0d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242003, "uuid": "a9397eb2-2c7e-4536-8654-f74f7393c722", "comment": "Malware payload (Mirai)", "value": "a98a247bef89e0e9a5c4206782f6b1544de23568c07deb3735468ecefb19fde3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242003, "uuid": "726abb8f-7d86-48ee-9a49-2d776d04d786", "comment": "Malware payload (Mirai)", "value": "dd40da0f6b4430d42cc9d0dd568970a44d460f2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242003, "uuid": "b45e0b2a-5fa1-4ab9-9ef3-a0a856be4e88", "comment": "Malware payload (Mirai)", "value": "854e6e852a1efb213b8f0237a5b0318a2e689a8737053ada8965f7d0f84db31ef3703226bef39f2c8b64f62b3cc3c7fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242003, "uuid": "98b32cc1-a3da-49b5-9cdf-4e34f2b3a2c8", "value": "T18DC30649ED416B01D9D635FEFA4F028973530B6CE3FE7202AA245B3523CAA6B0F76505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242003, "uuid": "7356e487-c14a-45df-ad40-e372bcecf30a", "value": "3072:1TRJCRWRGXxgLRrxcb+avtRJTsAueJZsdmnkc2diPh:dRJCYUhgLRFg+av3JTsAuIqmkc2diPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242003, "uuid": "6d093ee5-c4e3-4a6d-84b9-1b6da7f1e3d2", "value": 118580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242003, "uuid": "de3817ae-b56f-43f2-b03b-0519638c114d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242003, "uuid": "e44e9ebc-5f24-4ce7-b5f3-a3ed8042ee0a", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4a3541-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778245619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245619, "uuid": "9669ee27-9778-4dbc-936a-93f9e9014d17", "comment": "Malware payload (AgentTesla)", "value": "116962c68e7e7fd0b12d4cebd6930cd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245619, "uuid": "ddc1fe12-73af-4e44-a405-0029dc52d907", "comment": "Malware payload (AgentTesla)", "value": "a99fa4567648892c79ed2d9b9f3421dfb3ac8c0ca270ee27a49c0d67ca955054", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245619, "uuid": "cb1a02cc-d4c2-4b02-beac-10e171c99c6d", "comment": "Malware payload (AgentTesla)", "value": "d946c9161a66f1010a1fc66c85a4e310792ec3c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245619, "uuid": "5a5f352c-c17c-48e3-b354-28ea856392b9", "comment": "Malware payload (AgentTesla)", "value": "76363fa4528ef53ff222f9cabb90e21dd70a1f63f665475113a5f95a7be9d75ef46dcf7f1b9b70bf51c3de23c1be8917", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245619, "uuid": "9317527f-672f-4dc9-ade1-2ff6457362d0", "value": "T1A765BE12779DC261C37211B3BA66B711AEBB7C2506A0F86B2F943D3CBC70661521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245619, "uuid": "927df735-c521-408f-bb79-6e2e74738a79", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245619, "uuid": "00b0b838-277f-49e4-961a-2509e5ef6e01", "value": "24576:otb20pkaCqT5TBWgNQ7aOspErdtFt5XrPT6A:xVg5tQ7aOGEJtFP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245619, "uuid": "7a900319-8b93-46e0-8a8f-9933f38ec0b1", "value": 1428480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245619, "uuid": "c6b98545-183d-4f9f-8791-c910dbb2f605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245619, "uuid": "5cae8b43-0eba-486b-b19c-14b056599476", "value": "a99fa4567648892c79ed2d9b9f3421dfb3ac8c0ca270ee27a49c0d67ca955054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768cea61-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243757, "uuid": "ca2820a4-fb9d-4342-aaa8-ba2afd53e9d4", "comment": "Malware payload", "value": "4ef015df9c637a92a14192362aee6ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243757, "uuid": "09737a1e-26e3-4153-b78b-a4b8d2d177f0", "comment": "Malware payload", "value": "aa0e13cea8797c89a3604098ea568877c59e7783a98e3eb7ff2f56d0437b774c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243757, "uuid": "ddc7b511-a221-469e-b4cd-8a6969aab767", "comment": "Malware payload", "value": "8844b5320db29859a137da04062318698e611bc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243757, "uuid": "23ecffa5-22f4-4533-9ee2-4852226c15a6", "comment": "Malware payload", "value": "a8b60dda60f820e2a2095b4ac997528b77d22fb47b992a7605f4e0cc05cf9fbf442b510fb847de07bf166de1ce12520a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243757, "uuid": "a6950939-dbcf-4c3f-9ef3-02ed0de45a87", "value": "T1B1E3126FCBA8EB45D9BF877CB43281043235F69109C8995BCEE911FB5B33B465192B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243757, "uuid": "16a321b5-9e4c-4bb4-a982-981eb41c5d16", "value": "3072:WchwpfD8GGwGr3zzrMNGVmz7u6gVrQT5atRgnXdCVTQP/SMS0ic:Wchwd83wGkFO6J5YaUVQP/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243757, "uuid": "a3803092-bccc-4c89-a932-3ef995fba39d", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243757, "uuid": "1372a0e4-50ef-4c9f-a867-4b23e2e1a3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243757, "uuid": "54ae96c3-9b02-415e-a8a4-4fbb169a7411", "value": "aa0e13cea8797c89a3604098ea568877c59e7783a98e3eb7ff2f56d0437b774c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a66931-4ad7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242598, "uuid": "3f56214a-a563-4970-bc0f-ed3651b4dbf7", "comment": "Malware payload", "value": "f06433e0c6b3d3bdebbb12bc3b13e94f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242598, "uuid": "7abbeec1-b463-41ac-91eb-5468b16008e3", "comment": "Malware payload", "value": "aa294ae9e3804b491ac27b12256eec8df0255dbb1f3ea0c67f5e582356b2564d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242598, "uuid": "c470b81b-8309-4e3b-8025-40cea3567b9c", "comment": "Malware payload", "value": "07e8019a28bc925518d63cab3c14a77992d00f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242598, "uuid": "2fcbebd4-67ec-48ca-86b7-280383de638f", "comment": "Malware payload", "value": "745c428a21c33d19b6292230b689f6afc4a327e487f9b12c5be4e13b10279d9b98303458f7972bd12d202e3549e1b94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242598, "uuid": "28341dd9-3d9f-4521-bb0a-ab0b331c9670", "value": "T150433B78D5C4ADC4C75F93B1745AA3C203AB9E077839079C9BDC38660FB32946A29379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242598, "uuid": "2d4907d5-4418-454c-8053-7d4cf2b853cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242598, "uuid": "4f643f35-3072-4891-9c0b-40da7b9b5891", "value": "1536:6kbyCif3KNPDw06jR8bb/yXzfVBH13wDu3Y6Uk9jg+rr6GbOsKpeQiQKW:6kbPk3qLw0AubbaXzfb6Dud7r6GiX8Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242598, "uuid": "7d3702ee-3a52-4c03-a123-501d6242bd21", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242598, "uuid": "d7a83bcf-1b42-4d43-aaa9-14ab3de96453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242598, "uuid": "6583f1bf-c41c-4e6e-9182-8f9d6d30a778", "value": "aa294ae9e3804b491ac27b12256eec8df0255dbb1f3ea0c67f5e582356b2564d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da7cf6d-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778244038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244038, "uuid": "fe792276-9e64-426c-a2b3-4c28d35fe6e3", "comment": "Malware payload (Mirai)", "value": "f95cfe63bcd8fe2d3b66754df9743b29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244038, "uuid": "cf41ec60-e6f5-4e4f-aa79-ca30cb5d639f", "comment": "Malware payload (Mirai)", "value": "aa87cb2d40b4039fd426842b19b47b28ed5403c3a899f8b83d9df01051832094", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244038, "uuid": "9d000c0f-147a-4ab9-855d-5506dbb6c358", "comment": "Malware payload (Mirai)", "value": "03895bcad6ee41089df368e3416467b4882a2215", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244038, "uuid": "bf1db521-ac5a-4125-a308-71d6cfbd5bb3", "comment": "Malware payload (Mirai)", "value": "19a935c9ca68c9b588fc6dcb36eb74a0b7bace5002dd7d96d83ae5cc4b4e194b7e5186123a9c84337dce4e9e8dbd7a94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244038, "uuid": "d7e76268-66dd-45bd-9027-62a6adaa9798", "value": "T1EDF33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244038, "uuid": "0bced3c3-644d-411a-acfc-841c032a4a76", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3ndfau:oFJMZBtqCnFCtE1R1WpvD1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244038, "uuid": "daa58cb6-8b1e-4646-83f8-e26d90b97c0e", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244038, "uuid": "6a31ba5a-1352-4cba-a7a2-cf997817791a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244038, "uuid": "6c75f979-afe6-453e-95cd-2476507e98ac", "value": "xnxnxnxnxnxnxnxnmipsxnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e82fee-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246394, "uuid": "ebe266cb-4539-4d56-9fd7-5310da81578b", "comment": "Malware payload (Formbook)", "value": "ebe0671b46d8fa0ba89a7018ead6a726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246394, "uuid": "89099a6f-bd54-4dfe-8e40-dcd1080ffac9", "comment": "Malware payload (Formbook)", "value": "aad25d1908ba6198f953db6d55b60b185e25268ae4e6e2c1951c4c16397146d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246394, "uuid": "5cac6bad-8d2a-4047-97c4-0ddbfd0a7df4", "comment": "Malware payload (Formbook)", "value": "bdc5029e889029ebd05af3cb601a1608253862d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246394, "uuid": "b7ab9e40-a6cf-411f-abf1-29590035ad4d", "comment": "Malware payload (Formbook)", "value": "e7cafd81d3d3defb4ae801f6cced24157f4baaea38979a1fd3770db388e1d152be3a9405ae1932511adfcaa881523627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246394, "uuid": "9d11328a-cd37-4c7a-aa27-8c450fc16bed", "value": "T1F835BF027391C062FFAB92334F5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246394, "uuid": "ad01e5f0-9bbb-4262-b1f1-f3fc7fd054f1", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246394, "uuid": "b4fc0c3d-386a-4030-8dd2-57964caa6dda", "value": "24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aPOBhr/z5G66y:YTvC/MTQYxsWR7aPOBhr/z5G6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246394, "uuid": "b895185f-0313-4fac-a63f-a5d3c7473132", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246394, "uuid": "d3e01d77-55c5-47ea-904d-d2348328ffe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246394, "uuid": "30a2f520-bdcb-400a-8f8d-1e2c4a7e7cc3", "value": "aad25d1908ba6198f953db6d55b60b185e25268ae4e6e2c1951c4c16397146d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b4c11f-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243675, "uuid": "f1554bb2-f5f9-48b7-86eb-a433acd93ab0", "comment": "Malware payload", "value": "8f4d4474ce98e24530deffddac92046b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243675, "uuid": "af6ea7ab-34f6-437c-abcd-f24207728558", "comment": "Malware payload", "value": "ab67b634bc27ee59af58a6af1ab2739776c3957a75b47e32c4043c3d1d6e90e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243675, "uuid": "b1b0616c-e79e-4518-b00a-b8e770cb62ab", "comment": "Malware payload", "value": "94b615adfbbf78270dbbbce33b1c0614f21e4840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243675, "uuid": "2985b4c6-2eb7-4623-855d-fcaff346313f", "comment": "Malware payload", "value": "7ea798920bbab978d94f400bd9c5d708dadda36b67b00bbfc135a1c73a8f9500836bcf64be83676b9672ca9cb4e6cbca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243675, "uuid": "d6453c38-c84c-4d72-9657-ceb6dff15f69", "value": "T1A455E0298DC61F90C06F0B34D2B5405C53F28E57EEA6E7E76DDC1AF0AB62359E906093", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243675, "uuid": "27dce772-7a35-4bf4-9acf-69c6a5872410", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243675, "uuid": "b7e518fe-a4ca-4991-a210-75302294ff43", "value": "24576:VZDQNidpbjbRF+E80N50uJRHP2iNW9CD8bPITht:VZDKupbjbRF750uJhPhNq8Owt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243675, "uuid": "c03715b6-72ce-4200-9803-ff9ae94fc1ce", "value": 1392128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243675, "uuid": "a33489a9-5684-4777-81f8-34ef267a0469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243675, "uuid": "bd2c6639-2fe1-459d-b9f8-8a30e44e2d9d", "value": "ab67b634bc27ee59af58a6af1ab2739776c3957a75b47e32c4043c3d1d6e90e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4749dc05-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244107, "uuid": "eb6807b1-f252-44a8-9575-11af97fed70f", "comment": "Malware payload", "value": "9a578590e1712900aac509d8ab32441c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244107, "uuid": "bab514fe-bb89-4dcc-b960-cd1da8427919", "comment": "Malware payload", "value": "ab7d5bd897444b4442cd064546bafe5ac5d989ad2d79aafb240e8a8a8b00873c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244107, "uuid": "d4483b95-6d19-4aae-8807-50887421f81f", "comment": "Malware payload", "value": "2890e230b614611ae813209a055634dd902ce681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244107, "uuid": "01715a16-bb72-42ff-8027-3365a5750947", "comment": "Malware payload", "value": "84fabf7da542e87577572b996c7dd26c476ae7a31364496fe0eef56f88e0bdea7d9333c20d6f4697c9c76bda7a59de45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244107, "uuid": "77db805e-7ab3-447b-8051-ca27174abafd", "value": "T131E3126B5BEC856BED8D83B048AB650002F45887FB64C35F5BEB011E0B6776425BD3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244107, "uuid": "92008fc2-ad8b-46cc-9622-0532ae0172bb", "value": "3072:vnMIuR+mbsVeVe6DTS1Yu4bKpskTbf/f9kdLWrYfU:vgR+0QehPS1Y5uHf9kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244107, "uuid": "f69139f7-5a0a-4375-b30d-1805df810661", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244107, "uuid": "0e85290c-ac09-42d3-a33e-ce7fe37f3798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244107, "uuid": "600cd32d-477d-4fd1-8a41-18493214f40c", "value": "ab7d5bd897444b4442cd064546bafe5ac5d989ad2d79aafb240e8a8a8b00873c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe434a1-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236606, "uuid": "34cf5766-3ac6-4172-9c62-304da229ef7c", "comment": "Malware payload", "value": "311c90ea81818d826a4e1be2ca3f892a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236606, "uuid": "dd4ff258-fdcd-44f9-9001-9289957383c4", "comment": "Malware payload", "value": "ab84717626de55a6b484f80c3bc291590f550fc813641c44903c004a4c183328", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236606, "uuid": "caed0d8e-20ee-4f8a-af0d-8a26ea2e09ef", "comment": "Malware payload", "value": "1672fc003ce3bc822eebc1468524f339f9061216", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236606, "uuid": "fdf6c0f8-4fa7-4509-9213-c6c198dce3d9", "comment": "Malware payload", "value": "2d69064b9aa1ae9a9ed279ef1f820c10c20b7cc0ee14062473a8205c4dcd045c6fc7a2713252ca2f7c3dba1dd2131d86", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236606, "uuid": "df21f0f1-460d-4b85-9fd8-b53017332bd8", "value": "T184037F9EC7080ABDF7EC0BC8D0DA295A46F1D11B3C2D114EABB765D3F83A64570356A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236606, "uuid": "58dc4e8d-566c-4a14-b5d8-ffddc45e1597", "value": "768:D2w+IGHeF9N3MIJV0JnKbxBvtqhAuaEyZ4ze/Vs:DlrNtVM4BvaAXRuGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236606, "uuid": "e241a5c7-8ca5-464b-b51c-f47743700b30", "value": 39062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236606, "uuid": "c4dbac16-0c7b-42ea-9ef3-bf465b756f11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236606, "uuid": "4d411482-54a4-4246-96d0-68b0aab5024f", "value": "SPO4_nlkvsag.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f467c9b6-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243109, "uuid": "0c3bd878-77f7-4a5f-adf3-d27139dffa80", "comment": "Malware payload (Formbook)", "value": "9b2da353edb7254721187a510d007e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243109, "uuid": "9da5e8bd-aaa1-48e3-b3d1-5170365e9afb", "comment": "Malware payload (Formbook)", "value": "abff69c0d2985c11e4e92309178f13b8857d44498303dff2c074e772b23c8023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243109, "uuid": "5c3ce31b-f185-4b21-921e-8056de193372", "comment": "Malware payload (Formbook)", "value": "1cddb8887e58910912991bc5da3397750f2220a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243109, "uuid": "403c2c5f-e647-4ba3-bfec-bf6fe34ab38c", "comment": "Malware payload (Formbook)", "value": "00ef693ace9d4ce350779d6456b9d99e617293b871021a51f0a603d9a6ebe2e70b99207bdc09541f8e03c7a7fc93adce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243109, "uuid": "5d07b66c-1d9a-4507-b54d-c8d29e2be56f", "value": "T112450254225AEE02C5926FB41D70D3B487B89D946422D303DEFA7EEBFD393523919283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243109, "uuid": "149ed0f4-a7ea-4e3f-8422-547f1372a9ef", "value": "24576:ISJJSHwu004J2xVfqDrhvJrxMBs3J/3cljYwinGef+IddMa8Jxgz6d:IqUw+EiRqDrhes3OVoGerR0Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243109, "uuid": "ca52704b-5b57-4f8e-8bd0-87b453b477b0", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243109, "uuid": "4b789a70-5cce-411c-9f41-1cf44b94ebe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243109, "uuid": "91e0ec9c-9859-4746-a815-b63095872ebf", "value": "abff69c0d2985c11e4e92309178f13b8857d44498303dff2c074e772b23c8023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9422b05-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778245587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245587, "uuid": "51142a09-548e-45b1-b933-04610e521b4c", "comment": "Malware payload (a310Logger)", "value": "9f188c068496b59e3a99c234948a587a", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245587, "uuid": "47d3a92a-0c8a-428b-8e65-32fe810d64ad", "comment": "Malware payload (a310Logger)", "value": "ac332b767e1aae680747f24594dd3595db71a2db67415dc25f195c4b0fb6250b", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245587, "uuid": "4285c4c7-d76d-4e70-97bc-01edbcf17aba", "comment": "Malware payload (a310Logger)", "value": "a33cf505ccd9ec72d48a943d8070187f5fed9582", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245587, "uuid": "f6ae3a23-1952-4b39-b742-b2a23e55466f", "comment": "Malware payload (a310Logger)", "value": "c786c331ffa49d9dc6a460e93ee023109a12727fcaf5c0a276e7e885e4e3294040f14780d124a07a4749cd191eee965f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245587, "uuid": "a9cf26c1-6261-4ef1-95ff-242e3d90a7f6", "value": "T1ED352218376DCA06C1B25BB418B2D1B423796EEDDA10DA5E4FC97EEF747EA048A05343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245587, "uuid": "aa081207-5db1-4f11-8760-4fff9e392842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245587, "uuid": "864a5116-7def-4bde-ac84-0e676d32b26b", "value": "24576:6L/Mtu7EWBgbUqG5HFP64cbiQaiDcD1ykgy70s2ObwqeS+QHuXK:6L/t7dgbUqal64cbiQ9gD1yD40HO06Hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245587, "uuid": "222cb48e-0e5e-45dc-85bf-b47c4eebcc3a", "value": 1135616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245587, "uuid": "330b23c8-b7bc-45fb-99c0-39bc46d04365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245587, "uuid": "749b9eb2-4e1d-4f47-936c-c1fd1962793d", "value": "ac332b767e1aae680747f24594dd3595db71a2db67415dc25f195c4b0fb6250b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f47cbb1-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778244631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244631, "uuid": "4caa0c7d-cfa7-42df-a1a1-3aaa5275f884", "comment": "Malware payload (GuLoader)", "value": "285912c51c27afef6fd9489a075c0684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244631, "uuid": "fe544aa5-9da6-459e-8775-4f18b2e19452", "comment": "Malware payload (GuLoader)", "value": "accd2edebbbdc5561f77d4452acebf376808771ad59bade59f9d5c3a39804cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244631, "uuid": "36333e11-7bcc-4ab7-93b0-5a2f189c5651", "comment": "Malware payload (GuLoader)", "value": "11954c731b837ed921e9b25c8c20f45f2c2e6c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244631, "uuid": "4ba8de20-fbdf-41f3-942a-abbb0a924bbe", "comment": "Malware payload (GuLoader)", "value": "90f803a6f2cf8acb1508ddeee4fec885f6bc611e652bb7d9ddf382d91c0793cb0f745ad63c74946e9d0a59faafd14b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244631, "uuid": "70cc0b42-a50f-48ba-b404-d5a40443b031", "value": "T171A4122A7660C511DC848136AC2CE4B61F6D9F2EDA7B0FCF1745BE1CBAB72826C0D146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244631, "uuid": "d60321c5-af41-4ae0-8860-d11193527d31", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244631, "uuid": "52309170-7539-4490-8ce4-32bc434e6b74", "value": "12288:AbcVKlgggggggggo1vwYl+6rNLEBSkFn5UlGu0cGlGNTaCmd:AbcVKlgggggggggoRwYlfLlELcGl0Taj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244631, "uuid": "c9cef83c-17e8-431e-b47b-f7b227a76bd8", "value": 456944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244631, "uuid": "28da7dbf-bcf3-491d-9e7e-fd2b752d928d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244631, "uuid": "cdad3b87-5b79-43dc-83ad-994df7a978fc", "value": "accd2edebbbdc5561f77d4452acebf376808771ad59bade59f9d5c3a39804cdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d068a8f-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233380, "uuid": "d58ea1d4-bcd0-43b7-83c3-36dc8a9f157e", "comment": "Malware payload", "value": "22771f79be88b8686ea247ba10f1c13f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233380, "uuid": "680dc7de-2e70-4136-b6c8-a9cf298bba36", "comment": "Malware payload", "value": "ad1d8a9a421583964a04935a6a1d66f8a7c3dc6b81dcb844a3cf5be3f1a7a0dd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233380, "uuid": "28edba60-2358-477a-a6e5-f34f6d2b5f89", "comment": "Malware payload", "value": "9e6e0bb954f4b0b6a71b7085c914c44eed1a8fb9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233380, "uuid": "10656231-e81d-4750-9d3f-4cb16f9d8c5e", "comment": "Malware payload", "value": "fa3fcc96562125b194d3b329e299366f2dbd77aac922e35cd07f235213d48ded5570e0e0f355fcaf9329285c0ec0c346", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233380, "uuid": "843442e6-d999-4af8-9ce0-2ce346d2e410", "value": "T15DF6CD23F60525ABD9D6A234F5E7239132311E5403939279171FF02AFDF25CE8A76AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233380, "uuid": "a484f6b8-aeb5-4c14-bc04-ba1c6d6599d4", "value": "196608:f0gToRiDnb7hr25+WAYtqtLGDb07/GwdmOTkp6DVPBiozkEDW6szqtyNRzVHqF:c2owDb1c+DLG3/X36DVPBidEi6QqtQfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233380, "uuid": "a3889ae1-537c-46b3-ac89-6507a587c464", "value": 16785217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233380, "uuid": "e71914ce-782f-422f-9c61-f7637a330a53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233380, "uuid": "6bcaef88-1dc7-4be5-975a-5396fbac8b58", "value": "FapxChat_Pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e19276a-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778243663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243663, "uuid": "a091baba-2f15-45b0-b1a9-cea782f36e5a", "comment": "Malware payload (a310Logger)", "value": "7002ca51f55ecbab6f27ff577fd78117", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243663, "uuid": "5287c0a7-1a76-4b59-b3c2-b755edc82f4b", "comment": "Malware payload (a310Logger)", "value": "ad2783f419d9b343c61ed8eed550c7dd0c001d67df4b01faa81d90acf24d1e6c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243663, "uuid": "690d1b2e-84a1-47e1-ae7a-981e077c90d9", "comment": "Malware payload (a310Logger)", "value": "4c119fd56d8eb4853c695cd1f0b012bff9666941", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243663, "uuid": "dd1e80b1-eba3-457e-bc47-a9d3901d08f8", "comment": "Malware payload (a310Logger)", "value": "2ffc448336c8915ec2cc7741215bc7c02de1a2e60cd3246db8c8d87c494757958f6f3a4e12a0da4c30b9f10e6e818682", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243663, "uuid": "a13355af-e9a6-4d83-bbd0-14b3c725c76f", "value": "T164845A23EA50A12EF1A3C9F1B9A5A25728263D395A88EC57F3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243663, "uuid": "18039c86-fa5e-49a3-a7f4-39adcfe9d77e", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243663, "uuid": "c21b00d6-afaa-4814-ae91-29a66fdf8645", "value": "6144:38d1/w5KA81IJ8GpF6nuTmOOUWT4zONE4EnvFEsvyF6GCyHxxBT7k:MjYKkJj6GmZUW5Cv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243663, "uuid": "6db54728-fa8d-4d92-a9e7-81af2ba111c7", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243663, "uuid": "cce5c4b4-8963-4c9d-95b6-1d27703b8a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243663, "uuid": "1637f62b-c113-47ce-a05f-c82a897c2d71", "value": "ad2783f419d9b343c61ed8eed550c7dd0c001d67df4b01faa81d90acf24d1e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4dd0e9-4af6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778255821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255821, "uuid": "54bd5a75-b809-4a54-8d6a-c1ef4806216b", "comment": "Malware payload", "value": "365d79c4976c4266e8a928a291ce70bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255821, "uuid": "948c1315-aa03-4a8f-96ad-0906e142d719", "comment": "Malware payload", "value": "adc3207cc73d1e48c6d03eac056962eea8b6b61a68d0c5d7a80364bcddc715d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255821, "uuid": "6d607960-fe03-4fa9-af50-34caabe18202", "comment": "Malware payload", "value": "72d2446b13d7bacf5f244e732d9969fa0e23a648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778255821, "uuid": "de7ec754-e16c-453d-8b4d-4edea8cb92ae", "comment": "Malware payload", "value": "39d03faf9ecba4c3ccbd345367bf5f07289fd3278c9739abe5512bb8773166f6bcd5dfb82c19a5df13af6a00616acc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255821, "uuid": "92abdb62-1910-4b14-858a-3a61a233db70", "value": "T14E846C13FA9495ACE159C079835686B7B537B8CE032069FF13E446302E5AEE26F3C719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255821, "uuid": "104743f5-bfb5-42b5-8f4b-e53493b2b5fd", "value": "9c85867df517363f4f9d371b35212fea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255821, "uuid": "24745343-3e69-49b3-9f87-ccc3168b3b3f", "value": "6144:HOrLJHejv6KbYz1CjtR+H4pxeI3zyVhGrYDVgEEP2f5lD5hTfG8PWPik7T1:HcavkCs4pxe4yVhGrSgEB5pLTe82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778255821, "uuid": "0d506afd-f6d2-4491-adc6-fe99c442150b", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778255821, "uuid": "e7972462-b8bb-4308-bc3b-ba1b8dc0e6aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778255821, "uuid": "7ff868c9-8a9b-4cf1-9379-8e4cb1e9d312", "value": "2026\u5e74\u7b2c2\u5b63\u5ea6\u5185\u804c\u4eba\u5458\u8fdd\u7eaa\u540d\u5355\u4fe1\u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a807c5-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243242, "uuid": "170025fa-e413-4a4f-aa3f-48dc4013e076", "comment": "Malware payload (AgentTesla)", "value": "85a279efa75a6129d4770b7836b9f7c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243242, "uuid": "379a9828-a880-4ef4-a084-00c220f684b2", "comment": "Malware payload (AgentTesla)", "value": "addc3ba270598abeca0bc80477b9a9b0fa0107bacc7535e250fe7996eea96115", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243242, "uuid": "1e85f562-9ce7-4e0b-a288-b63d7723af9a", "comment": "Malware payload (AgentTesla)", "value": "752b661a5bdbc98bd3a63e3b0de147a6b010daef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243242, "uuid": "5e302d61-b36e-4769-8b05-46817fe717a8", "comment": "Malware payload (AgentTesla)", "value": "7f8c3e1f7aef379272ad41b068a7f69680d61de7e048938560620577fe241afefaff8d6bfae5ca8c88e89d683326fe59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243242, "uuid": "611e5fad-5e98-4dbb-ab3b-a27c656f191f", "value": "T127340F027F88EB15E1A93E3782EF6C2453B2B4C71633C60FAF49AB5514516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243242, "uuid": "9bbaec05-ca7f-45cd-88c2-0b2a79ae1c6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243242, "uuid": "bff7d3b2-674f-4d28-9911-f2df3cc02277", "value": "3072:7yniyqayzRc0stgWlZ0eTHo9rG8KaG5jnThDS0ufzz:wiyqay1/sVnsq8KaWTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243242, "uuid": "82cdb259-be07-4823-8110-7739d2843a8b", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243242, "uuid": "2820351f-3664-476d-8989-99b817e3a02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243242, "uuid": "70d2d102-9751-4e35-9a90-0cf9afe1ac7b", "value": "addc3ba270598abeca0bc80477b9a9b0fa0107bacc7535e250fe7996eea96115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e445f9-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265102, "uuid": "30f05c05-1c2f-41f1-827e-c4ebb284fab9", "comment": "Malware payload (Mirai)", "value": "0fe73704818c396a99c786763b9b3741", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265102, "uuid": "97043110-481c-46e7-9241-86f56ffb63d3", "comment": "Malware payload (Mirai)", "value": "adf7dfa8d4cccd9d454818571796948c14c3f916e023246517b52f257a3fc1d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265102, "uuid": "3dd1ba45-c84e-4f31-83dd-afd522461a35", "comment": "Malware payload (Mirai)", "value": "821036bf44f07e0cc6f09fc15c999b38788441f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265102, "uuid": "ba776d1d-63ac-43b6-8cae-7f7569251ecb", "comment": "Malware payload (Mirai)", "value": "8c3dd86f8ecdec84c8e30baf57985757b4febca32726843514134002350f6c9bcf5c1490ea313ebb92c7a72bb489def9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265102, "uuid": "6724e1fa-3b4b-4b6d-9b23-9367a347b987", "value": "T1BCE32A0BB8C1C4FDC4D9C1744BAEB53AD931B09D1238B29B27D8AB365E4DE201F1DA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265102, "uuid": "999cd625-cf1b-447f-a769-8a76d956e199", "value": "3072:8EejiAtFMuqajheAmwGufvmo+UXXjDcMICCjvzpDICTDK:8EejiAtxm6HuupICCjLDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265102, "uuid": "be07b490-38ae-4264-9b99-fdeabe99b148", "value": 147352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265102, "uuid": "7af43cb3-2a80-4f87-8322-b94ff39da51b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265102, "uuid": "273bc27e-a8c7-46d3-a277-af504568bf68", "value": "micro.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72c7a93-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245986, "uuid": "46fb5bbc-1480-47dc-8847-0dc4b567748f", "comment": "Malware payload", "value": "0d94615194b814b339a4ff6624eca249", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245986, "uuid": "55aadc4e-a55a-4bdd-b81c-0945fbf7a930", "comment": "Malware payload", "value": "ae11ce7967e3e3d550c57b57b85877c0229f1e7c702f9523bc984a01265409aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245986, "uuid": "f19c10a6-85a4-4378-a706-65cb93d1cb8d", "comment": "Malware payload", "value": "0daacd64513aeebbccf79d8b750935269cca23db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245986, "uuid": "738804ec-e3af-474d-8d00-2d3ac165c3e8", "comment": "Malware payload", "value": "3dd99b8bbf3d5000e5def3a7ff7ee997680fce78b0852ce9d5394abcb579441db3f13e8c3fefafdb6451fc7ad55c063c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245986, "uuid": "7344a415-da28-4b3f-a1fa-39d81279605c", "value": "T169151210126FE906C053AB7118F1E0B023795F8CEA5BCA43AFD96EEFB57B7594294306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245986, "uuid": "4be978c7-7611-4b3c-8150-698c4e6c3334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245986, "uuid": "ab72eca9-1fd8-4c2e-a575-6c93411a046b", "value": "24576:Q4FXCwlJKKElbpl+6nMIgYEMgdXnGgCNBPP:nSh8TIHZgdX9CXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245986, "uuid": "0644255e-c4d2-4574-81b3-cf29484085cf", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245986, "uuid": "a13db1cf-9523-4877-ac55-16da6f3cbbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245986, "uuid": "f2f48cfb-6c2c-4db9-9ce4-75720588fb30", "value": "ae11ce7967e3e3d550c57b57b85877c0229f1e7c702f9523bc984a01265409aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097ddf1-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246136, "uuid": "21ebdb6d-e515-4766-95c9-3290c2a9120d", "comment": "Malware payload", "value": "398bc506a7edaf9137f3357aa8700bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246136, "uuid": "c0a0e4af-c090-4931-be39-e730f1c65203", "comment": "Malware payload", "value": "ae61dbd899c849f269fa49c15eea47c2edac13fa4791ff04ad6ba15d09261e31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246136, "uuid": "86a09743-02c4-48ee-9a7e-ee80dc3b0404", "comment": "Malware payload", "value": "4c291ba6f946157cafff111152cb008c6c2d30e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246136, "uuid": "55c98bb1-3e57-4c19-a960-36530a385549", "comment": "Malware payload", "value": "3e218873fcbbcf9bfc0d6f9ba58b8651362fce1a1bb51251b61024d85cfbf8a0f72dcd7740eed4b02ebcd23a5cf9d905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246136, "uuid": "996ffae5-d923-45c9-a840-b9586b28555f", "value": "T1CCA2737DC6D5ACC0C7AB12F434AAF6C2029B9B17BD671B6CB9CC14511B10358EBB8689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246136, "uuid": "facda686-c2b7-4fb7-9c8b-ccf6a9e08ed4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246136, "uuid": "f98ea7fd-a9aa-4014-92ea-e19501461f77", "value": "384:nHz57Ngy0RmI94b1PkVSsjT6AeGKXfYrwgyx8/0OAsz0uhPUBCgIaK98tjTjcVoN:Hz57Ngy0RVubFo5Ywrwgyxsz0u2LviW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246136, "uuid": "7be37b2e-a0c1-42a3-af9b-3f59930caa85", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246136, "uuid": "77de6c2a-bd27-4e3f-bfea-5ffe5ef2c472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246136, "uuid": "cabfb101-67bf-457d-91e7-a24428e06ab0", "value": "ae61dbd899c849f269fa49c15eea47c2edac13fa4791ff04ad6ba15d09261e31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73b9349-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778242980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242980, "uuid": "cc491ef8-b39c-4e15-8f0f-71dbf9e2e015", "comment": "Malware payload (PhantomStealer)", "value": "a89e8c17a5f9dcbd4440f8fbd82bd22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242980, "uuid": "dfd3b34b-787f-4a27-97ce-687acc76e380", "comment": "Malware payload (PhantomStealer)", "value": "ae7142c27d6ceff29aa3cd38df77748d22da9c847a5dfd63a76ebd59504167f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242980, "uuid": "aa404c09-62f4-4a88-bc46-ea8eb46a64d5", "comment": "Malware payload (PhantomStealer)", "value": "c5d28cac1827c1334a763b57e7258d005efc8e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242980, "uuid": "2b09f80f-8577-427c-bbda-8f653e85ed13", "comment": "Malware payload (PhantomStealer)", "value": "015f60bfd4b7aac86c4c4fde0514e959eac146e3fd3160790d3a0287b105e540322444f588ea21d747ece59d91721005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242980, "uuid": "7b018c6e-725c-47f0-aa58-37f038027edc", "value": "T1767512842269DD02C1B75FF40931E37547782D89A412D313CFEAADEBBC2A7D5680A6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242980, "uuid": "9096da64-2c7b-4729-82b1-1f694a3ce493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242980, "uuid": "c12f3a45-f2d2-4f4d-8aba-bec921618e26", "value": "24576:t/kpqDUQ2UlFEkuZ734YuOy1FQIPbGRIRPLw2r7Tm3ADYVeW0b721OAS:6ZQ2EMhOjtLw2r7Tm3VeW0P21FS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242980, "uuid": "3c515df8-562d-45ad-bd24-cd2f866eced0", "value": 1641472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242980, "uuid": "a7ffc8e9-1673-4456-a2d8-a73787033ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242980, "uuid": "bd2b7783-94b6-4038-8068-6c5168d3e58a", "value": "ae7142c27d6ceff29aa3cd38df77748d22da9c847a5dfd63a76ebd59504167f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32932860-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243643, "uuid": "b3a6e993-0693-42fc-ae58-3a509d1303d1", "comment": "Malware payload", "value": "02e1bd0d417f219defd0fd40d4144167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243643, "uuid": "650b9500-52bd-4749-9cac-072be9c609b6", "comment": "Malware payload", "value": "af055dc4de56370c62080b01a10b36ce47ab02415bc7c7d768d5e014fb4823ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243643, "uuid": "dc08f965-4f28-4b7a-aa5a-f482fc425ea7", "comment": "Malware payload", "value": "1727e8612a942fe5ddf6c7bb7ba355bc454ba27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243643, "uuid": "ecc1ab87-e16c-486d-a045-3cd7ba33310a", "comment": "Malware payload", "value": "5560035e6f6cbf9a2f74d094c30a21c7826c2a97dbacf9bbafd26746617428047068bd82c30518df5cb3123fe2a3382a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243643, "uuid": "4382f439-d706-4f97-aff7-0f8b490f3823", "value": "T166E3020BE3C8E111F56E87B164FA004D0FF47BA59D05F71EABE9944A8E34390A713AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243643, "uuid": "40ed5524-7a3e-4063-980d-42fb874eb2ac", "value": "3072:0u+LDhmVC08gqLs9vFi/V4kkKVFzmbIhmvVR2YTPW9dK:0pLAVCYqLvDbmbmm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243643, "uuid": "7ef2b6de-af48-49f6-a0df-23f131201aaf", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243643, "uuid": "718baf93-440a-4978-9e01-177b30e2ab8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243643, "uuid": "4c971998-dc66-481d-8b3d-718e965351db", "value": "af055dc4de56370c62080b01a10b36ce47ab02415bc7c7d768d5e014fb4823ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875f59c1-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246362, "uuid": "9b26f32b-4575-45aa-8941-ea9f1173a683", "comment": "Malware payload", "value": "f58e87e6651f15774669a30ccb5cf0fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246362, "uuid": "edd87230-5657-49c4-b356-1c6034391bd0", "comment": "Malware payload", "value": "afa8e0d4a05692ab6275f0952f85976078e47de8f5380a28dc9a2bb1dcdcb2ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246362, "uuid": "27511312-6d85-46bd-81c9-d009f2d5f2a3", "comment": "Malware payload", "value": "1b7182e6e68db63be5c0cc5d6bf5326ff6792e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246362, "uuid": "424b6a14-1059-4331-aae4-539eff72789c", "comment": "Malware payload", "value": "75237375a0aacb698e29ed39f442bee32fbf648a92e3c638d978e6e25388a54f86119422c51b06005052b672ab047ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246362, "uuid": "eba2f716-a554-4bc1-bd11-4864e85da84f", "value": "T16FB2C63DD6D9BCD4C79F22F028AFF7D501AA9B17796A0B1CF8CC01865E20344AB75259", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246362, "uuid": "08f8262b-f0e1-4734-bed9-ef9d37bc4c3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246362, "uuid": "189dd3b3-fa3c-4122-bde9-5211aaafdc0a", "value": "768:Nz57Ngy0RbjmbFS/Z1nuw3pKGb9ubGIv4E4:Qmbc/Z1nuw3pKGb9ubGIv4E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246362, "uuid": "75f2ebe9-fe9c-4ef4-9a87-571ff762cc63", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246362, "uuid": "4c60c811-654c-4f7d-b4b6-7051dba6856d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246362, "uuid": "3be5163a-4541-4697-97ec-f51fcc4e13e9", "value": "afa8e0d4a05692ab6275f0952f85976078e47de8f5380a28dc9a2bb1dcdcb2ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecc04b3-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778246563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246563, "uuid": "910d35ff-a735-462a-8504-12f674a1c62f", "comment": "Malware payload (a310Logger)", "value": "efc40d413101af1e38fa1da01c25a5a9", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246563, "uuid": "6f149dd2-acff-41a6-8300-41bce5709ab0", "comment": "Malware payload (a310Logger)", "value": "b04af17429d5f558e26787858f59b8a1096bd28b97fdeda5e46e30053b95a307", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246563, "uuid": "4e7f0d2c-42c3-42e4-9559-abb7c219afdc", "comment": "Malware payload (a310Logger)", "value": "d6055a5feaec9d3d4cffdd1d2d6fc01024097f1f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246563, "uuid": "aad36974-42a9-40fc-a72b-93a67745d481", "comment": "Malware payload (a310Logger)", "value": "8d82f2d43c280c2719deb27b89a859bdee10bd0fd43c7597eeb68ebb5afd8b60b76405b7037ed4dac06a076ffcadf13f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246563, "uuid": "f1c11cf4-2154-4ad2-8b5b-6290b780c77a", "value": "T1B7A45B13EA50602EF1A3C9B1A8B4A29628263D3967D8EC9BF3405F5935715D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246563, "uuid": "2dd01092-5d64-4522-9243-fed96566aa6c", "value": "65587040564dca9304cea378a2d2e04b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246563, "uuid": "183a7ca6-f956-4a60-8348-bbc6285a5360", "value": "6144:Szw8d1/w5KA81IJ8GpF6nuTmOOUiBUrj1CmbxMe4ouTWMW7Qf/FiRyzTNaPugnSv:wTjYKkJj6GmZUiqrrtuThQRyzTeLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246563, "uuid": "98322272-ab02-4baf-8696-7b252e9dadd4", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246563, "uuid": "554e03f7-a6f3-47e8-b570-78601bf6e598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246563, "uuid": "d7759162-db69-4f78-9d17-82568e7b74af", "value": "b04af17429d5f558e26787858f59b8a1096bd28b97fdeda5e46e30053b95a307", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a86d19-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244472, "uuid": "1123402a-a698-4e6e-9a8a-4b1d6b96e015", "comment": "Malware payload (Formbook)", "value": "7f24548eea69c95523b877b53ed7767d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244472, "uuid": "a2ce521d-f932-4a19-a888-51528f59c431", "comment": "Malware payload (Formbook)", "value": "b09815e57f2df812357bdacd5fed62ca635e392fd9ffc440fb3e2a5cc15eb39b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244472, "uuid": "f496598e-c8d2-4ef4-b4c0-1b4d3e87263c", "comment": "Malware payload (Formbook)", "value": "e75586b3c5df32473403d131bae7b012b1cff034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244472, "uuid": "efbff707-25fc-4968-b09a-477be9886dc7", "comment": "Malware payload (Formbook)", "value": "5663748a4fb5e528d6102df95975be55281f9481edf9d1d71c6599deec61569f54c9d27a666dcf23629bfa42d1c954ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244472, "uuid": "28eb1f03-686a-4d54-b72b-19515e28b90f", "value": "T16C251109A3ACDB11E9BA8BF42A71D17047B63D9DA960C2474FC5BEDFB839B100A45743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244472, "uuid": "4ad1460f-7692-4f9c-8836-04cd792d4306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244472, "uuid": "792e5607-d819-4e77-9471-dac1f5bc9c0a", "value": "24576:uGE8P0sD4UuPMAG/7VIb/GVk7SwnSFGBbvin1U7WX:qYXDdEMsbbmGBbayW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244472, "uuid": "0666c200-df50-4717-b619-ab9abbc0ae22", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244472, "uuid": "646160ed-76b7-4a64-952d-0b3637586195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244472, "uuid": "b89d78cd-ee8d-46e3-b234-da4d1f1a2cab", "value": "b09815e57f2df812357bdacd5fed62ca635e392fd9ffc440fb3e2a5cc15eb39b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2cf912d-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231483, "uuid": "b100b23e-db54-44c4-9ad1-37ce42261c69", "comment": "Malware payload", "value": "0d6b1f962a759bbf068eb3d454258e9a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231483, "uuid": "abc6807a-eae2-4f60-86e1-262a224f18ec", "comment": "Malware payload", "value": "b11f1a152ae645946926bd251e6153ca1c7e15dbb87e379b6238081b6c92143f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231483, "uuid": "61992996-3fb9-4d55-ae02-bcbabaa39761", "comment": "Malware payload", "value": "d2c100665aee42edf09d4a286130e79a616caf84", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231483, "uuid": "ef94c04f-1cd3-4cab-ad35-224ac65cc40a", "comment": "Malware payload", "value": "ad9ab042547a825c279092bb90bda99fe8287d864691f204d2df2b254828e0da956882f03d89a4c0595ca82fa1f4be6d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231483, "uuid": "e8220530-8013-44f1-a6d4-5b15ee03ecc8", "value": "T139E62249F319886BE4F7523B39B2432265135C668B43C28BB921F23C6DB76D09F1DB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231483, "uuid": "aa012299-4335-4fa2-955b-054a4fbddbfa", "value": "393216:oyp9U1NJT6qGW4eFrLuv/DmFsNIZH0CmdI:k1L6qG9eFrLWyFsNE0Cmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231483, "uuid": "bb7e8601-b3f9-4406-a131-be119b6de69f", "value": 14880697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231483, "uuid": "7c3c9182-831b-4c1c-b170-c840b647cc55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231483, "uuid": "efd6d25a-9f60-4465-96a0-35e4fa006e26", "value": "iMobile Lite (37).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bda550-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778244264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244264, "uuid": "40c04250-11a8-4d0b-9e19-a8467ff411a5", "comment": "Malware payload (a310Logger)", "value": "d5c0313909baf19312e29d7177c17afd", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244264, "uuid": "1e42e2da-0efe-46ab-96e2-24218ceaa853", "comment": "Malware payload (a310Logger)", "value": "b13dab7cb80f46cb45091974bb302a7d977c1318bce8dfe56550331ec53ef0b3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244264, "uuid": "a1009ed0-2c30-418f-8890-169b6c7c286e", "comment": "Malware payload (a310Logger)", "value": "e1d6321916100bf0a259984a90d4a755bae11621", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244264, "uuid": "d368ee49-6393-4a0c-88a1-965a54d76e44", "comment": "Malware payload (a310Logger)", "value": "a71c48e30a5dae164701da9d070917ce6e1ad74ce95ac61e98ed0f3f3d7ed323182d4f9b6114b6a5c0707ea83419c24e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244264, "uuid": "3b5c5c4b-801d-47b9-8916-58819d3ef97a", "value": "T1E5944A13EB60A11EF1A389B0B8B5925A68277D351B98EC4BF3409F1A35715D3ACB131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244264, "uuid": "5b60ed8e-79dd-4161-a80b-f8e6cf0a8650", "value": "705ef3db1e2829511a2726d69c1c2b16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244264, "uuid": "ed21cde5-0705-4e7b-9958-26c625944f09", "value": "6144:EX8d1/w5KA81IJ8GpF6nuTmOOUiBUrj1tr2nfkwnvbtA+ttxGqrryPZjRlDU3:3jYKkJj6GmZUiqrzr2frtxrryPZjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244264, "uuid": "024caa57-84af-481e-87cd-0648c40891a4", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244264, "uuid": "784a2235-5826-4bbc-a797-58e89aa4886f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244264, "uuid": "afd03d92-bc91-42a6-8dcb-83ec5075f2b7", "value": "b13dab7cb80f46cb45091974bb302a7d977c1318bce8dfe56550331ec53ef0b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8630d562-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243783, "uuid": "1036c529-6653-49cf-b773-aa96e5b027de", "comment": "Malware payload (Formbook)", "value": "7a6d004872b16a5dd714e34eb83ccb05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243783, "uuid": "302a993e-dd70-4bb4-b1bd-9ce16d773276", "comment": "Malware payload (Formbook)", "value": "b18f050f1f54ff321be76d0dea0d835cbed5d48702ebf51ba1f0f5431c8b1c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243783, "uuid": "d98bc0cc-7d88-420b-a1a1-79beef011b0e", "comment": "Malware payload (Formbook)", "value": "9005d8ea6a775c0c6a3557434b7cf6608dfba3b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243783, "uuid": "80c7e8ee-98af-4dec-8bce-6d70e3e97c91", "comment": "Malware payload (Formbook)", "value": "cd240e59c11d0bfc1c6f26ef6cd3aaa558f850f88d2352cdb348b0ddf294d39eb5b251440b591b21ac488ddb0d51d6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243783, "uuid": "beafca77-fa9b-42f1-9bf3-58211ce41845", "value": "T17A45F141761BDC07C1968BB10CA1D6740BF65E84E422D213CFE63EEBBA39B865AC4753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243783, "uuid": "9870ecc6-3436-43ee-87fb-deaf83e421ba", "value": "24576:jAVucSJJSHwcuxVsp8g8YsBSyjNusqKXXpju6i2qFTwHQfmsjpeZ4o+aX+C:83qUwczpP8Ky8KNu6fHMer+aX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243783, "uuid": "ae3e5d13-606e-45ea-b926-58db35c71cee", "value": 1248768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243783, "uuid": "68cd762b-e7db-4a0a-9c57-b59d1ebac539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243783, "uuid": "02d9504d-8256-4ae6-85ce-033b97e74e1a", "value": "b18f050f1f54ff321be76d0dea0d835cbed5d48702ebf51ba1f0f5431c8b1c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9a658c-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245729, "uuid": "2c0ac3cf-fe70-4b1e-bbf8-655c079bd603", "comment": "Malware payload", "value": "419bb1a58320a260b0ab3f1f5d523434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245729, "uuid": "4da85238-b7fe-4e67-8451-ce576e3347fd", "comment": "Malware payload", "value": "b240bcdc626ec3dd1210e204b7d7737fc57b4d2ae1a95fb89a610c22d017e372", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245729, "uuid": "5bbccb17-a956-49aa-8251-cf9d5764527c", "comment": "Malware payload", "value": "078a4642ac224d9a063210ada241cfc2b02ba10d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245729, "uuid": "185a776b-b4d1-4c29-8b42-d9fec5514f2d", "comment": "Malware payload", "value": "c71b4a5111900275c471b15e5671efedb626206549f46e096b8c39a8386f27a4efdac294d756296bd413edf7cb96fa7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245729, "uuid": "1d9797e7-3799-44b0-9040-691792ee1c38", "value": "T1A1A2837DC5D5EDC0C79B22F074EAF3C102AA9B17BD6B1B6CF8DC10815A50254ABB859C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245729, "uuid": "a41aa73a-cf8c-48a9-8586-b8267a929dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245729, "uuid": "c92c39ed-0618-44cc-9085-94dc3c3cbc1e", "value": "384:fz57Ngy0Rmi74b1PkKSsj7ebuFV/34IiEh2QD7c/MzH+5mQ0RSyHbrqqRZewc0y1:fz57Ngy0RbsbFfHe6VvVDyMoYRSyH3qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245729, "uuid": "5f5ed4be-3bc9-4f13-a1a4-dea3864d76de", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245729, "uuid": "1f253348-c573-42ef-82aa-f97ba2433dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245729, "uuid": "9dec678c-2d98-41b6-ae9d-9668c460bc6a", "value": "b240bcdc626ec3dd1210e204b7d7737fc57b4d2ae1a95fb89a610c22d017e372", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8eee36-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246482, "uuid": "d0f97692-db64-44fd-9cc2-1988c5f99207", "comment": "Malware payload (Formbook)", "value": "eae432a44fd4f3a633f8fa3fe527e4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246482, "uuid": "a6beec2c-7aa1-4058-a086-747958510b10", "comment": "Malware payload (Formbook)", "value": "b28e7ee3053e894417d6f851cfd9fb84e9fb5f0274401e6c9f28481c3745a8af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246482, "uuid": "521d7231-4728-4f04-bc4c-ba8d6c546f97", "comment": "Malware payload (Formbook)", "value": "5fd2cff3008a9a9830ef422979d8a5bccf51c869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246482, "uuid": "9b2d45d3-a0d1-4512-900c-397364ab0d76", "comment": "Malware payload (Formbook)", "value": "75b8506ec46997f67def6ae431cd0bb56e4985f36e4f245b0f77a9294487cde9e17af13203c0d80b9952c3fe1cfeda8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246482, "uuid": "8490b15c-762f-4680-a4d1-5e119e4acff1", "value": "T114451204326CDE02E96B57F84CA2D0700BB66CADE921E3069FD27EEF3476B154A59707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246482, "uuid": "8c817af8-4db3-4a8c-9076-d6144698ab65", "value": "24576:IbrtNNhnaz9g62vTq4bEOG3gY5CgrON/y7mvMGFsw3t1X:IbTnaS6OT7bs3gYPrON/tMGZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246482, "uuid": "0679b68a-e6e3-4479-8516-7d6342845b20", "value": 1176576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246482, "uuid": "9104e0dc-36d5-4f79-bbca-e56fe0fc5632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246482, "uuid": "d8e204fd-e0a0-48e7-8551-ac0475f155a1", "value": "b28e7ee3053e894417d6f851cfd9fb84e9fb5f0274401e6c9f28481c3745a8af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0916bf4-4ac2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233547, "uuid": "57f28bbd-db0f-46a2-aa11-87a19d19aa48", "comment": "Malware payload", "value": "a3b57e4e54d178fea8f9a5f45a44ed0f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233547, "uuid": "f76508d1-5a9b-46b0-9c42-881bef3c4b41", "comment": "Malware payload", "value": "b2bfa29467c1979c044259d4ffe31fc32aa6ef33939779bd3b1ce6bedb44dea9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233547, "uuid": "c4b83241-0e86-4a6a-8fa4-12475d918b57", "comment": "Malware payload", "value": "390cf3bac67144c75f16065c2f74b864e745dc46", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233547, "uuid": "800e1cfc-3800-4506-9dd7-6083dbb31b38", "comment": "Malware payload", "value": "9cd27ac6e627664c0813b7669860b57ff201a0e582e6e70164b12a6d8e3b378fa42b622b2c0d3617c48aa339b3d3a265", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233547, "uuid": "4ffb4cd7-1b90-4c06-90b6-19f8a3a22f8f", "value": "T10C07CE23F51969A6CED6A131F5E7079132341D580793A229271FF026FEF21CDCA66EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233547, "uuid": "71a4ac47-f85c-4c6e-b102-d3d0215d3600", "value": "196608:Ai91h/01vkI1Eua64B+vFFD6PMDgd99VCR6l8tPxQ9nO83uws+9jBlV:B91FgdNegnDVDgVVCslaxsOOuDCjBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233547, "uuid": "90f6d1fe-ec12-4665-b805-3529ac95ac9b", "value": 18241100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233547, "uuid": "b31d3f15-157b-4bef-97e4-acb69d0bf283", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233547, "uuid": "7c3a1d40-2853-49df-9aa4-cd6fa191950f", "value": "IndeMobile (3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d126efe6-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778243480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243480, "uuid": "ee32d22c-c3a3-4299-ac10-67894cc81d7a", "comment": "Malware payload (a310Logger)", "value": "2d39b904d89e0477beb5720532cd3967", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243480, "uuid": "49b98b08-3637-4fc8-80d4-1bc352631d99", "comment": "Malware payload (a310Logger)", "value": "b2c9b5de6a79386e73dacb6ff090015089c75fc8eeb3152b9395afadaf54c891", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243480, "uuid": "54c02123-774f-4930-8ff4-953c73ec8b22", "comment": "Malware payload (a310Logger)", "value": "50ec71f864c4855c1a651db26f7c01bd8ef53b26", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243480, "uuid": "979fed1e-72dd-4032-b86e-c5d682df0e86", "comment": "Malware payload (a310Logger)", "value": "2ad0ef86dd194d06ae4aa8517c2d9bb1ea304f7a7dd4dd3428cf0bc052d8e40c0acc11ec82fabab7bdfcfb4193cecd38", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243480, "uuid": "9cd484cc-f332-49e9-bf01-1dde55f9ed43", "value": "T160845A23EA50A12EF1A3C9F1B9A5A25728263D395A88EC57F3415F5834711E3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243480, "uuid": "75e1cee2-9fa7-4795-9973-8f32483209f6", "value": "252c027bda7298291893ceb108f11214", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243480, "uuid": "bbb27994-f914-4b0f-be2b-ea941676ad00", "value": "6144:a8d1/w5KA81IJ8GpF6nuTmOOUWT6Q4NE4EnvFEsvyF6GCyHxxBT7k:JjYKkJj6GmZUW4Cv0nCyHxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243480, "uuid": "48b36948-9c7a-4dd7-b36a-ec414f4b7c47", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243480, "uuid": "68c9d6e4-53a3-4a11-b7a2-5138361f41f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243480, "uuid": "600cad43-e31c-4c4f-9298-a2352e171cf9", "value": "b2c9b5de6a79386e73dacb6ff090015089c75fc8eeb3152b9395afadaf54c891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0934d59-4acd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778238325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238325, "uuid": "174b0793-29a7-419b-88c3-08f19b36c5de", "comment": "Malware payload (RemusStealer)", "value": "3789f91f8c00ff93eb935aa0ae1c4a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238325, "uuid": "40eb9bff-01fb-47ee-a0c1-c831636fa2a3", "comment": "Malware payload (RemusStealer)", "value": "b309fc0c20c6b0a61e561ab073485dc7163d9380fda0691f23d5da9f8fdcf683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238325, "uuid": "22993a44-85eb-4fae-9b3c-8bda21059678", "comment": "Malware payload (RemusStealer)", "value": "3e5f85d243680423e0d5287c25f8c2cbeaed44fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238325, "uuid": "1fa5ff30-1f72-4c86-b896-a03ff8ba5c58", "comment": "Malware payload (RemusStealer)", "value": "0bfc44cef2dfd72327b2e10d4a089de3c31d6fe175b8e696cc9883d6d79a73a20b7cd81ce0a36f04329e2a39cc9c5054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238325, "uuid": "c64ded32-deab-4624-82ed-1be51fc7e172", "value": "T157A56C077D9148BEC09A73325CF622A1773DB848073663D32F616A7A3E76BD0597A309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238325, "uuid": "40293c7a-adda-4a5f-8501-962059a5e352", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238325, "uuid": "913d0eee-58c7-423a-bb3c-29ff27081716", "value": "24576:Wu7i8/Foe+pJzY7/FZid46S618gBiOD9glDvCqm9LFheletn92nOmFusb:WuGKolJzY7d8N8gBiOD9glD6zEmsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238325, "uuid": "e2bd0682-1393-45dc-b886-0ef4ba435bb2", "value": 2216752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238325, "uuid": "24b64772-b831-4daa-aebc-75697f2715da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238325, "uuid": "6910c862-0cbb-401b-b68d-ef356853313c", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ae95dc-4aab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778223668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223668, "uuid": "cd706f5c-8be8-4197-9394-31023a769d33", "comment": "Malware payload", "value": "d77012aae7fd8d218252849d448a7510", "object_relation": "md5", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223668, "uuid": "0cb67a60-c5fd-475a-a142-030f418336f9", "comment": "Malware payload", "value": "b392341db466c7ccac5a414f282ff9cee3719252cf80f1229658ff094f40edc8", "object_relation": "sha256", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223668, "uuid": "f87b24ab-e714-4b49-b1f9-c433eef02b61", "comment": "Malware payload", "value": "7fc90af70103f82d4872dfb0051e50288bccf6a3", "object_relation": "sha1", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778223668, "uuid": "1f95512f-bf28-4309-9b39-550cabc3daf2", "comment": "Malware payload", "value": "f91ee3b8475b573a1faa1d68c27c92938644920dde57fd349748a957c500ec9129fb949804584b0fdcfb1ae32f390812", "object_relation": "sha3-384", "Tag": [ { "name": "303031000000", "colour": "#9803FB", "exportable": true, "hide_tag": false }, { "name": "dropped-by-smokeloader", "colour": "#3EC35B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223668, "uuid": "80a902aa-7c60-497b-af77-d7f2123cbc03", "value": "T1A5B35A2B63E530F8E477823986914A46E772B8351761AFEF43A446561F236E08D3EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223668, "uuid": "d4319aaf-8bc1-4f7c-8c62-453e2f0f8787", "value": "1b6b5a4a6efcf2a5c5aa28265509ca77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223668, "uuid": "604b8c69-d6ed-4745-8f88-d49ab17788e1", "value": "3072:pPbn980OvKScAGyd24V1KKy8B287mIecJep:pz9QvKoDrKK/9mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778223668, "uuid": "e80b8b1d-8bcd-44c0-b891-119265cc09a0", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778223668, "uuid": "17de3e54-637a-4cc5-bac8-49372b66cd60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778223668, "uuid": "661c9358-09c6-4de8-8fd6-20cc96744098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f4252b-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778246258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246258, "uuid": "a8a3cb09-b59a-4596-b958-e0ec9f5d8dba", "comment": "Malware payload (AgentTesla)", "value": "50acfe04895576bffcb090a21818f4f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246258, "uuid": "a270459b-0cf7-4773-b289-6bb9bfcbfd8b", "comment": "Malware payload (AgentTesla)", "value": "b3ab0dcd5aa22ccb60566b1a39c51db804cd9f8c9af762facbdc08bb41a7b0cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246258, "uuid": "43e32931-24ed-474b-9bd4-7bc4e247bfb7", "comment": "Malware payload (AgentTesla)", "value": "1c7fee115add47cfcbf0b52cc4dadaab49822cd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246258, "uuid": "d19cb8cb-f26a-4671-8d5c-dff26f74adaa", "comment": "Malware payload (AgentTesla)", "value": "c5561df2af9f35b288d38b30e1f9fc86b71873c3a694f97e67cfc10a5fa255ab287cf2c97ad6bd858234bb00e0d901b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246258, "uuid": "7ecbfaca-f490-4dd9-827a-22d2fb753139", "value": "T19505E0316E821614D67E1F79C05231296BB8CD476286E71FAEEE31B50E727C6CB0F891", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246258, "uuid": "43f56081-86f8-4a10-b277-bd4fc45be0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246258, "uuid": "78928d1e-27d4-4dab-9362-c7b2072c6c84", "value": "12288:fAUzInAUz9QNHiUpp85QQzvVgpk8IAoG6ILHrZfI:fD+9epkQSEk8IAoG6I/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246258, "uuid": "0641a851-56f0-4696-9dc1-f1c553fd641e", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246258, "uuid": "a1fa4491-9bbc-4319-a5e6-365448885eae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246258, "uuid": "dda4797e-862b-4330-8da7-8383dfa61554", "value": "b3ab0dcd5aa22ccb60566b1a39c51db804cd9f8c9af762facbdc08bb41a7b0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bff5b2-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242848, "uuid": "5cc5a724-d69d-4c91-ba90-80d0ac25374c", "comment": "Malware payload (GuLoader)", "value": "05cbbfc932ca1129230508d8bc97aa7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242848, "uuid": "e66bee55-bb66-4b85-9457-26093f35bbeb", "comment": "Malware payload (GuLoader)", "value": "b405b7e4ae3b2a86014ff68fcdf33bb3f428179d919398bf620eccd31f5500c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242848, "uuid": "5be1c203-9a37-4b7d-8cfa-766ea3e11046", "comment": "Malware payload (GuLoader)", "value": "6207289b85c1445693348e04d317ab2d60502add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242848, "uuid": "8156da5c-a1db-4fe7-a60b-8d4812477213", "comment": "Malware payload (GuLoader)", "value": "f7dbca8ad7c82e213151ed48e1212cc14900013cacac298aa4e1d68535433811b52227b545fc7163465cb031083855df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242848, "uuid": "37cdc9f7-77de-448b-a557-d0b94e679230", "value": "T1195412217300CE63E9A84A72887397BF8FBDC52429209E575750FB2EBD72372D61E605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242848, "uuid": "81d82f86-e2ab-409c-980c-ed4eef0afaf9", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242848, "uuid": "b8c6a9b1-3233-448b-b60c-26d1bd46269d", "value": "6144:HlHXel6AWB0UjaknErEtVtzHG61MySk2yb9ZK7gRSa+0uUNUk:QlTkayw0BHG6FSY9ZdYUNUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242848, "uuid": "9a2560cc-8ee7-4615-8b39-6bf7f1ac3557", "value": 296736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242848, "uuid": "ff844163-9584-41c2-8e08-2a1132945784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242848, "uuid": "36cff7a5-89ae-40a5-9b4b-79bb6d61a044", "value": "b405b7e4ae3b2a86014ff68fcdf33bb3f428179d919398bf620eccd31f5500c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6ce0f1-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244515, "uuid": "8366021f-dea9-452e-8ace-4742a9f8a37c", "comment": "Malware payload (Formbook)", "value": "c3b12a83c2b415155a965d827ffbaba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244515, "uuid": "5462a0d8-9e5e-48af-953f-1e6f96bf4cdb", "comment": "Malware payload (Formbook)", "value": "b42e1a36265a4757b700ac71ada3f1c6ea77eb7256574ec31217fd8ba240628b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244515, "uuid": "f3a14443-98e8-48b1-b826-f04de29904b3", "comment": "Malware payload (Formbook)", "value": "d664ae9d274f6b8b4b829fbdb29c2fc48e445fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244515, "uuid": "47fdc74d-4a83-4fd1-b838-273b70326f13", "comment": "Malware payload (Formbook)", "value": "2f583e737fda4f925080e6556ee94ccc595753e8167856d443817018f698cd4e9e1382b9c3bf6290ab727c7aa531243d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244515, "uuid": "ff611273-b021-4895-a202-c1e83172ce5e", "value": "T1B445E0431658CB02E4364BF52D23D8B017BA2E4EB811F2AE1DC26EDF7D75F24098965B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244515, "uuid": "85ec7cc8-54b5-4f48-a9f5-43b331893fda", "value": "24576:bAAcyj08UXKcSBVJZynHC7ZrvNA+U0ZHxYUHkI4RGVmbdE3X:7j08UacSYHCtry+152R7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244515, "uuid": "05600048-2864-4428-936e-ff29dcf8b44c", "value": 1223168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244515, "uuid": "da11e251-4959-49a7-b0a6-c61c50666f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244515, "uuid": "00f85557-6102-49ea-a500-33f7365fb62d", "value": "b42e1a36265a4757b700ac71ada3f1c6ea77eb7256574ec31217fd8ba240628b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8a0fb7-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246074, "uuid": "456acce9-cabe-466a-948e-56a68989cab4", "comment": "Malware payload (Formbook)", "value": "eaee57ce6eb8a32b1851a5eefc5df546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246074, "uuid": "e25fa083-5f2a-4d88-aff4-837baf444d79", "comment": "Malware payload (Formbook)", "value": "b4a88d755d4ac88a380582ed5331b90b9c84872e6b6d04f773ffc08b4dbcf7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246074, "uuid": "79de38e5-1e69-4d20-8c1e-ce052696107c", "comment": "Malware payload (Formbook)", "value": "f72ca563fdd6ed3893e77ca43a91658da7e268b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246074, "uuid": "ab7ddae5-28c4-49ab-bcae-c9140615085d", "comment": "Malware payload (Formbook)", "value": "a9a4f8f1eac0e965dd7075e30149d86d5ceda38fa745fc7730d8b15169eb9542b1a94de6522a3dd675827cdfd7497010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246074, "uuid": "0a70da93-6163-4b7d-b9b0-fe72963ff6ed", "value": "T11354238A89C236B5FD740BB3298ADCD8364A713A834770133E511E7F5772AC86412F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246074, "uuid": "e7d4e659-5689-4621-a831-e8d785a8e030", "value": "6144:h9NxVB0Y+UvrjOs6cGsSrN7ONDoUG8KX+sWEEDK66vNyCnkrv5nq6X9ttts78XHR:LNxgY+2Pp07z98dsju6Rkrv5nqe9tttc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246074, "uuid": "1e383078-b910-44f2-9137-591c950c51eb", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246074, "uuid": "eb648a8e-d1d4-4d5f-b161-381022f81c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246074, "uuid": "a7d563dc-75de-4363-a0ad-0df52f0137d3", "value": "b4a88d755d4ac88a380582ed5331b90b9c84872e6b6d04f773ffc08b4dbcf7c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef2111f-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244416, "uuid": "ab3214ff-cff4-4d67-a38d-873f76824fc4", "comment": "Malware payload", "value": "2f9bf24e2712c79e71b8c0e3e597b0fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244416, "uuid": "ce85d2dd-0bd2-4e40-947c-84a7524753f5", "comment": "Malware payload", "value": "b5611d7aba6fae579dcd7d6e66717597f30053092467f47cc12d879a8ea40c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244416, "uuid": "5610ac0d-1874-42c1-bc21-e435db799084", "comment": "Malware payload", "value": "65847635b03316c66c9438da973bc67e1864d88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244416, "uuid": "c33d0bd0-7583-44c4-a43f-bb82137bf9db", "comment": "Malware payload", "value": "6c2912ff890eab21a27d9266af589fad5349dfb090e79b1af3466dafeb20a4e50fe6d313fbf0b76fad73e460a9a73812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244416, "uuid": "bcf6065c-8264-477d-a2c1-576ba8946e51", "value": "T1AD67334D23462A48CD5139305F9EB4A686067DB305437A3D1F07EAD2C7BCCEAA6E8537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244416, "uuid": "7e0b4ff5-736f-4721-9fd8-d8420b311832", "value": "d8b25d9f6e4502eb253a30096c76cb14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244416, "uuid": "3a07d854-6a1f-435d-b1eb-e008ac95bd1f", "value": "786432:sr+dqyftxKMRe+I841B/cPfIT9wX+UNnT:s6dqyftb41BUfzZnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244416, "uuid": "4e316bd2-29a8-4311-b522-fb0d11971994", "value": 30807314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244416, "uuid": "9e6ea8e8-2e8e-4b58-aa96-01d7c4fed030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244416, "uuid": "30f7bf80-629e-466d-8407-630a08cee5b6", "value": "b5611d7aba6fae579dcd7d6e66717597f30053092467f47cc12d879a8ea40c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eae2d8-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778232999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232999, "uuid": "ef22523a-73c9-4561-9c36-85df1b166dc4", "comment": "Malware payload", "value": "d268df2b38c937c71c1bba334f4d4a39", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232999, "uuid": "932464fd-18d1-40d5-b9bc-cb6354262e55", "comment": "Malware payload", "value": "b56b156ca98d8bd582b2d9ed36845a5b86c7eb5d845f15948c60dcc22a715497", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232999, "uuid": "7157784e-53c4-4f25-a434-cb3744380866", "comment": "Malware payload", "value": "7133827ed2d07cb2e959080585597e3c001af1dc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232999, "uuid": "0a1f88bf-0868-4ab3-b499-b632a616b346", "comment": "Malware payload", "value": "626e9d263a5a84cc27c55e765b072b294f07ee0db592a51f6810b8a4b4d62f57175cdb82894fcec26d508814499efc7f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "indusind", "colour": "#495C30", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232999, "uuid": "3fe81bbb-1044-4acf-b279-e66e1d487ab4", "value": "T11A07CE23F50569A6CED6A135F5E3079532341E480793A22D671FF026FDF21CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232999, "uuid": "f2c1ebec-63db-4f42-9b32-a5b71c92656d", "value": "393216:1VOOJkNDh7n+2pIjyO/UkWWup42K6nSHkUJXbExfYv45JQ:vJkNDh7n+2+j7/UkjuK/iSEUb7yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232999, "uuid": "96e4b4b8-8d68-4990-bdf5-80c3124b22bf", "value": 18265668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232999, "uuid": "f694ecbf-486e-48e5-8c74-0303a55fe3c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232999, "uuid": "5881666b-def0-4f26-9519-187903a3b02e", "value": "IndeMobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a241853-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778245911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245911, "uuid": "1d0a8ba7-9a76-4c91-92a1-02868b498925", "comment": "Malware payload (Mirai)", "value": "b058e02e29458e7b5222f867371953e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245911, "uuid": "aa4db948-1f55-4181-98a9-157d203dfb76", "comment": "Malware payload (Mirai)", "value": "b597225594559aa12bbcca3a425fc8e1346bda36789e37932175cd463ec260aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245911, "uuid": "7e683c27-4d7f-493f-8efd-6341cd0969d5", "comment": "Malware payload (Mirai)", "value": "d8f15e5e5a093791ef76cf75a7158c251d7c7710", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245911, "uuid": "cb3d4da7-1d4a-4213-aba3-78e0b6f7e1b6", "comment": "Malware payload (Mirai)", "value": "9b5dc5aeb6baa4e24fafc0d74622f688485acb16ace28b525492ef8d0d2e086776987ed7f3f503fb90c07c1ae8366a53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245911, "uuid": "a7c0b154-767a-4b30-a553-d99ef931418d", "value": "T1A504A81A6E228F6EF67CC73047F74A35976D23DA27E1D684D2ACC1142F2025E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245911, "uuid": "055ce4a1-e03b-4d37-a179-c198c8124bb0", "value": "3072:X8hdP+108idLXajPBRMgVzc2Dvfo/i+h47dDE7:X8hqaDarnpcuX8Xh4pDE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245911, "uuid": "3e06b837-d26a-4787-92e9-7ebd93b048d6", "value": 174552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245911, "uuid": "848cd758-1fe0-4df3-94c2-0ae6e1d4d07d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245911, "uuid": "e96c43a0-39f8-492d-89c4-672077a53752", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24ff0c4-4ace-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778238730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238730, "uuid": "2d754346-7e67-4143-97ed-0c23bf9fa36a", "comment": "Malware payload (Mirai)", "value": "ae51811c552766da5de819b5ba2812e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238730, "uuid": "fd2e6c4d-d007-455a-b1de-1bc710c6e7c0", "comment": "Malware payload (Mirai)", "value": "b5aa94a07ff2b7947cb8a29dd6168dc248460870857dd683ed7461f9c7c1af63", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238730, "uuid": "2358beac-288b-4428-946e-e5408f0de5f8", "comment": "Malware payload (Mirai)", "value": "67170fc50d3e0fdc8f489e370ee57647fd4afdc1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778238730, "uuid": "86794e57-1191-415d-b60c-b63f2fa6d41c", "comment": "Malware payload (Mirai)", "value": "2f2fc074aea0026ef146b86da0988b3b4d9c26db09437469b140eb5f1dc64e32dae43b323893512dcc71d1ab0cef177b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238730, "uuid": "176b8fcf-b384-4269-a605-95b4840b9759", "value": "T1AA14C80A3E228FEFF16D877147F34A31976966D627E29684E26CD5101F103CD681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238730, "uuid": "3501a99f-e95f-41e3-a5b3-6d47d6db5681", "value": "6144:bgyELyGsBkB/7KUZXfTXp06GtCqjYW8nY1j20WI:NEL9oUZvjp06GtCqjYW8nY1j20WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778238730, "uuid": "94aca8ad-9084-41ac-af93-1f600bb9ce16", "value": 202077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778238730, "uuid": "9283726d-7b66-4e84-880e-77ee25a14957", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778238730, "uuid": "8cb8d0a3-7d73-4d2e-9d4c-6568d5bff97b", "value": "iran.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891bb384-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778242929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242929, "uuid": "eeccc05b-e226-44d9-b676-e0833ded717f", "comment": "Malware payload (AsyncRAT)", "value": "a15be8e92227471bf72c5efd60c62993", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242929, "uuid": "896d5c30-2fdb-4ac6-81b3-6430b7831396", "comment": "Malware payload (AsyncRAT)", "value": "b5c58d3f6320024a5b8e0bfd635dc1b1ca987e275446b470271b5893fc6bae91", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242929, "uuid": "5370696b-7437-495c-992b-22665b5c0e29", "comment": "Malware payload (AsyncRAT)", "value": "a119e572d31946c6b0a0fcbb31eb0eccff90af4f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242929, "uuid": "d5d38e8a-c82e-4094-855c-b1d1c739de8b", "comment": "Malware payload (AsyncRAT)", "value": "5bc8646866ccca4f8555bbb8701edd5f4aeb8d4c4e1ed45301b80c435b1510eedb6dfa7a8f7585a58a05e1b912fbe3b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242929, "uuid": "508a7d8d-75f5-490f-894d-789c3095f7ed", "value": "T186F25C0837D54229DAFE7FF95AB366031770E5078A03DB4D0DD88A9E6B27BC589007E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242929, "uuid": "ac84f909-c02c-45af-ac48-c9bb4108d3a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242929, "uuid": "a1324cee-c9a5-42fc-8423-f718a1ae0bbb", "value": "768:c6KkDnV2jZgWSVOo+M1TnLV/Fn9S6M6TOMhh3O:cfb8BltnLxFn9S6M6TOM7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242929, "uuid": "1e18a6c6-9cf9-4e8f-a5d8-99912f5bbc87", "value": 37376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242929, "uuid": "d326f8c2-b15e-419c-8e39-88b7f4066d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242929, "uuid": "1f9f165e-1b1d-49c0-98e9-9c9fafbd238d", "value": "b5c58d3f6320024a5b8e0bfd635dc1b1ca987e275446b470271b5893fc6bae91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ee358f-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778245904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245904, "uuid": "a1e18017-de61-4849-88ec-2150cb518376", "comment": "Malware payload (XWorm)", "value": "420d11e2527da48927ab5cdebd5480db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245904, "uuid": "465ab166-49b7-433b-81be-b6308b3fc795", "comment": "Malware payload (XWorm)", "value": "b5de998bef87cfaf1392cd8157e266111e9e4315527a670680e8158149e72088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245904, "uuid": "0a9aeae5-9022-4013-a2b7-10ed20cf6da8", "comment": "Malware payload (XWorm)", "value": "0d2689e3eb43c41c1a339d2aa7ed0d0a23f419f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245904, "uuid": "859fd707-af8d-4f91-8d70-151f83ac065c", "comment": "Malware payload (XWorm)", "value": "278d438b32650f94183d708a1fad0ab962b1647401377c9263ce4f561a8c19cf054b8699f378a39e34162363083712d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245904, "uuid": "9190f2ec-c52a-41d2-b3b5-09efe6eb2273", "value": "T1DC15026D77A58F01D59C18B0C8E7493403F2BE8AB273DB843D4815DA2D513A8DEDABC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245904, "uuid": "0ccc4dae-8c2a-462f-ba1c-3c71c1712452", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245904, "uuid": "15bb45a3-366b-4cbc-914b-c4aa2551315f", "value": "12288:jXORhmqnvIG5jm7sPc2ieavCL5WEe2fBlPSNpPpSVs24HL6xPA4r/6ORx3jUbpyk:cQse6UEe2fbupS4r85wycp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245904, "uuid": "4f079794-2c3c-46a4-8d51-bbebf34f4412", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245904, "uuid": "4af9e6b0-9e3b-45d8-a1aa-fe35b12ef055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245904, "uuid": "99a04462-f853-4c41-989f-6d4364c4a130", "value": "b5de998bef87cfaf1392cd8157e266111e9e4315527a670680e8158149e72088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83559716-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243349, "uuid": "458e3d00-bdcc-49bc-96c3-eabb9f8e331f", "comment": "Malware payload (Formbook)", "value": "5af7a641575f153ae9ab71afedfd2dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243349, "uuid": "71e4004b-547a-48d4-8a4e-6e14584cc958", "comment": "Malware payload (Formbook)", "value": "b659fc694b658b03b5763521165b4868110b397af1a99eff6c35701ef392d778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243349, "uuid": "c3aa132b-b1f4-4d92-a882-fa4761cb1ce6", "comment": "Malware payload (Formbook)", "value": "faaf741621dd24b8b960206b5050c2866921ab00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243349, "uuid": "959d9042-958f-4fc4-a186-4fe3983dadbe", "comment": "Malware payload (Formbook)", "value": "cabd2ebd00fd3a9112f05d91777d0e9541a2d06803478ed50d98cf696ad57bb663dbdc383d45da5274fb3525303099d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243349, "uuid": "508d5731-abde-4b61-a8a5-ce7cad4bc1e6", "value": "T15B45BF027381D062FFAB91734B56F6115BBC79260123A62F13981DBAFE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243349, "uuid": "2841a0b0-e195-48e3-a1d6-f4be22561332", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243349, "uuid": "f04db936-03ef-42f9-8436-6a91dcd1fabb", "value": "24576:a5EmXFtKaL4/oFe5T9yyXYfP1ijXdaAefFslc5MboVI:aPVt/LZeJbInQRaAcFs/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243349, "uuid": "0311bd13-3c3e-4915-bb74-98a8312d8c91", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243349, "uuid": "e54e445e-879f-4699-ad9b-a8ec2094d3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243349, "uuid": "8c32e18a-ccab-47cc-a738-3038d6e89936", "value": "b659fc694b658b03b5763521165b4868110b397af1a99eff6c35701ef392d778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f6d9e5-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246043, "uuid": "50a691df-90dd-432f-8e43-bbee9f440b0d", "comment": "Malware payload", "value": "6d04919f1201581804758ab4a1b99ce8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246043, "uuid": "f647c7e4-c75b-4aa8-8e69-2da8c101a05c", "comment": "Malware payload", "value": "b6b7b87b68f970e5d39e34c73e8e9853a0d1812850b96e545791a6300d6fc04f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246043, "uuid": "dd185628-587b-49c5-839c-27e0488f745c", "comment": "Malware payload", "value": "2d820793e5b91e9fbe37cb17f79939ad554eba88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246043, "uuid": "d4acea49-fa69-465c-9f15-f0e27faaf65a", "comment": "Malware payload", "value": "d31347fffcb658018456ad15ce6bd0a8069d439ffb8fa9d2a2e47146a3fda83c5f9d024080c69a3dc74ad0f75f30d92c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246043, "uuid": "1c12187c-3d45-474d-9029-f6f5245d920b", "value": "T111C43116E961A02FE093C9B0697896567C292D761680EC5BF7801F9930B4ABFF1F071F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246043, "uuid": "8b239724-c235-41a3-9673-77bf00182973", "value": "0e4fabc5cb7fa06078a5b5788e1afe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246043, "uuid": "e8eedbab-7d7b-4f5d-a107-757c015f611f", "value": "12288:Sz2q8nUWI+dDI71gJSqZMd4l4ROyS6kk97uAstN9WY:wmdDAgJTy44OySj5tN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246043, "uuid": "da68908c-7ed3-4e45-b0a1-2e0cd715862c", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246043, "uuid": "29f79f8f-183e-458d-b80a-5b76d3ef59c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246043, "uuid": "abf6ebe4-e8fc-4f70-ab08-8e9324ea1516", "value": "b6b7b87b68f970e5d39e34c73e8e9853a0d1812850b96e545791a6300d6fc04f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea739943-4abc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231067, "uuid": "3f14940f-158f-4472-8564-0af464270751", "comment": "Malware payload", "value": "0708af878117d2459360dd842a9a6979", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231067, "uuid": "9db9799b-d421-4463-bdee-173d86baa194", "comment": "Malware payload", "value": "b75757e3f7f4b7b7e362ca42756869a310f0f32da06790466e68518f6622efb8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231067, "uuid": "a42fa7ec-9798-4a28-9ed7-2269075efa2f", "comment": "Malware payload", "value": "95d6514fa64af50805708d05aca6b57b6c26ee15", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231067, "uuid": "668cb742-0501-452a-b53c-b780c710e21c", "comment": "Malware payload", "value": "9533667f318d0d2d97c0faf991904ffeecc306abf5b85f8fdd9b30a93f2052d3b130758ebc494db653755acb0bcc1a3b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231067, "uuid": "42c53ac8-a557-42ed-ba4c-c32e3ffe72ba", "value": "T115F6120BF308A96AC9F35335BC36437A651B1D254F43C6876C64733C6AB36D08A6EAD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231067, "uuid": "948af134-d8c3-4f7c-adbe-98ed56e7804d", "value": "393216:vkzl7tjlIZFWP8RJcgoOjA4KSzYswf9Jh:vkZZjlI+URulh4HYsm9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231067, "uuid": "bee06c02-5b7a-49d7-820b-69ab2246dea9", "value": 16286368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231067, "uuid": "8d74f7f7-37e8-470c-a6ba-e016561354cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231067, "uuid": "cf02bd96-d05b-47ee-816a-9e90697a82eb", "value": "iMobile Lite (31).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c261a8f6-4ad1-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1778240019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240019, "uuid": "9e706449-4989-498a-aff9-dad9d5d2ca5d", "comment": "Malware payload (Prometei)", "value": "4b77cc27450f1a4971a382a82deff79e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240019, "uuid": "2c15760d-a372-446e-abb7-f443b9087aec", "comment": "Malware payload (Prometei)", "value": "b788d4041d0444be82bbe1c8de8f43cd3dc39f9b60afdadfd32f44ff7551d994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240019, "uuid": "4ba05bb7-8fc2-4f24-b204-82361bb34c03", "comment": "Malware payload (Prometei)", "value": "722908c66aa416db37a4138a7683bdeb0c8fb8c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778240019, "uuid": "241f0c74-01f7-4c8a-9f96-1abf5c3acd8c", "comment": "Malware payload (Prometei)", "value": "14aaccc721c13696184939b785e7b6353ee2a7db7ce002d544a0db738d2a736496037fa5094d8c26ff6620eb82165610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240019, "uuid": "f780c69c-dde7-4a26-8631-0069c7d83671", "value": "T1B1A423B4F9219E9F6DD769F91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240019, "uuid": "4b1939ed-c657-497d-aa88-f27f2c4f0697", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdu:Fs6pyCC/Ya2hpi6T6N4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778240019, "uuid": "9f6f9352-e5ec-45fc-a977-3d37f7a0b655", "value": 449081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778240019, "uuid": "2da2fdb1-1cbc-4206-82d8-e669c59a1c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778240019, "uuid": "93e21d53-0847-4c67-b89e-c5fae9284600", "value": "b788d4041d0444be82bbe1c8de8f43cd3dc39f9b60afdadfd32f44ff7551d994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdea599-4ab5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778227908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778227908, "uuid": "c0cb27ba-ce98-47c4-a3cc-a81f2f3cb892", "comment": "Malware payload", "value": "015887045facca4a7cc4713a5479f5c7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778227908, "uuid": "c082bdb8-7e0c-40a3-b020-42f469c124fe", "comment": "Malware payload", "value": "b7e18d6227ed641061b9e7a24ddfe3002f4c449b6107a5ff8a3976ef4e20c05a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778227908, "uuid": "9e689562-163e-4c2d-836c-5bb292bec1d8", "comment": "Malware payload", "value": "f829203051e703d069c9d15d5cd8e341a16cd137", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778227908, "uuid": "710f9700-58a5-4e49-b3ad-f0c3907067f2", "comment": "Malware payload", "value": "b5acda549fc3b84b5b4acc287aeba391a6c839b639ff30743395938c9ac6bed97588515b079bab35a8692383f153b941", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778227908, "uuid": "25bb9e38-3758-4f8f-bcc6-1b7f62436d7e", "value": "T133665B01E506C075E54A37B02936E7EAE2687E2DF7634AD3EACC3E546D329C21131AD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778227908, "uuid": "e3bd613b-8980-47e4-ba85-4c99f35b0e1a", "value": "fad4cfe684646d5a98919bdc92bd72bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778227908, "uuid": "5d563e7c-1282-481c-bc6e-b004e9e8f9ae", "value": "49152:yyzhJB0nQdQjMiXKxGsQ90ubIshBnc/BiTfJH15oc8jnaEQRox1fZjIsi5FK2mpA:wnQmjMiXCQ90ubIshBnc/Bu/ocgj4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778227908, "uuid": "eb1bd571-a24f-457d-952e-a9f3936ba965", "value": 6731068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778227908, "uuid": "223220ac-61c2-4113-82b5-018373df5aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778227908, "uuid": "d6501379-0688-4357-a69e-b564b5a32e42", "value": "libvlccore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e3dac2-4aa3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778220275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220275, "uuid": "59d679fc-d19d-4055-8722-c4eb317deb35", "comment": "Malware payload (Mirai)", "value": "11de3100400eef48c3fe7d1c2824677b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220275, "uuid": "9d1052e5-b694-4fc5-9592-3c2b871b437a", "comment": "Malware payload (Mirai)", "value": "b8340111fad6001870c73e879d3a478c52b6b35f851bfa46beaa15670b8cc1ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220275, "uuid": "975bb655-1c77-4f51-8c38-d22082e07da6", "comment": "Malware payload (Mirai)", "value": "05379d424ac3c11da614261c0b41d7664c7135b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778220275, "uuid": "42c4cd41-ed2e-44d9-ab49-b182ce9b2af1", "comment": "Malware payload (Mirai)", "value": "e9e18b71697518e000cf7f545123d9996a4bfc498a09f81c42c68876ba2111decd0ee98b6a741423cbd430c65fa8d400", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220275, "uuid": "00cde168-89a3-44b9-8fc1-be31d3387152", "value": "T103C35B82E6A2D0F1E68701B00557E3E68935EA305416CEC6FFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220275, "uuid": "83a057ab-75c1-4df0-966c-58c451f2f2b8", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNiolw:VoRNjmj1VGc3rRioK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778220275, "uuid": "18bc6215-8967-48c4-bd90-b77174cc0690", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778220275, "uuid": "49d471ea-4494-41c1-88c7-4580de7217b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778220275, "uuid": "bbb158be-634c-40d5-9bf9-52f804e4ee2c", "value": "xnxnxnxnxnxnxnxni386xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b89c5fd-4aeb-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778250906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778250906, "uuid": "96c5a383-0ba7-4424-9c6e-2acb79da6d9b", "comment": "Malware payload (NanoCore)", "value": "dabeace1734a3a2629c4c72cc84c8164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778250906, "uuid": "00a48da6-b595-4268-8e7b-a3e1068d7cda", "comment": "Malware payload (NanoCore)", "value": "b84e6a4c83f867fe3148ee97ee283ab346828850309d7221af5a43d9ac6dd329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778250906, "uuid": "fbf61c64-7bbd-481c-a3a4-7885b10133e6", "comment": "Malware payload (NanoCore)", "value": "ea539550c0bcb5f0786f4ed0c70c194899c902c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778250906, "uuid": "ef696513-78f9-4461-bb67-68272fc55ca2", "comment": "Malware payload (NanoCore)", "value": "906de54b4488f66708607226c313ea3c143843a38a978442371bc80cce536028267b4176867ee1eeb1beee8d3c341ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778250906, "uuid": "c44fe99a-1e37-4b0b-896a-d4bdd6536a70", "value": "T1DF14CF6A37A88A3FD2DE8679611202538379C2E799C3F3DE28D455B74B227E10B071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778250906, "uuid": "a128ab4d-eecc-4156-b97f-795a6e835987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778250906, "uuid": "be2a5ed3-971f-4b98-9f86-870261ef8355", "value": "6144:sLV6Bta6dtJmakIM5MNLiVdjyTMyIdWu+:sLV6BtpmkJkjyIfMu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778250906, "uuid": "335cdf3d-16d5-4fb2-bec3-b083d6f35a24", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778250906, "uuid": "643535d1-4911-427c-bf0a-868db2b5fa3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778250906, "uuid": "85487338-9d3a-4bb2-b3f6-b9a70433437b", "value": "www.son4d.it.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaa8a68-4b2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778279607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778279607, "uuid": "29a7c70b-c7b1-41ed-9afc-ae1b05a68c3e", "comment": "Malware payload", "value": "15e2eeae44f8a1d96e587f3d29428bad", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778279607, "uuid": "2898270e-32f1-43c4-8bca-a4b61e059a22", "comment": "Malware payload", "value": "b8de00249df3b152e5b28c21735a6acaa649b7098d0e4195b86fd29577367da5", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778279607, "uuid": "d6caa111-a6df-4635-854e-1dcbdecbf602", "comment": "Malware payload", "value": "2b0f65bbf9e77b084ddf83880e5fefac190a9ec9", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778279607, "uuid": "9c366d93-2b9b-4d33-a93c-d5afec826382", "comment": "Malware payload", "value": "1311138d6694a1a45e27ea97ca536be49f4640a85a9d963963143c5bd3e2b77c9c1909b63c63a318600ba6dec8066a6b", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "mrmike", "colour": "#7DACE6", "exportable": true, "hide_tag": false }, { "name": "Panda", "colour": "#728175", "exportable": true, "hide_tag": false }, { "name": "securitysolut-com", "colour": "#7FC116", "exportable": true, "hide_tag": false }, { "name": "webhook902-securitysolut-com", "colour": "#714A5A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778279607, "uuid": "248802fc-048e-410f-9902-050ead841dbc", "value": "T1C9864A03FCA615E8C1AED1358AA39662BB727C494B3123D31F90F6243F76BD069B9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778279607, "uuid": "b0b4cdb7-7999-4296-9829-7e026632ab65", "value": "49152:Fo6whWuGSOmAzhTi8Z/l5Vm6STOLSirdgwsBezu1qn2B57J1boP4SDV5fcl7ExwB:FojW5QYzu5IfDxwwSQgE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778279607, "uuid": "cc359f73-6886-4559-9e43-1ed3b7ee78eb", "value": 8495266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778279607, "uuid": "53291e36-9e08-4aa0-a183-129539e6b286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778279607, "uuid": "10cf88d7-8901-4e6c-95fe-0fbbc35d0514", "value": "l-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7f380e-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265056, "uuid": "26d76b45-4e31-4aa0-a2f4-ca7dcc3296eb", "comment": "Malware payload (Mirai)", "value": "542e083ce5a33c15b30e1eeb736336bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265056, "uuid": "357b93da-26f4-4d42-a517-20eaabbb6165", "comment": "Malware payload (Mirai)", "value": "b93f3b9e7d11a6b71120eee31b2142514fd79e012b739adb1aba46056f9d1b6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265056, "uuid": "7c8374ce-c8d2-4176-88d0-99084c01c247", "comment": "Malware payload (Mirai)", "value": "4a99c742f53d6897429cf5bbde5607f6722e99af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265056, "uuid": "320614ff-53b0-4087-99a9-2a949d81feff", "comment": "Malware payload (Mirai)", "value": "9bbea343c442722c94dee11defd2cf7d23f0ee6e01bee713320914d2183820ce02077be88e250a4ae8f156ee73f077bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265056, "uuid": "c1d0615f-06c4-4bc5-a11b-117b5d39ec58", "value": "T1B633026183196D25C6F4A8FA9EB7C5523D199F6FC3C4F033647D2228F8CAA50A07A74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265056, "uuid": "87063e29-1456-47de-9925-be184d053e26", "value": "768:vpO7Y5eidei4Ws5GLVK2jxT/Yy/3/mZsgG9DjCuc4b29/pTk0+qLdhIhFllikxqk:ROGVhsQT/zuwRjCio/FkvG8Tl6Utzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265056, "uuid": "4588fad3-c9da-43ee-903d-c6bae19271dc", "value": 52128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265056, "uuid": "5936b175-867d-401c-bf81-2ab06074ad95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265056, "uuid": "f413f6e5-6286-47ed-bf33-783757eed25a", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931df15a-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244664, "uuid": "ca76b1ee-a470-4c33-ab49-65322cebec4b", "comment": "Malware payload", "value": "4251a3bff4d4ae9d04bf586340517e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244664, "uuid": "3b7a51b8-4784-4cee-b611-7d8832027987", "comment": "Malware payload", "value": "b9903929bfbb60434140089993fbfdac2d4856f74972547455f37dc5ebaa7065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244664, "uuid": "55e98525-3f36-419f-8eaa-59167f555ab0", "comment": "Malware payload", "value": "9a5844673abea2bd2cd5903a24eeb355135db76e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244664, "uuid": "94087595-50d7-4646-9040-2d2ea3dd835d", "comment": "Malware payload", "value": "5d3b68c851b332e857ef24eb931de7258d3791a63c2ed49832abee2cd1eaac81b8a00b72c5e3d8ad5e4a8b33a6d6249d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244664, "uuid": "d7a1b1c0-88c0-4fd9-90e4-e58f4d5605b5", "value": "T19D159E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244664, "uuid": "b7ec4cd4-8654-4d96-90de-7848bf09c725", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244664, "uuid": "2ca1cadc-8294-4c37-8343-fe87a04f64c2", "value": "12288:hqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgagTGz:hqDEvCTbMWu7rQYlBQcBiT6rprG8a4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244664, "uuid": "d8076b0a-b02d-4158-9152-45fdcc2cea8f", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244664, "uuid": "a09636ec-820d-42d1-961e-a61a786fcbc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244664, "uuid": "4cfa2715-5a65-4884-9a57-62d521e45a38", "value": "b9903929bfbb60434140089993fbfdac2d4856f74972547455f37dc5ebaa7065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d048a0-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1778242917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242917, "uuid": "310fc114-8c7d-473c-8821-14a62f5650a9", "comment": "Malware payload (PureHVNC)", "value": "47351e8cefba2a1e1ee6684dfcf9c656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242917, "uuid": "145d2064-d755-45f7-b789-df53901a9b77", "comment": "Malware payload (PureHVNC)", "value": "b9a116e7c75421a3bf53ab6915f6aead36e8dc31ebcb7b6a429b4279fbe5b2ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242917, "uuid": "2c87eed1-ff23-4257-b632-e314ebde442b", "comment": "Malware payload (PureHVNC)", "value": "419869db5e925548a70af823c1627e50daad25dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242917, "uuid": "49f209ff-f1aa-45b1-a61b-decb92adaaeb", "comment": "Malware payload (PureHVNC)", "value": "3395a3f244990346fc24dc0ab0b4c5b1b156bec4756b6d3bcb730dcbb46772d58fcc529307a58ecbabe36cc908ed303e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242917, "uuid": "00521f6c-78e7-4e7f-8092-816499addb61", "value": "T1E76501443329EA02D5BA2FF40D30D3B547B95D84A812C317DEFAADEB7C3A755580A293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242917, "uuid": "b49f54b9-0cb4-4bc9-9e6a-88a8f7f2b214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242917, "uuid": "89817e07-b39a-4969-8d78-02948ecfa047", "value": "24576:S/ROASlq6jFeaSuvyFBLBm+QZiRio2a3S357Rr1Z43EvuBwB5jTc6BjdXM6KOCa4:IFSlqySuvyFVui4o2aCp7R1q3cH5jDxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242917, "uuid": "a3d8e993-304b-4428-9321-7ff28c61fff9", "value": 1526784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242917, "uuid": "224ec154-99c7-48ce-b04e-1382c0bc5a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242917, "uuid": "9d575135-5de8-47f1-bf80-fbe0757514c9", "value": "b9a116e7c75421a3bf53ab6915f6aead36e8dc31ebcb7b6a429b4279fbe5b2ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ec6025-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243380, "uuid": "0bf88526-d81d-46a4-827b-eaf556118c80", "comment": "Malware payload", "value": "4d533ef1a10c7cab8854915e7a5b8ce9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243380, "uuid": "75014f14-1d30-4509-9618-1bb60d0c9b1a", "comment": "Malware payload", "value": "b9d08865d0b0e6351e7f2ad0d32d7dca4b77a4d90b67cad971f0277a8e72581f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243380, "uuid": "9354813f-27d1-4066-82ce-90f15e0cfa6f", "comment": "Malware payload", "value": "af4405845b35e921056b2d7a35aa044af60e15af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243380, "uuid": "d740f1f9-e582-45a6-8696-7a1524e02675", "comment": "Malware payload", "value": "219dbed7f6c4aeb23c3dca6a5aaaec9e962a629ef9262602594c496152fe025fecc18be250427a153d7c9432957e9c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243380, "uuid": "2ed42c32-0d36-44ae-af11-6636f2682a59", "value": "T1D215CF241E922F95E66E0B78C0A3025877F0D86792A3E3997EFC14F85EA33C5CD67650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243380, "uuid": "f2507c39-9fd3-4957-b953-b474fedb9ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243380, "uuid": "ebce5533-052e-4381-bdba-c6ccea005473", "value": "12288:YSYdPD6/jK+fBfgpBfGfuABEb2bNmP4hqkgL5jkEW8KAKat6ruxLoE:9YxEjff6D+ZTUPxVLJkEW8UU6r3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243380, "uuid": "21b90ed8-2041-41b1-a9f9-539abeae17ca", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243380, "uuid": "e58b03e7-afec-4930-9b50-7cfc0a56f8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243380, "uuid": "06eb7326-ada9-4a00-a32e-ea7ce83dec19", "value": "b9d08865d0b0e6351e7f2ad0d32d7dca4b77a4d90b67cad971f0277a8e72581f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b9d47ae-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778245833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245833, "uuid": "866faaef-6f0b-4588-8a2e-243d15d068a2", "comment": "Malware payload (PhantomStealer)", "value": "e01c629ba7f205751ba906a96035e59d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245833, "uuid": "8dc54e0d-b6c8-4faf-8eb2-ee32a0582edf", "comment": "Malware payload (PhantomStealer)", "value": "baf6ff1fb182f19c5d9704e3867afca3d13ecff2304efe6a9bc6d74d9d648f4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245833, "uuid": "ead144b1-efa8-43e9-8561-a64e933b1387", "comment": "Malware payload (PhantomStealer)", "value": "d9fcefbc79c9b25ec99515fd87f5a1cbaf83a710", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245833, "uuid": "755b6a2a-5671-403b-97ad-9d29e448b8ab", "comment": "Malware payload (PhantomStealer)", "value": "f5a17ea65325d544b24ac375ca41739362e22727d84028b56f66302de9a0cc012b2dc2d2666795fbe711a916c05facf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245833, "uuid": "8bbd1b9f-a252-4891-a1b7-ced2eb835ced", "value": "T198F4DF5873F84A01F1FF5BB294B19D51AB35B513A961DB1E21C081D80E72B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245833, "uuid": "652354b3-6940-46fe-87dc-a0bdc2923e71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245833, "uuid": "5437f3ac-7662-46e7-bfdf-3a62e7a67092", "value": "12288:79P4QUkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabO3NUW6:79ckqjVnlqud+/2P+ATAS/JYeU3NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245833, "uuid": "96dfec9e-9510-4f64-a762-95b0a3727113", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245833, "uuid": "8b29d2a7-b2ba-42b8-9d7f-4b581b564cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245833, "uuid": "9f0b4071-9df1-41e8-b428-4206cfc024c6", "value": "baf6ff1fb182f19c5d9704e3867afca3d13ecff2304efe6a9bc6d74d9d648f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e070b96-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245756, "uuid": "a4fc7261-4179-4bb1-9943-6248a1db6a1d", "comment": "Malware payload", "value": "0c8e03b39a317208a44b018821734be6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245756, "uuid": "af026d72-c638-48e9-b809-2dc27cfa4fe1", "comment": "Malware payload", "value": "bb28b6dd0f3bad3203019cd8e48fa6ac6892c4a7d84258dc4fd264e3108a1066", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245756, "uuid": "39443348-e402-4035-8af7-5a5fb51e11e2", "comment": "Malware payload", "value": "68259126d9faee68badfdfaf39302752100c5e74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245756, "uuid": "e8af2795-9adb-4ab7-9d17-9d86fe9f7d87", "comment": "Malware payload", "value": "97ef1b12c65a73f2a5a4939cc1922d29adb12c80047ac554eefc6988b05b9f1042b04588ce5da957e141902fbc144734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245756, "uuid": "baae41fe-af4f-4763-a44e-ac6489a2a3f3", "value": "T19205BE516BE46124F1BFAB7A40BA0109CBF1FC83D616E71EB52931AE1D327C2D656323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245756, "uuid": "8aa2a12f-dbc9-4d8c-be75-c5573a8900fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245756, "uuid": "2e797427-f900-4585-ab3f-2293c4ae6a9d", "value": "12288:Kbdb04VL5ZfUWL6WtpcCxxUeL7On4TKrt6ruxJRYIvpabeql4:d05l9L6WtpJLSntJ6r+Al4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245756, "uuid": "563668d7-e769-4223-921f-7c806da5bbf8", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245756, "uuid": "d455b977-183a-4f80-b1f7-8d086a80a59d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245756, "uuid": "8f3370e6-fa31-4ec1-93e1-d04dd91723e0", "value": "bb28b6dd0f3bad3203019cd8e48fa6ac6892c4a7d84258dc4fd264e3108a1066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c3cd6f-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245872, "uuid": "7dc13da6-1550-46d8-8c65-a611caca3747", "comment": "Malware payload", "value": "2798e8289c92dcd0f2451d4f47273c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245872, "uuid": "3a5e2dc4-48c8-4ee4-915b-635c8dcf553b", "comment": "Malware payload", "value": "bba9174f39a68b090decfd4a9a3d73b77c6e135413128f599b5bac4a8fc5abc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245872, "uuid": "348cf978-4245-40bd-b900-5bfd6913397c", "comment": "Malware payload", "value": "d371d07fb50fd35828a5b84f2072153690f9564a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245872, "uuid": "f221e812-566b-4b48-8e3a-b28280eb5b4f", "comment": "Malware payload", "value": "a88deb6e9646686f613e948a6767922a3d31ed298720925c5dab68be35e24ed4aaa47a1c3ea1f5f9a4c4cbe1fcb39802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245872, "uuid": "b001346b-2f17-4899-82bc-ab22ce87b5f9", "value": "T12585F12623E45B68F5BF9739A4B918244FF1F806D722DF1DB999429E1C21F40CA92733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245872, "uuid": "e151dd87-d06a-44cc-9378-db3c294bb194", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245872, "uuid": "13a58fcd-6abb-4128-981d-5dfb98317817", "value": "12288:pqEgnnvK/BeG+DaetTx+U1coDskeEqtcO1yN53vOFExQszUvmcbb+TycWEG92RcY:XgnC/AGMaGu0/eS9BrVXqI+sRERE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245872, "uuid": "216005c4-ece2-44b7-8dec-2bfd2c2b8f49", "value": 1730560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245872, "uuid": "43c075d8-bc8e-492b-8969-e6b32e001403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245872, "uuid": "e5bef3bf-3521-4ad5-a233-13a3f6faf513", "value": "bba9174f39a68b090decfd4a9a3d73b77c6e135413128f599b5bac4a8fc5abc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18378a5f-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242740, "uuid": "6af0d6ce-1c6e-48b0-8ddb-5321fcabe7b2", "comment": "Malware payload (GuLoader)", "value": "446f16f93694ca352f480db2bbc0d88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242740, "uuid": "1f05569e-b0d7-4763-9f11-b21174e8ff87", "comment": "Malware payload (GuLoader)", "value": "bc6c95a0fd0773bee15b20f6b502108c105c1e95fbdbe9aacd3e670f14b26ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242740, "uuid": "dcad3f54-7eb1-4b44-b48e-3c6e3bb25e04", "comment": "Malware payload (GuLoader)", "value": "97864ed981656f7a37c13fe290eca2dc0aa24961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242740, "uuid": "946958de-a160-4477-9e28-3f352ab03eea", "comment": "Malware payload (GuLoader)", "value": "8eebdd00adceb2aed4bd5d4ee4c54224c75a79a0188ca5d2328184e4a69eba7178655c667858a1b5c9698413837a8bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242740, "uuid": "73be034d-42b8-46fa-af7e-80cd1911c93f", "value": "T14844126772D1C453C27B0930887F4B668BF6A66519A8274B63E4FF9DBF26342CF06211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242740, "uuid": "244b4ad3-a62d-450d-aada-704b187030fb", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242740, "uuid": "5e87e141-7ddc-4c4f-93ff-fbc28477f63c", "value": "6144:5qjIcRr1gfMXoQA2YQX82cf6YW70Bs42U1WJlHZ:QVRr1gfSX8QOyX70srUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242740, "uuid": "b7a26d13-fe23-4b57-8d2b-5e0189a7e8f3", "value": 276464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242740, "uuid": "9f181873-154c-4ec3-9a8b-21ce42357540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242740, "uuid": "8efa6bb7-afb5-4fab-9a87-1feef718fe77", "value": "bc6c95a0fd0773bee15b20f6b502108c105c1e95fbdbe9aacd3e670f14b26ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3f420-4ac3-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778234001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234001, "uuid": "01ee4e40-3839-4d18-b97f-8523aac4a56e", "comment": "Malware payload (Formbook)", "value": "6b937f2de276f008fb156c82391995a7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234001, "uuid": "9caa1f78-afd3-443b-8198-dfc3fe425199", "comment": "Malware payload (Formbook)", "value": "bd125b43ba0f49c2ee59c8d9c78e35e3a56b578b770ce1e8dfd9b541c3974fb2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234001, "uuid": "242f4b54-b430-43c1-8ce6-72de47a074c6", "comment": "Malware payload (Formbook)", "value": "a3fc2c6c6872f613f83db5306cbfefe591727a0f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234001, "uuid": "966b83bb-16e6-402d-a4e6-b637acd84a7f", "comment": "Malware payload (Formbook)", "value": "3e2b5e8661becbfc718e18eeae7a245fb461a9376a24cce90f4540b22a4eaaa8dbd9f65f0587b1b183501bf2900982d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234001, "uuid": "8d5b7af3-9b7e-4def-b11d-bc16f1bb569b", "value": "T175D56C17D66F974E18093B61006A5D9AFE99CAFCEF727BC4E0CF90B614EA1110B851B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234001, "uuid": "c6c6d1a9-eb03-4946-9e8a-d45fee061fd9", "value": "49152:avMSPQ9NzE5epwK/OD3sLgV/mpk0wHZSIZsM12LlYhGRaSemtEQVfHUh:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234001, "uuid": "1f04fc5f-3ed1-40a1-9f92-014f461022ab", "value": 2979875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234001, "uuid": "77c87639-4580-4cc5-8d3e-14f3b9e60cde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234001, "uuid": "b2e67a7a-297b-45c4-ab12-ee22274e1a73", "value": "Ust_Yaz\u0131 Yakias\u0131k Maliyet Fiyat istemi_ihtiyaclistesi_1062945_Teknik sartname.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e528f621-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778236641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236641, "uuid": "7885f973-8d71-4d62-9e40-75bb537b4901", "comment": "Malware payload (AsyncRAT)", "value": "0c4ffdc4e82b0cea2a273ee9d48e44a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236641, "uuid": "3f82cf8b-147f-4125-b3ae-bcb74aa49aaa", "comment": "Malware payload (AsyncRAT)", "value": "bd530101baae6c95563be9d40a6b51ebe67160e12b6c80f3204c4d7aaf4c74fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236641, "uuid": "df000320-9428-4e2c-bef2-7bfae14ff71d", "comment": "Malware payload (AsyncRAT)", "value": "af893de0033511d21b4ef90be2cc95f529efe5bc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236641, "uuid": "b2af1cd6-cfca-4ffc-8a24-e8f143f8209a", "comment": "Malware payload (AsyncRAT)", "value": "234947d75bcd736628e8be30de7cc3ab66ee38e88e013a07ff96e0f6b4dfdb8fa54fbb9311df11f9d92befce2d80c38b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236641, "uuid": "9ac5264d-39ca-406d-bedc-7fbc412b9496", "value": "T1EED558B074B9B5AE71F08EC6616118C92199AF3C45EC1C43FBB376E4352395EA7B8843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236641, "uuid": "1f7ff091-4587-4600-88a8-12f963c03b79", "value": "192:+aMKPo6Bs9ITKdeAuuJifbWMs/2HnygDac:LvB4ITKdeAag29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236641, "uuid": "8dd05ccc-2534-4f83-b047-5b3823b5569e", "value": 2953996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236641, "uuid": "b5b3aa54-47cf-49c2-80c3-ad01a87a80e6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236641, "uuid": "2d43aab5-ae5c-475c-b3c0-3f48c3715350", "value": "Transferencia bancaria.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c578d5cf-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778243460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243460, "uuid": "da290f4e-7d65-49b3-bad0-35822561790a", "comment": "Malware payload (AsyncRAT)", "value": "529fd592778ef3912193420fc071cf3a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243460, "uuid": "b47d5d03-c6da-4835-a81d-5e06c278d72e", "comment": "Malware payload (AsyncRAT)", "value": "bdd6ca44065c5b1f9866eda1b84cfec8e1abe42b739e7c776a9b5e67646d9edc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243460, "uuid": "b46cde6d-6d6e-417d-a01c-619186c13147", "comment": "Malware payload (AsyncRAT)", "value": "782c03f1e0c9ad76899898d0b9129f96e7cef870", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243460, "uuid": "3e16ca13-73fe-4d07-a57b-134b9758ed79", "comment": "Malware payload (AsyncRAT)", "value": "aed793d3d8c19602470bb8f47f7f3bfadbe5f5a8edd8359cd908078553084d371347f7910ee15753a2f9e4465c46632b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243460, "uuid": "36104af3-7189-408e-b143-bf1ab8ede9cb", "value": "T1BB15F1482259DE02C9A65FF01D70E7B04BB99E945422D3078EFA7EEFBE397416904393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243460, "uuid": "eecf2151-e001-4355-ad36-ae43c029e6fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243460, "uuid": "96235328-20bb-4e8a-a5a2-e45e8b5a606e", "value": "24576:zmSJJSHw/S38sNWZLgkxY6AROBUGRn5IBS:zmqUw/SssEgRNr05IB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243460, "uuid": "65e6b721-175c-48ae-af54-f2b71ff9ad65", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243460, "uuid": "8c118bd5-87d3-40c7-83fc-0141e0ef86b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243460, "uuid": "43e5f9bc-8d9b-472c-a45c-5effc2690c17", "value": "bdd6ca44065c5b1f9866eda1b84cfec8e1abe42b739e7c776a9b5e67646d9edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879d008e-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1778246792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246792, "uuid": "bce0898d-abd1-49cf-ac8e-6562b4e842a7", "comment": "Malware payload (DarkCloud)", "value": "6fa83d6526ab9f57a9ceba992b11a3b0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246792, "uuid": "a308ea9f-bd5b-4a4a-b8c7-a220bc83120f", "comment": "Malware payload (DarkCloud)", "value": "be74355fc8c8a3aa317e53222590e8dee8c65154d2bd1ac8b03395b66f73d8ea", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246792, "uuid": "943a78a1-aeb5-4ac1-8de5-993103424602", "comment": "Malware payload (DarkCloud)", "value": "26c57691e5d2a5664ec4626fec04cbcbeaf38a53", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246792, "uuid": "8e1e2cc4-06d6-4583-823c-a9636126e389", "comment": "Malware payload (DarkCloud)", "value": "3ca700393458140fd9cd0e0f648a35cf2d2cb65de896f2ea0b3e22e05427c25ed2b1a6974a0e9ceaeaa7f9d0f96ccb75", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246792, "uuid": "7133670a-4366-4400-9c9e-501ffcf63e7a", "value": "T1F5A44B13EA60A02EF1A3C9B1A9B4A29618267D3967D8EC97F3404F5935315D3ACF131F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246792, "uuid": "c327d7b2-7025-4d19-8662-2aea40bd59e4", "value": "65587040564dca9304cea378a2d2e04b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246792, "uuid": "87467d62-a8f1-454e-abf5-b4edd87065b7", "value": "6144:O8d1/w5KA81IJ8GpF6nuTmOOUiBUrj3NRWMKLLXVEezQstCb4yz4wWa/Iyn3ziX7:djYKkJj6GmZUiqrRwXTS4yz4wte", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246792, "uuid": "f4705472-49fb-4e25-8e88-719bb290d5ad", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246792, "uuid": "d2d048bd-4a28-4718-a0d5-3faea8b9e697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246792, "uuid": "b03b6729-f061-4187-94ef-0456b008da8a", "value": "be74355fc8c8a3aa317e53222590e8dee8c65154d2bd1ac8b03395b66f73d8ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af77d81-4ac0-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1778232464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232464, "uuid": "229fff13-a726-41c1-9d8e-59996e2c340e", "comment": "Malware payload (SpyNote)", "value": "8ef02710098da919049cd4b68225c703", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "lazada", "colour": "#5AB2A7", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232464, "uuid": "7affef6f-792a-4363-920b-ffad7d736cc2", "comment": "Malware payload (SpyNote)", "value": "bf06df823a0a0b1b4618ee736f5f0bd508b315ea3c6b96a16d2a0d0e58906346", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "lazada", "colour": "#5AB2A7", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232464, "uuid": "a915c51e-715d-4bbf-af02-60133cdf9fb5", "comment": "Malware payload (SpyNote)", "value": "2436a4b9a769c11e8ddda1bdf2ff503f461ea661", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "lazada", "colour": "#5AB2A7", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778232464, "uuid": "8c08511b-89d5-4697-bd40-ee5281ee4677", "comment": "Malware payload (SpyNote)", "value": "5f8f45a1a45f8cac796b552a5e6d0561e1f36bd4a7931a9b372b6d7f294d18bf29ba0ff005af1859edf81f0bf3180376", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "lazada", "colour": "#5AB2A7", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232464, "uuid": "881eb073-b971-4af7-a487-d6c3fe015130", "value": "T14F07F103FB45CA97D8AE83F29B370FA92E070F54C6626AE75551762D2D772D009C2ACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232464, "uuid": "097de87e-2b69-4c84-8574-6a136ffa74a9", "value": "98304:BvnmrFEc3ZigpIeVz/uI0mzRzBtTW0tylmXnKQDhG/B:lnIFPJia1FzzJdXXKMYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778232464, "uuid": "ad029987-2717-4f24-a74f-8dcf5531139c", "value": 18329944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778232464, "uuid": "c8362f6e-c2f2-4130-8590-bb3d3979774e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778232464, "uuid": "aacabf5a-72e3-4d93-807a-4c227375ebcd", "value": "Lazada.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604a72a3-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242861, "uuid": "96fc70b2-4c49-4941-9f22-00d4a2534a29", "comment": "Malware payload (GuLoader)", "value": "018d0026fe080c9ede0328fc7075a58c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242861, "uuid": "3944a78e-3a2f-4b07-a820-e0835084258c", "comment": "Malware payload (GuLoader)", "value": "bf9348e27f3fd30a76f327bb92f022dfae892563d79f57d5494541d71379aa38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242861, "uuid": "43355e0c-61e4-4287-b26a-6b5ab8015070", "comment": "Malware payload (GuLoader)", "value": "bc1ee6d30d1d5e839829dfc92a5c548c3a6a1551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242861, "uuid": "4ba58738-4f7f-4a5f-a4d8-28dbb0327b92", "comment": "Malware payload (GuLoader)", "value": "6e0d20247408e46b5eb4e3c3185bad4b5a1a93065718724d71c1f8bad70ad009962eb7654fa26c9be8fcebc594ff38b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242861, "uuid": "4806d398-be6b-436e-acb3-f8d1e0d6ec8e", "value": "T1B64412553384C1A3EEF14B311C37B6BB09FAE9355A645B0B6310AF9E7C12283CD29762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242861, "uuid": "dbdf3eb8-8d5f-451c-bb67-26778b696bd2", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242861, "uuid": "55cc8031-d576-4585-bfaf-428609f4a7c8", "value": "3072:cDxaVzwmg4CSW8JSur455xtG7kp4iQ2ihyp8liU0kpFQg7Pvf1GbPV2+e5dgOl5C:CMm4CCNUxwaVnel9r8bPoZDgG4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242861, "uuid": "3bb0e19d-634b-4f44-a054-fcf07e5211ac", "value": 254808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242861, "uuid": "c379c93c-8f08-4386-97e9-209b9127ab40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242861, "uuid": "1f424d43-a4e1-40b7-b7ca-2a5dc1345e53", "value": "bf9348e27f3fd30a76f327bb92f022dfae892563d79f57d5494541d71379aa38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e00078-4b27-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778276631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276631, "uuid": "689a6ebb-4f36-4469-8d44-a5dcb51a67e0", "comment": "Malware payload (GuLoader)", "value": "c9c37772b6a3ad49603ce1fbe0422f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276631, "uuid": "501dfe5a-b133-4cdd-8ee4-397d170536f1", "comment": "Malware payload (GuLoader)", "value": "c0091ec4f891a04ed8531faa207345a6674597ee1b765ad0dadd35c37676391c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276631, "uuid": "0e33e8f4-a304-43d2-a6fe-404092851a41", "comment": "Malware payload (GuLoader)", "value": "7da664284e092d7b9a4aea7bb42bc3c215ce454a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778276631, "uuid": "42ec0f0b-e0c2-44c9-b0c3-5e549df3dbd2", "comment": "Malware payload (GuLoader)", "value": "a2fe83588f2f278ec4006d80e8c7a2494c9da80779a0feda39fdd130629e1afae708f5a8610f1f136b7d40ad94cba301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276631, "uuid": "1a572e74-888c-4784-bbe3-bbdc6c4b7a04", "value": "T1A7E4122173B0E467E323FB31BF68D6A94A96AD2068905E0B3B6037DE7D70D54940BB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276631, "uuid": "38ba4750-6f45-40f4-8d9b-cf7a77370db1", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276631, "uuid": "a62d2535-e8ae-4631-9c7c-e6c8aef5e6aa", "value": "12288:uX4HfexJR+6gYnAj4yR3Aoz9/oszAW1POgs8T/YwVwEfFjL+3aZZoJaojl5IZ4VL:w4HfGR9gYsFR3AW9/osVOT8swZN/+3b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778276631, "uuid": "8d12f147-88e4-442a-b342-58f011ff0851", "value": 705104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778276631, "uuid": "b444aaa9-c3c6-41cb-8023-d33fb54cdcbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778276631, "uuid": "fa925e0a-fcab-46b6-9c9d-e8862c77947f", "value": "Purchase Order Batch 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147aec35-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256478, "uuid": "c7a25143-11e6-40a6-9fe8-9ed884436bf7", "comment": "Malware payload (Mirai)", "value": "82f7d34cc92da75e9254957224deccaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256478, "uuid": "2d0d0cf5-a6b5-4b57-a880-4304c4962907", "comment": "Malware payload (Mirai)", "value": "c08e8d2c5149c95197e3ae2d51e9a6a0a80b3031d51c8d9dd75f05eacff882e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256478, "uuid": "a6f5c273-0f66-4a6a-8078-07cf6af99ef0", "comment": "Malware payload (Mirai)", "value": "b6e96d865b4fe9e82f9735ae0a3aa5ce34cd9d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256478, "uuid": "f7b62e2c-d9e0-4e71-9344-978585657dd1", "comment": "Malware payload (Mirai)", "value": "06a5b6444d41f2aad6e03f29a13c9e00e49effc4998887e392f013bcfa9ef12e57ff820046367323688a37b437cd5a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256478, "uuid": "2f490845-274a-4cdc-9abb-deda962771c0", "value": "T1A0145B4AEA814E13C0C717B6BAAF9245333297A4D3DB73069914BFB47F8765A0F23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256478, "uuid": "178e2c0b-c846-4af1-bbac-98bb3ecf2299", "value": "6144:KTOZxbWn+aou9ovT87dRAZwR5jvFVM/9HSmEw3bqiKuR:KTO3bWn+aou9ovT8/hxS/wmEMbqiZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256478, "uuid": "12723d40-7700-4d31-bc99-bd08e250bf64", "value": 208367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256478, "uuid": "e46de2ed-e641-43e4-93be-9981b833a8a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256478, "uuid": "ffa68f45-3871-404f-847d-674e9107944a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf07a33-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246556, "uuid": "722bcecb-f2a0-4848-9923-c08afa9bb454", "comment": "Malware payload", "value": "97c19bf2b03e5c4edf15212fdb5e1c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246556, "uuid": "6d415191-0919-4b14-8778-4a789b06d7f2", "comment": "Malware payload", "value": "c0947b004276c9e398032eb95351642c8e3a7106f3270ddc9e23bf6b6415a01b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246556, "uuid": "74c622bd-c16c-415f-9c27-f683b5135712", "comment": "Malware payload", "value": "fd5ffd3f178bfff9c9f1f087045918be13a3d9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246556, "uuid": "d4843cf4-3e83-4f6d-9e31-29fa12269077", "comment": "Malware payload", "value": "572228dc45f368a66817dca8cb407b387a17acbf54a317a90a11b9251b12e9d32ed9ca406b16f487dd2b6be952d5417c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246556, "uuid": "0bd99376-3823-491f-ae2a-e217da091b6b", "value": "T1514512252BA8CF06D87B9BF08961D0701BB06D9CE520D21B8FC2BEEF35767254644B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246556, "uuid": "06c4247f-34ac-4956-b642-a0febbad26e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246556, "uuid": "7b002b86-dbf4-4542-b41f-ea897dd3e29f", "value": "24576:b4UnhG3jHTKpnRujpAs7TM5kHzN6V3AJeZ/uSPF6Do7+TOdwdSX:bfYvKpn8jpAs7T0kQSw16hTOdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246556, "uuid": "e955b54f-9309-4366-9253-f4ec0b3d50b5", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246556, "uuid": "056f2bce-9ec5-4e32-8e89-a288c18d6099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246556, "uuid": "84f88de7-2858-4e65-a27d-41de9d7c98fe", "value": "c0947b004276c9e398032eb95351642c8e3a7106f3270ddc9e23bf6b6415a01b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9eb345-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778236221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236221, "uuid": "1973a14b-fafa-4ad3-a2b3-ac76e3abf417", "comment": "Malware payload (PhantomStealer)", "value": "caacc18870f071fdafa0ce3fe0f18e0b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236221, "uuid": "76f91861-ab0c-41f4-917d-286dbcb6d41d", "comment": "Malware payload (PhantomStealer)", "value": "c0c6d90a469fe79f03c570f7d2a6485b2ccd7ee890b5ec3bf04380e8c8d55739", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236221, "uuid": "1fb6c5ce-d3da-4f7a-8bfc-b0b5e1477d2d", "comment": "Malware payload (PhantomStealer)", "value": "3edca3ebe0662ee48f146769e7c2b12278c73fca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236221, "uuid": "5207c476-5a8e-43fd-8343-1e2fcbe3934b", "comment": "Malware payload (PhantomStealer)", "value": "eb0a8fe078aed6b30b4ede43cb2ab425058e63c39fd1ac84cdf9ea3b677e4b978395ecb045dd2cb7e49694ab5c71c1c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236221, "uuid": "2369e858-80fa-485d-b506-5a91fb02790d", "value": "T19A73C8C839CAF4A6039270B7992BA057F1ED8C80B80CC555FDD5645DB8AC704EAB6B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236221, "uuid": "6a87ae69-b45c-4f75-833d-0599d69dd8da", "value": "1536:xwjvr8P7k3vH9BctadF66wWYuGo1NjEtpws7/qXbpESGoXwMvbCj5t:CjweQIFbYFo3EtpwESiSZzvbCj5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236221, "uuid": "e761b245-88d9-4bf4-a34e-046bfd4070cf", "value": 78231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236221, "uuid": "dc252b14-a031-445a-8877-46b725490cce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236221, "uuid": "218b572e-1733-4402-8a87-d09ef76bf160", "value": "Swift-TT-ref07052579.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b2d911-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243318, "uuid": "934ebe24-1e92-4216-81a4-bbff190aa264", "comment": "Malware payload (Formbook)", "value": "6272eba18bc46f6c741975c6b69e3af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243318, "uuid": "b03658d3-50c4-423c-9225-fabb3908f9ba", "comment": "Malware payload (Formbook)", "value": "c11ded561f8fd8f54d0f55a41f27dc5054f8bf424866557785bc8d2e45131ec0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243318, "uuid": "fb295cc0-5ac4-40a2-90ec-e7249aef39fb", "comment": "Malware payload (Formbook)", "value": "86af6f84554fad9e6acd72e6c8c86cad6318c715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243318, "uuid": "8d73d32b-8fd1-4d51-a6a4-4a00b6f29cb9", "comment": "Malware payload (Formbook)", "value": "b7a69df31fc79b929bc4c0d6261ce53923573bf5fbc4e9449a50d412ab1046d2f555c298be7a2cc738c1d6ccd2c40cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243318, "uuid": "6b99d08c-60ab-44d1-82b6-2b5bf8ac1063", "value": "T14D45F114676BDC02D4A65BB148F0C33407F5AD85E422D30B9FE67DDBBA39B922885393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243318, "uuid": "8f9838a0-78c5-42db-a141-a55ad3bc38c4", "value": "24576:SBxSJJSHwkHqSizEOZU1L3LqaeUzRCSF+yedTXaXy66ft:SjqUwkYk35eUQSMVd7aXy66f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243318, "uuid": "e2d2beef-019c-4660-b3ed-255a5ac242ee", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243318, "uuid": "400feccd-0c72-4d7d-9b36-1f0c574a8eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243318, "uuid": "5dace80e-eba6-44aa-a5bd-80c58752da98", "value": "c11ded561f8fd8f54d0f55a41f27dc5054f8bf424866557785bc8d2e45131ec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7ed73d-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244573, "uuid": "ef47f705-ff63-4011-b63a-30439c7187b2", "comment": "Malware payload", "value": "7d34d078e037ac15736c8a799f1d64d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244573, "uuid": "6d6ad31b-55df-4d32-bc86-7396adca21d2", "comment": "Malware payload", "value": "c171863a3a24b142fea8e03d673445a4e7e85e8a24e61c01cf26bdccae6f9cb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244573, "uuid": "1db1435f-2624-4394-ab29-7c8b94c61afd", "comment": "Malware payload", "value": "5fd073ccdbdc06d17deeaccf9a508ccedd71f7ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244573, "uuid": "affb3d4a-c199-48e5-8fcd-7cf69a4f75d3", "comment": "Malware payload", "value": "679b8d24c9ff9e111a0f5790ed494fdad5ccdedd4a89fb1286939e86603ffe689b76f69bd025d6cb1edeea128fa2ddab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244573, "uuid": "92a94875-d27e-4a5b-930d-46eb341882a1", "value": "T192C44216E921A02BF49389B0697996467C292D321780EC5BF7805F9930B49FBF1F1B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244573, "uuid": "48c3aec8-11d7-458c-bbec-9af82b9c1884", "value": "fd5807fc6425a0e7ca5e6d1a8d0886e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244573, "uuid": "06328e9a-478b-449e-ab9f-bc2c430fee79", "value": "12288:LJ/lZlCcUqWIvlfMuPkNmvv7Ecku8Ft+y+pK7YPf5BRcCbbAR:LDCcUqbpK7YPfdbAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244573, "uuid": "c8d45f04-fd97-48c5-80de-ff2de4e49e60", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244573, "uuid": "2f422681-ce36-4516-b9ed-9a2b068068c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244573, "uuid": "40c309fa-b897-478c-a1ab-2f8ceda9329d", "value": "c171863a3a24b142fea8e03d673445a4e7e85e8a24e61c01cf26bdccae6f9cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aebbed9-4b1b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271601, "uuid": "f6338cf4-be09-482b-b339-036dd1e59a6a", "comment": "Malware payload", "value": "4c0125c6b40c624be44fa5024954417c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271601, "uuid": "3e3315d8-c47a-4ded-90f7-1c72f46eed1c", "comment": "Malware payload", "value": "c1cb59ccdab7667756c2be2135231115a618ea8319a9ac799e71c32bf5f2c8a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271601, "uuid": "001f1e0d-6048-4682-b567-5f45a8506abf", "comment": "Malware payload", "value": "57459ef3e91bc471fa31b86bea4754d43b56aed2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271601, "uuid": "548d32a9-8461-41eb-a7f7-3f42aaf91b1d", "comment": "Malware payload", "value": "eae52c7c3af3f76e8f3cdd10ef33f5a7812c0c9e2727b043d6723c1e9cbab41a9a06dbb4371bcfdf34026f9ab4eefda6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271601, "uuid": "073283a7-08d6-4226-9381-ef0ddf54c99e", "value": "T147D3BF037E452E3BD0E148B546024553761FD9E1ACEBAE1B8358DEF7B3A623B8E4D241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271601, "uuid": "92c1c6c3-0cfc-4daa-a254-57b0d91dba57", "value": "3072:H8fgRpho8Uuv+O2RDZHcOO3QpA2jZvKPU/bduhhUN:H8YRA8MO2RDZPOcA213/bMUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271601, "uuid": "060a66f2-f5a1-4775-8699-a36dcfc5f7a7", "value": 133410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271601, "uuid": "68fa9468-a222-4293-afa5-7fc985a8bfa4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271601, "uuid": "080946cf-123e-48b5-9e24-d435b59163ba", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7125d57e-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778246325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246325, "uuid": "e67a655d-dda6-4442-90e8-0817238f1edb", "comment": "Malware payload (GuLoader)", "value": "9c20af09dfb0e9a6c65402bf15931a1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246325, "uuid": "b20bfb33-614d-4b37-bc6d-7c37cf62b3fe", "comment": "Malware payload (GuLoader)", "value": "c1e20c1ba75433f41885ca5038a52ff8cb169bb1fec8c983ccc9656d9b2fc5e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246325, "uuid": "2a6c64cd-6631-44c9-be5b-b022202475ee", "comment": "Malware payload (GuLoader)", "value": "84a685412afd151a6c1cf61eb92570ffc57ce01c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246325, "uuid": "e0225f5e-5b76-4df9-9a64-9b48a8b46958", "comment": "Malware payload (GuLoader)", "value": "7f9e0e1a2dedaaca6be42f3fd4d6b587135d4289329c5b3583e5fc5995e1834e4ffef52cc81d5abb87d34fe4518eadf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246325, "uuid": "150c79af-5187-41db-a918-850214791608", "value": "T1F905C04298C1D276EFE24770D42F08E15037BC6E6AFB684DD8DB70B5DBBB182B11A056", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246325, "uuid": "d76568e3-e913-4214-8f22-8dc658bfafec", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246325, "uuid": "6dddf8ad-6ea2-4bff-a498-583c1149e974", "value": "12288:SNf1CmFPKk4FmsG+RW46zWRTwk+IwecIdmSz0GJOW9wJmm+5GsnbK+vdBesbN6Wz:Sf2xR6zWRTOIw+dEjvsbK+LeshBUE5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246325, "uuid": "315f6438-9ff0-4ede-8eac-665ceb34b9e9", "value": 832072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246325, "uuid": "7d04ff67-24d3-49d5-a8bf-e68a9188db61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246325, "uuid": "d8c11b05-68e2-493f-b8e2-a743b437062a", "value": "c1e20c1ba75433f41885ca5038a52ff8cb169bb1fec8c983ccc9656d9b2fc5e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90786eaa-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778245948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245948, "uuid": "30d371ab-7f55-42bc-ab11-0966908e29c8", "comment": "Malware payload (a310Logger)", "value": "0545c943730dac0c594d007a0d65df73", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245948, "uuid": "91111f63-8262-4754-9c16-377ffdef619e", "comment": "Malware payload (a310Logger)", "value": "c451e5318054adefcc185477658d005fa6fa2fb985e6709d870a6ebcf76221d6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245948, "uuid": "2ab65c0a-c9a6-4681-af86-8d0752cb7526", "comment": "Malware payload (a310Logger)", "value": "046c22275533e5c725975525d09b36bc9053c0bf", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245948, "uuid": "24aeff35-5509-46f9-a2a8-4818c3df0024", "comment": "Malware payload (a310Logger)", "value": "e639b8c3843cb77ffbbf17c2073d0eb8ca870efeaaf0bb4e31ca2204eabe93ac969e802a0598f4a9f1319c43be50b33e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245948, "uuid": "1bc351ee-a94e-49b0-b9e4-dd8d40302335", "value": "T1ED552321532BED02C49617BA4CB0E0B01B745E5DE636CA874FDA3F9BF5BB72405A9306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245948, "uuid": "34538a6d-cf70-437c-b645-d436a8717cb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245948, "uuid": "7fb041cd-16ab-4442-b95b-df883efb6d10", "value": "24576:uTXv9BQlnCn6769o3W8CLB7HoqIGLZPYmbq9gwff9EeiiNqX:a1BQhCn67VG8C1rZGgIf9EWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245948, "uuid": "9cead678-848d-4512-8478-c12db9600180", "value": 1340416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245948, "uuid": "b3605ab2-4075-443b-9571-c9ad5113dbd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245948, "uuid": "ba47df0b-b11e-42ac-9899-1a504c1cc560", "value": "c451e5318054adefcc185477658d005fa6fa2fb985e6709d870a6ebcf76221d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07343e3c-4ac4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778234122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234122, "uuid": "8b1cfa96-7711-4ba1-ad30-bd76f2b66b50", "comment": "Malware payload", "value": "8fe07d87ac4e73fc8403297682563812", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Netflix", "colour": "#C269C5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234122, "uuid": "65ff5323-21e6-4927-b372-11afbbe9d8b8", "comment": "Malware payload", "value": "c46688f553c2ec0dd426fcdd73895700a116dad0a93b3f54064f6475b9330b14", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Netflix", "colour": "#C269C5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234122, "uuid": "250356c3-c933-4034-ae3b-5495fe50d299", "comment": "Malware payload", "value": "eaf0156f784132e64d778e58263b7986bd520c32", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Netflix", "colour": "#C269C5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234122, "uuid": "5d8eca65-4218-4eaa-ab42-45dd652a9083", "comment": "Malware payload", "value": "e26d6491cb013d8786f9c7634216a9ab8f6c3d9a54515b0ca9851e93a246459b7e28456a8e58bd8c5fc858e298f5c7b5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Netflix", "colour": "#C269C5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234122, "uuid": "3a4ea035-78e5-48ed-9cf4-d45be2a45f5f", "value": "T1C48723A6F389EF6BC1F78B3246796256655A4C25C783D783090172382AF3BD0C949FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234122, "uuid": "caaf1265-ee14-4bcd-b1f4-8ca787eeb901", "value": "786432:mUVNkhTZOOOah2qMOq+FxiTpTzPMDDAjp80BSQpLkndkyfM:9NKOOOah2ZUxCuDDC80o/ndkyfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234122, "uuid": "b142f650-c9f0-4842-95bc-27546e72f398", "value": 39317665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234122, "uuid": "2b171840-2649-4bdd-84d3-7d13b73effea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234122, "uuid": "eee9d8d1-a4a9-44f6-88f9-908c95377b37", "value": "_play-2_Net@flix_Plus_Unlocked__2.3.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ae6979-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243405, "uuid": "9ff0c6a3-05cb-4cec-8738-ef94358e10a5", "comment": "Malware payload", "value": "51e28b3c00fdee2b83f07f1d273141ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243405, "uuid": "6650285f-f415-4cc6-846c-8b140ba5114f", "comment": "Malware payload", "value": "c4ac8d08bb441d593c494ccb801faf60b663bd1bba1f286c0e5b8026252e04be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243405, "uuid": "011e5f8d-9aca-4d82-b7a0-29598a438d87", "comment": "Malware payload", "value": "3a3f0994d139d07289a87d6dd189ce8fb5d7d351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243405, "uuid": "fb594eeb-cf67-4d3a-9d1f-f2c8faba024c", "comment": "Malware payload", "value": "707a07f7edd50a7aa2848b2f08bd1cc78510bc6b198a2d04950406ea9a818d9f5bcce85bfc12734c150c695892c81151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243405, "uuid": "8a6da881-bb6f-4f77-91c3-9ab8444439ff", "value": "T164B2983DC6E5FCC0CB9B12F4756AF7C412AA9B177E6A5B1CF8D800562E50314EBB4688", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243405, "uuid": "7b276a36-d25f-46fa-9e3b-1ae5bf2c7b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243405, "uuid": "f9a79af2-eed7-439e-9834-4de83d3e8c5b", "value": "768:oz57Ngy0R4DbFG042XMW1b7H4PzlSUBEf3ZOsK4:8DbD42XMW1b7H4PzkUBEvZOsK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243405, "uuid": "01b9c5e2-cef8-440e-982a-7807862fa5e5", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243405, "uuid": "755af090-5875-4a36-ae7a-4f199896168e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243405, "uuid": "d8764d76-f62e-4334-a543-83058b04b696", "value": "c4ac8d08bb441d593c494ccb801faf60b663bd1bba1f286c0e5b8026252e04be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5e26d0-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243473, "uuid": "0dd3ad6e-7950-493f-ab1b-d8221efacd09", "comment": "Malware payload (AgentTesla)", "value": "fc1a85b81fd01ce948dc5432952b3b21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243473, "uuid": "3f2148e8-89dd-4aa3-8c24-85640e657105", "comment": "Malware payload (AgentTesla)", "value": "c5b6815d50de3d03fd763a0293f696b38b827ce6a08f879dc6f84a664317609f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243473, "uuid": "e024a257-46f7-477c-98a2-1fcbd5366cb1", "comment": "Malware payload (AgentTesla)", "value": "413c447761ce69ee33fc3af7c871b698da753f02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243473, "uuid": "4acf30db-db1b-4043-b2c1-e30037a22544", "comment": "Malware payload (AgentTesla)", "value": "e6e4ed465a3923163993b06c0cf3a9beb38d1583598b5d8fd92a06f60a3d0b824639fc2a4fc8c83bd5480f58870a60aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243473, "uuid": "a0e27f48-fff9-4095-bc47-eafa146b0d72", "value": "T1526559F1D38189A4E8E6A77C5533CD3705BBADBEAC60924D449E78B3BF723821066507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243473, "uuid": "2954389b-7335-4bfd-9708-3718952f21c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243473, "uuid": "20b932de-daa2-4faa-954e-d5c6aeef9edc", "value": "24576:39P/vcLySsfhm1q0ne7gcQJGbOcxSJJSHwzXObe7wP7+:393vAsEE0neg5JGbOcxqUwzXR7G7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243473, "uuid": "f2b136f5-26b5-4de6-868b-920b19fc99ef", "value": 1528840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243473, "uuid": "6fb6f640-cee8-4312-9e57-369ef1ee860f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243473, "uuid": "747dd398-d6af-4845-b19b-19b76cb09827", "value": "c5b6815d50de3d03fd763a0293f696b38b827ce6a08f879dc6f84a664317609f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b427878-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243255, "uuid": "031da133-3a96-4fa9-854c-d4f8ddc9b695", "comment": "Malware payload", "value": "664a7f2d21f20f4a9747981145cb1332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243255, "uuid": "55e19d76-30e4-418f-bae2-92ab064968ca", "comment": "Malware payload", "value": "c5bd3bb48f8f12752ec7ca5318b38074ddd83beaccf9795a9e9d389e0b26c682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243255, "uuid": "4b8ee62f-7436-4d96-accb-543002a7d936", "comment": "Malware payload", "value": "ae5f1f396d62443fc37f4b73148011f2fd06fb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243255, "uuid": "fe332014-5533-449d-b09d-c3a692b2fc84", "comment": "Malware payload", "value": "f2b6c326689082a9391dcd3af01f996f4f6827593e2e0f66e602d37fc851d6be089dd5af2e569ace38bd4e6fcbb256d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243255, "uuid": "82cbe29b-d0c2-494f-b749-7659465b1403", "value": "T14C155BA0F219D9B9C1764EF35C3A987510A7AD2CC5A044AFA1F9371C1AB736710AED0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243255, "uuid": "fb64d71b-1548-42a0-8109-234f3bb9466c", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243255, "uuid": "206dfbd6-2d71-4a39-960e-a40b34f7e51f", "value": "24576:xAT8QE+kvcnNnTsIERNOOZD+8OQ7uOp6U0:xAI+5NnTlEn1ZD+857uOX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243255, "uuid": "e78eec6b-2478-438e-bd01-490e9b906b6e", "value": 942315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243255, "uuid": "665698b3-af89-4be2-bb49-f17f8d97a5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243255, "uuid": "e1df8eb8-bdd3-47f4-80f8-e16bfbbaa3a9", "value": "c5bd3bb48f8f12752ec7ca5318b38074ddd83beaccf9795a9e9d389e0b26c682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d5400e-4acf-11f1-a769-42010a9c0008", "comment": "Malware payload (AESCRYPT)", "timestamp": 1778239131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239131, "uuid": "b7ead541-3a71-4703-b870-c1b86fba291f", "comment": "Malware payload (AESCRYPT)", "value": "92203afb811364033d4577e8213509d3", "object_relation": "md5", "Tag": [ { "name": "AESCRYPT", "colour": "#D6928C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239131, "uuid": "8c401ed5-0f80-49db-a2c5-fdbd35a5e1ef", "comment": "Malware payload (AESCRYPT)", "value": "c67b59844d938681a8ab3fd2f48e332cf63c266b7fb03c196b3eced2bc4ff2c5", "object_relation": "sha256", "Tag": [ { "name": "AESCRYPT", "colour": "#D6928C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239131, "uuid": "eb162d0c-b497-4bb0-b846-95f9c08e5029", "comment": "Malware payload (AESCRYPT)", "value": "3b2b258d08d94cf3af98de062f9ac805974dd937", "object_relation": "sha1", "Tag": [ { "name": "AESCRYPT", "colour": "#D6928C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778239131, "uuid": "8be89a63-35db-4495-a753-ae6f5bb8ed87", "comment": "Malware payload (AESCRYPT)", "value": "52a9b922d143208691d95750491b379ce17541f9861f790a230c4fa7302d39bbb235a26bfc7ef779a9f10e4bcc2196c5", "object_relation": "sha3-384", "Tag": [ { "name": "AESCRYPT", "colour": "#D6928C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239131, "uuid": "425e19f7-58e9-4bd0-9733-1c5cc8e9e56c", "value": "T150C5D09D766072EFC86BD472DEA82C68EA50347B831F4603906715EDDA4D89BCF640F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239131, "uuid": "d809e2dd-3ab9-41b0-be3b-a20dc59599ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239131, "uuid": "5058d5fd-2727-4cab-b385-0c2baa657d94", "value": "49152:d7Xq4LXtKdd2BJuS5VEitsGetV8SpvysVmzt11FOpScfGlLFzGq8tIs:dTHGd2BIwE+sG4XcB7FOpxAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778239131, "uuid": "93eed94a-f82f-46d6-b293-84b8934a6f46", "value": 2729984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778239131, "uuid": "dda83cae-3237-463d-a794-c999b8ba07d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778239131, "uuid": "d25cfdad-d873-4b9d-ae17-16be9bdb355d", "value": "\u2564\u00fc\u2568\u2591\u2568\u255d\u2568\u2557\u2568\u255b\u2568\u2551\u2568\u2561\u2564\u00c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d02f23-4b0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778265098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265098, "uuid": "91f1108c-260b-4053-ae73-b21498cc41b1", "comment": "Malware payload (Mirai)", "value": "2808c8428c6c5efa13a3c2d0daeb7d93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265098, "uuid": "ea4041bf-e177-48c6-91c3-9ff39a53a2e3", "comment": "Malware payload (Mirai)", "value": "c7329170f9c8bdc1e77ccfe68711366e3c52eaac041f143b424d37e0b91cdff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265098, "uuid": "21111976-b50d-4d80-a319-1a02f63f0782", "comment": "Malware payload (Mirai)", "value": "c71de2fcc7036d2404f0b93adf122c45d26c813d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778265098, "uuid": "f00822f0-b1c3-49c5-98e8-6af77b325feb", "comment": "Malware payload (Mirai)", "value": "e09c0e41fc352f080564a22c7829d3ad51c2c846d819c2de505962867da294f052c07a32adecfa4ac457b5c86e5f7b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265098, "uuid": "5e022c7b-c78a-481a-a683-717b13d1f3a4", "value": "T19FE31945F8814F27C6C612BBFB5E428D3B2A17E8D2EE72039D255F20378A56B0D7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265098, "uuid": "3ccb01c9-5534-433f-8872-47d15ddd669f", "value": "1536:cQh7kI6GwUu3TjyDEx4mWrLfdQd5dh2TVSI4VnUb7J2OT2yw8zyggBNtl5Vwywvs:cQhYnxEXfaTdhwJ46bkOTr7k4ZXf05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778265098, "uuid": "1cbe2f4c-c301-46ad-a96f-105ce13a2c73", "value": 145984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778265098, "uuid": "5e95ebbf-ffbd-45a0-a991-2e7b84a9ba14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778265098, "uuid": "5999314e-b02e-4913-9593-af82b21fa7f8", "value": "micro.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41058e6-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243511, "uuid": "590573d6-187c-434d-a6d7-92d48ef71c00", "comment": "Malware payload (PhantomStealer)", "value": "d377cbda669f240534fe0662938c9577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243511, "uuid": "049207b6-c9e0-4591-8712-1ca0f89a2554", "comment": "Malware payload (PhantomStealer)", "value": "c7af8085f78ffcf5ec035b8d91cb142f7cba5adf045e25e1c39ef96e8329b9c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243511, "uuid": "772929f1-2986-4407-a1f9-b2003bea78db", "comment": "Malware payload (PhantomStealer)", "value": "58e9c1750fc1f45e42ddc47014a8e65409a4c72f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243511, "uuid": "58859acb-8005-4d0f-885d-ddc9ac594166", "comment": "Malware payload (PhantomStealer)", "value": "4bb9ea87640d6a39734282ea6820f21bddb943654037b8b39cbf811210690cd74a08cf257cb704f2659ee1966c94a952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243511, "uuid": "5954e4b9-f57e-4d26-9c86-0c2e01984f65", "value": "T11C7512852719EB02C5A29BF41D70D3711BF62D855812D323CDF6BEEFBA39B04A904693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243511, "uuid": "19ec8281-43f8-4560-9830-bcb8bb40c26a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243511, "uuid": "6effdfe5-5a4a-433b-8f48-ab718e2edb00", "value": "49152:ujEboYnp3cEbvtviLhdRD5ix/4PJtIg2qF2w3I42uHtqUw/:cEbbnWkvRAPRD5ixAPJZ2MwuHtrw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243511, "uuid": "32332503-d4b8-4dc7-864a-b496f6fb000f", "value": 1700360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243511, "uuid": "02432f51-529f-4054-91b6-53a615306c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243511, "uuid": "da520444-bbb0-4959-bab4-f06c9aec5b21", "value": "c7af8085f78ffcf5ec035b8d91cb142f7cba5adf045e25e1c39ef96e8329b9c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d057b0-4abe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231566, "uuid": "0b7abc2e-8e0e-4eb9-b0b5-d440c828f669", "comment": "Malware payload", "value": "a249b1e8c51acc0047e34171e6cff812", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231566, "uuid": "67dc054d-d52d-45b0-8133-64440bbd2c92", "comment": "Malware payload", "value": "c7f225a9f54d7b83865a2885872c082722ecff638a1b2779e56013c31c46ffac", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231566, "uuid": "a9034d09-2d8c-4881-b019-559f75957fbd", "comment": "Malware payload", "value": "fedb0301440d48a609aeb96cb585f3a0c9cdf6d9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231566, "uuid": "02a2af9a-d4a6-433d-bed3-21f44ff00af6", "comment": "Malware payload", "value": "ba17e84dbac70c500dac0febe19354f1214a2265f134f6c7206abb15c97632c53c67db75a607e8236f0bfbddb4f5d418", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231566, "uuid": "341a1320-8e3a-4814-bf7c-cb3f87ec640e", "value": "T12107220BF308A86AD9F75336BD36436BA4171D254F43C6876860723D6AB76C04B6EBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231566, "uuid": "71feb159-7978-4a1f-8489-86c8d46b8118", "value": "393216:s/fxTqZALTfn2j6V3l9gnzjI1sHkynVae7:s/fxWZALTfnT9gnzHki4e7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231566, "uuid": "c94177b1-f1f4-4311-b9ad-561cc7288f1c", "value": 17347236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231566, "uuid": "eb900b04-5ebb-4777-afdc-fa9ce066dbcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231566, "uuid": "3c0ce836-e3c7-410b-b5ab-d63ddbaecc96", "value": "iMobile Lite (39).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171b6a6-4b35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778282726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282726, "uuid": "36b85f80-37d6-46a6-aec2-972a940826a8", "comment": "Malware payload", "value": "3a764144f10b1ba4563d1786d88545b9", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282726, "uuid": "f2f65c17-a157-4c29-91df-52ed773418cb", "comment": "Malware payload", "value": "c7fd854a95f0e1c678a4fa9562c6099d7d8053abe15cab6e7129390dd69d7e0c", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282726, "uuid": "6c72bd0c-21ab-462f-8c94-33d6391750e3", "comment": "Malware payload", "value": "6e7f7582ed2dbb2080f10791b39ebbd1bc88a90c", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778282726, "uuid": "84c726be-a101-486f-9675-1ef149c15527", "comment": "Malware payload", "value": "58c9f639128d3f5020309d66a3dcc0b4355c11b8c1d36275c0dbfaacd9badf67a1a6bb180705525b8ea1ffe82925a0a3", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282726, "uuid": "09d4b33a-8e9d-4a78-80d8-3a8b730987b4", "value": "T14B62FA35D2DAF594C79E33B164F2E1C203E2C64BCE660B5DF54C14616FA0B54EB6194C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282726, "uuid": "f5fbdfec-ce18-4dc8-b520-6cc101cb67ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282726, "uuid": "095d468d-eaed-420b-acd0-1f94a9dcd5c1", "value": "384:Qz57Ngy0Rml4ZhU74b1Pkb/mP43DioRrlkzybshYuzUKhA+uG:Qz57Ngy0RKPsbFTW+ofkzyghxzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778282726, "uuid": "8d98a6f6-f182-4687-b5ab-36971f91277a", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778282726, "uuid": "a5092732-2059-41d4-8d0d-bc863f7e9105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778282726, "uuid": "33706779-d42d-474b-a405-7f2ece05b9b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1120a5-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246830, "uuid": "48db6a0a-dd75-4598-a7bb-562a98408a38", "comment": "Malware payload (RemcosRAT)", "value": "0f9ef0432e0e9f3d8f0d85b28930f64c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246830, "uuid": "16bced61-40ae-4601-a541-28eef159d941", "comment": "Malware payload (RemcosRAT)", "value": "c880e37d701bc7d79e8ef816a9804cea99ff1254da9d67596dfa89b0824e97f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246830, "uuid": "020ecfd8-e25e-41ab-a281-45175a6d3ab7", "comment": "Malware payload (RemcosRAT)", "value": "9eeb9833eacd4ae7fa97c137b5b2a7da5ace0091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246830, "uuid": "a9fdb371-e4b5-4a85-bf96-9f9874e38fa8", "comment": "Malware payload (RemcosRAT)", "value": "0679c3a1171016fb36659331680ad90f37deda8a3b52076eb3969cff21b5bd4ab35c8e4b949c6e7f32ce42a813b7338e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246830, "uuid": "baeabb2b-b9e3-4c7d-960d-20547ec39b80", "value": "T1D884E8D1E3CC8896F0A798B348B79D3255B7237C98A9851E255D72326FF334210ABF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246830, "uuid": "fa5de1a3-3e0d-4aad-92e9-ddb2dfd1d118", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246830, "uuid": "850c247b-3d22-4ae5-bbda-be8d113515d5", "value": "6144:QNeZT+QIY0I0ZtNeJyjBc9pduS+RW/wo3oD0ozA6Jpo:QNmgYDC3tjBcLduSIW/P3+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246830, "uuid": "c08cd6ae-7a25-4c31-a902-676c142f2790", "value": 393046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246830, "uuid": "a02ec805-c8e9-489d-952a-df8cc79d57a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246830, "uuid": "56ce161b-cb15-44b1-8790-090140541e3e", "value": "c880e37d701bc7d79e8ef816a9804cea99ff1254da9d67596dfa89b0824e97f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81056e6d-4a9a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778216287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216287, "uuid": "56841a79-ee7e-405e-afd8-3672e13ff77c", "comment": "Malware payload", "value": "654ff3aaafb9a97531ba77bcd1bdfccd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216287, "uuid": "7c161a9c-ea1a-48f6-88e0-11164a4a8b2a", "comment": "Malware payload", "value": "c95a298aab7d7382955b54456e47c09b3820438292429105c7c4f68f39351141", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216287, "uuid": "35a6833a-aef6-40cb-bf35-2e176d411ace", "comment": "Malware payload", "value": "74ec11f77ac52065848bb2b6faab8fc3e44d2924", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778216287, "uuid": "977a4a5c-10a1-4ebc-a75d-598eea7fc67a", "comment": "Malware payload", "value": "725e3d561a009e970cbda5f954296c7249bdcefc17b61ee20cd6c9d633df8dd333ac013fdf1775ba9a7ca69c0cc5f6f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216287, "uuid": "fd131915-0f83-459a-90af-c02f8cb4356b", "value": "T16C737C013690C473CA4F56756495C7B2AEBE6D505BF0808B7FAE0B7A9F603C2673931A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216287, "uuid": "e06b417e-cd2c-43be-aa67-f9413660cea7", "value": "b04393022fffb1a5237a1e9ffd54599a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216287, "uuid": "197a8e4e-5720-4475-b745-f78069b6e51b", "value": "1536:CGIQYzri48BrbPHMeWJnQELCp4m7/j7/:CGb48hLMeWJnQE+emjjj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778216287, "uuid": "8dcf2e2f-6977-4273-a193-79c56c080bd9", "value": 78872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778216287, "uuid": "8851c4d6-434a-43cf-9fd8-aa55288aba19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778216287, "uuid": "e4d77deb-2362-468d-8002-937b2025214c", "value": "datastate.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce9b367-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1778246774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246774, "uuid": "8bc22604-49dc-4ff4-9819-bfc45f47ee19", "comment": "Malware payload (a310Logger)", "value": "10d10d1c5c446bfa4d5437d9abbec35e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246774, "uuid": "5ddba5fc-790c-4e90-8e45-e2e8e80f2729", "comment": "Malware payload (a310Logger)", "value": "c98c46ecebd503697024187bd110348448c9d25611a558df922114e5ce7a6edb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246774, "uuid": "dfcc2276-8772-4e7c-918d-3ea2a2c1ffdf", "comment": "Malware payload (a310Logger)", "value": "3f53674d40808a4c9bd4a743bba55bdfb9f85a60", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246774, "uuid": "3b960700-4171-4fce-a52c-2a4d52894f39", "comment": "Malware payload (a310Logger)", "value": "8f16f12fe67c89ca02353049c4f71e55470d23921195e20a8fc93e65e0baaf48f55de8ace7c1fe86317432b60f002651", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246774, "uuid": "b5e2dfbc-df05-41c6-9275-165cae668895", "value": "T13555129C6612DB17D9286BF84972E03407B85DEDB901C3469FEEADFFB529B084D48213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246774, "uuid": "e6f080bb-879f-4f18-94c4-d7df6f20c4dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246774, "uuid": "493d5be8-60df-471f-9cf3-2ef542eec875", "value": "24576:FgKOJndC6Q1L3AtY0HcorMyU4swaY96/TLYAD:vOJkHwu0ZrMyUbHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246774, "uuid": "a695ea5a-8994-472f-8230-e5a4557ad921", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246774, "uuid": "bc6252ae-70d0-4e73-88ff-aed25c0d8b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246774, "uuid": "9ba9cd6d-a14c-420e-82fe-62fc35e54b9d", "value": "c98c46ecebd503697024187bd110348448c9d25611a558df922114e5ce7a6edb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90e0d9e-4af7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256351, "uuid": "0c591b17-3c46-41fe-9880-7ee7c377bf6b", "comment": "Malware payload (Mirai)", "value": "cd4b3212a77da0088bf917f1701bcfcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256351, "uuid": "ebb16109-d5ce-4c47-a5af-a51df2fc466a", "comment": "Malware payload (Mirai)", "value": "c9f5b36208c8903b735ca19ad9658ed924a6155e45fc7dd6d64aeb4dfc4a29c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256351, "uuid": "5ea0c8b6-28a8-4b40-a4e1-b0dac66ab00a", "comment": "Malware payload (Mirai)", "value": "00870472bfdaaa93f6455250b45b77001ea5d016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256351, "uuid": "37edb0a6-224c-4ea6-b41d-699c65d9b780", "comment": "Malware payload (Mirai)", "value": "12910ad5785fa98933c728d9396e020a019678eec7a1106e1ecc936d45bc18bf945bb701b37ab08c89a1e4be60f77757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256351, "uuid": "6a3c1db6-e7f8-4c2b-aebe-26eb17749e81", "value": "T1E0C3189AF8825B11C5C706BABA2D518D331613B8D3DF72139E10AF64B7CB81B0F36956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256351, "uuid": "f258ad58-9c18-420e-80a2-20209df09a03", "value": "3072:ywiKZtpMK2Tfcx20alA09WFmYOMwbZnI:ywicMPfcw0aagEOMwRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256351, "uuid": "d2a26c63-c9ef-464a-9928-30eddac9975a", "value": 128532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256351, "uuid": "ba6631d5-196c-4ac8-b369-bebd62e9f14b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256351, "uuid": "2931fd56-fbd2-413f-8f6a-3bb87d8a069d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cacc0b4-4ac1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778233084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233084, "uuid": "e9be44fe-4545-48a7-b3f8-bdbb48377ea4", "comment": "Malware payload", "value": "be58fb77961a3bebe6263a57122b64c8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233084, "uuid": "a30ca4ae-1358-4401-a17b-b4a06d58a034", "comment": "Malware payload", "value": "ca2e505a14391d0455ea1e007531a7c9c4c56dada2e1e185257a0be843e1745b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233084, "uuid": "eeece733-edd4-456e-965a-f6d35e865a68", "comment": "Malware payload", "value": "6942c259cba7e08ddd69573d0d2e8c112938a27b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778233084, "uuid": "b6219997-8a3c-4937-9b9a-bb36ba52536c", "comment": "Malware payload", "value": "b40d69bf22ffec1f5dc13c2dff6a92b90794def4c277255bd1bdbc396e0ee4d43240fb3aa87dd995a4c3827c51f5874c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233084, "uuid": "3fbafa8f-fcb9-4165-96fb-81039e68f028", "value": "T10007CD23F5096996CED6A131F5E347A532341D580793A329271FF026FDF21CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233084, "uuid": "171d096d-3a19-4cdc-acca-7b0cb39431eb", "value": "196608:XhjJoGbVWORIGg9cQ7x+j1b5nq9SLiH4+TwnpiISk9bHT4BunE3gx246+f1GCYgz:RjJP59Qk9q9E+Kr1z4BunHEg1Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778233084, "uuid": "f173cbd7-afa1-4471-b06a-669b46ba7e07", "value": 17888833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778233084, "uuid": "b8a45deb-6d6b-4efa-be09-d2d03724a1e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778233084, "uuid": "bf6678c9-3cb7-4a98-af4d-5441c673ef07", "value": "iMobile Lite (46).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f6f0bd-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246332, "uuid": "fdcaa985-659a-4c63-b36b-1db2a7b33a78", "comment": "Malware payload", "value": "08a51859bc320a986d6d2e72701221ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246332, "uuid": "dd97f281-34ce-4aad-9425-3351d7e20e97", "comment": "Malware payload", "value": "ca6b68f97a7a8bda5d1ab6077e6b5b7b55297f34273a220ca924c4d52ba5b5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246332, "uuid": "4aa29c04-f5cb-4507-b2c4-8efc6cb723c6", "comment": "Malware payload", "value": "03815e13a81c2f279886c95fe304c73446ee55f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246332, "uuid": "03bfeedc-4cdf-468a-a244-3c66af398a62", "comment": "Malware payload", "value": "ade53c9c9b25b29d5c22d1ee7ad132b83503c03b8d418b988acd3174fe1700d65df3670d2b0f027b30e8272299a6d659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246332, "uuid": "c66b4496-7541-4f60-989a-2a741c13e2ab", "value": "T16645CF1363DE8361C3B25273BA25B741BEBF782506B5F46B2FD8093CE820162525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246332, "uuid": "a6f7e1de-46e7-44bd-9a93-d23ebbc78fa1", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246332, "uuid": "95c3b8cb-74b3-4370-8e22-a45f645fb3c3", "value": "12288:qtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaNT0HP4fxrB3BCgi6x6A:qtb20pkaCqT5TBWgNQ7aJ0vOxlJ1x6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246332, "uuid": "adab6149-7d9a-4404-9619-b2d8d4f57d5a", "value": 1181696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246332, "uuid": "2804ac82-3e8c-4652-a69b-36a7693d79be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246332, "uuid": "421431f8-c12a-41be-84ec-8be604b60e60", "value": "ca6b68f97a7a8bda5d1ab6077e6b5b7b55297f34273a220ca924c4d52ba5b5d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c90794b-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778242855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242855, "uuid": "392c42c9-8b79-4d51-9bf5-760ed74f7aa4", "comment": "Malware payload (AsyncRAT)", "value": "26cd300e7731c3f98bfb4d24e9ef69a8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242855, "uuid": "c832658e-85ee-46d8-afd7-34437829a284", "comment": "Malware payload (AsyncRAT)", "value": "cac4102c30b7fbf78eae1656ffecf1542376a69a28fe6c9f104113dd1b7f4e37", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242855, "uuid": "bcae2a95-aca3-4931-8ba8-0b83d27aec50", "comment": "Malware payload (AsyncRAT)", "value": "58ddd91c9ee880565cff4841f88776e2bcd1761b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242855, "uuid": "9a7b1b93-6589-40c1-a803-ee8a35f59830", "comment": "Malware payload (AsyncRAT)", "value": "caae4e9e159ef50f9a95d094fdfa93441e24492fd237ebaf507943ccf92e85a1abfeaa322419a2378b85ae0b5b7b9a86", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242855, "uuid": "758ebf54-4385-45b5-840a-f599ff21c88d", "value": "T19A05F14412D9EDC2C4925FB00D70F3B017649E98E821DB139EEABDEBB93D652383519E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242855, "uuid": "ee2a6f75-0751-41d0-8297-6eb3178bb53d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242855, "uuid": "38ee8103-e781-490b-8c48-64ddc41baa84", "value": "12288:sooukFvLGwKXAaIVyKSnfgSL5xaVY5Jkn/CXVKyxdCS7JMLzBP/QBfXtJ7YG1hEX:9kOAStfg4xuE5jxdC4E+NXoGzsUyQU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242855, "uuid": "d601ea81-2550-4eee-adbe-7f14c26f55db", "value": 852488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242855, "uuid": "3c68e908-6d3c-4871-a878-42cc67845fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242855, "uuid": "8a9f5f15-515d-4cdc-8043-1baa92879801", "value": "cac4102c30b7fbf78eae1656ffecf1542376a69a28fe6c9f104113dd1b7f4e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f3b22-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778246191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246191, "uuid": "cc414599-d1ab-4ae9-bc0f-176e2f0630bb", "comment": "Malware payload (Formbook)", "value": "5276ea9b6eeb20d4163deacadf98f3a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246191, "uuid": "7ec0ea0e-727c-4dc5-80f3-aaafc2f7dc8d", "comment": "Malware payload (Formbook)", "value": "cae269e0773f6380ac77c208b29e434c52f47f48bda04576e73f4925978bf000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246191, "uuid": "c5c6357e-0afe-4e01-97a4-9f126bfd059b", "comment": "Malware payload (Formbook)", "value": "44528d7deeaeb4aabd6308080159f9da8b7d5537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246191, "uuid": "f0c2755c-5dc9-4b2c-9d4c-8a936be279e9", "comment": "Malware payload (Formbook)", "value": "f1c801a5ad7b8b4268649e8cfc221c13cb2e2a5cf97e3f2fc2550ea0eaf5d0983fd8dae7d95843af4280f50762a722ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246191, "uuid": "52389ff6-2e3a-4333-ae21-dd9bf4ff9660", "value": "T1983522487228EA06D8D52BB85CB2D2B013747E9DAA31D4039FC9BEEFF139B294515347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246191, "uuid": "5d40bb53-b186-4ab6-9446-89371e105607", "value": "24576:CTfLPgfJYjXP3UyjoX3ESZ82TdPgKEFTExbVym5tA4KrFuqufFEVX:CgIf357S+MgVVExVrtAppvufFEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246191, "uuid": "e9a61a17-2dbd-4858-96a3-35c6e3e84935", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246191, "uuid": "405e5b48-1b1a-4245-a7c7-6fc59ad039ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246191, "uuid": "5652290e-031f-40a4-a86d-ff85df5d4aae", "value": "cae269e0773f6380ac77c208b29e434c52f47f48bda04576e73f4925978bf000", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b683415-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778242880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242880, "uuid": "511c0e1c-115b-4b6d-a3f5-b1b2473f6dd5", "comment": "Malware payload (Formbook)", "value": "36079f78a7ee64959cbb57304d5b5dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242880, "uuid": "a56656ab-4130-457b-8ed7-ed7b18b881ca", "comment": "Malware payload (Formbook)", "value": "cb70357549841be383d38d9c155e6cb95b46c1711f7e67c8a2274d1166a3a538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242880, "uuid": "0b3b798d-6ea1-4d3b-827f-5508092fcd59", "comment": "Malware payload (Formbook)", "value": "061d3d8a423f3fe5cbb6d217c30489d74518d8d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242880, "uuid": "48fb9bf7-3ab5-4057-a24b-11da7250cb96", "comment": "Malware payload (Formbook)", "value": "09dda16a4350f6819029a74893444211cad84c2757299e7e52ac8e010d8d6fd90d638b52668b8894871a55536f6ae88e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242880, "uuid": "5a8d32d9-2098-46ea-a010-502a0510edd8", "value": "T1143502982316E903D4922F744D71E7B807785D98A812C3578FFAFDEBB83E6566C041E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242880, "uuid": "02920bd0-f953-4106-90c9-785624699156", "value": "24576:WcoOASlA6yueWOd/g2UHPEC2UwfW3Vvan88GUvAgwC0r:WcoFSlby1HCEC2Fu3V8BGUvA7Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242880, "uuid": "c15fe73f-613b-485d-988d-6e6d76e4f57f", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242880, "uuid": "05a4444d-4d0c-4374-a9d2-b78b98a347cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242880, "uuid": "9a076df4-278b-48d9-8596-0ec902bbbfaa", "value": "cb70357549841be383d38d9c155e6cb95b46c1711f7e67c8a2274d1166a3a538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b2a505-4aaf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778225509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225509, "uuid": "3e188727-49f4-4099-aa72-ce8ce2d8cc6e", "comment": "Malware payload", "value": "ed938584c5d8ac31fbac0205d725786a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225509, "uuid": "01fd1f8b-b655-475b-b7a0-11e25e8cf6a7", "comment": "Malware payload", "value": "cb782661c7ba1e2ed9e7fe86e5402043a7aeb90fcd4ef038cd09290ffb4ceee0", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225509, "uuid": "cf911938-2146-4bd8-bbbe-47185401134c", "comment": "Malware payload", "value": "d24be1f7a615c07705d79527106679bc6ebe6df9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778225509, "uuid": "95c00199-c73f-4eff-bc05-3048c90887cd", "comment": "Malware payload", "value": "7dee20577af83f13aea6fbb7fdbe72ff37cadf2b40b241ca71605bd81e32611286503f7cbc43f33bb7ac8c4786158905", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225509, "uuid": "3392f853-b5e9-4466-981e-fa9d87739f1b", "value": "T18BE5BF05A3C866E9D427DA78C714A332D2B2BD224B76D08F0A9AD70A1F77D914F3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225509, "uuid": "1bdc2ee5-13b7-4251-9f1f-34daf0a29fd5", "value": "f418e835c2fb79101e806fd56041f826", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225509, "uuid": "82a763ec-264f-4a79-8544-d78212ad97d0", "value": "49152:eIe9CapMRi3WpvRAT14usssbeJJR7CJlZpKRYVqVO/xwEHFdz1h0NBrIECtXMTIw:3HJOOKRYVqVO/xwEHFdz1h0NBrIECtX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778225509, "uuid": "6a9704dd-894b-4c35-a470-839bc546fa27", "value": 3123712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778225509, "uuid": "3c7dd9e3-c04d-4bae-bd71-8f50fb5f2d10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778225509, "uuid": "13812526-22d9-4921-8fec-d7eeb28b7d5f", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89ace48-4aba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230151, "uuid": "dcfd2c7c-b7d3-4f94-96fb-de6115e9dd56", "comment": "Malware payload", "value": "4ed5b237f4d6bd8119305e0ad8b4224d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230151, "uuid": "6b85bd1e-41ec-402b-83df-987905f456eb", "comment": "Malware payload", "value": "cb87eacbbf45be7fe7fb89d4370a5089626f7037016363e29a5ac9dfa35e38e5", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230151, "uuid": "36613a99-503d-43bf-8986-37207dfb56a8", "comment": "Malware payload", "value": "d3b9aa7e99264db97300ec3c8606d2acb8ff1d5e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230151, "uuid": "6941285a-ee9a-4e4a-8a81-ff3932a0de66", "comment": "Malware payload", "value": "c68815030c8455c58262e62112a29e1372493a2a86b7964532b87955cde1985282c7357211d2e4402158b8bd457b149f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230151, "uuid": "2d49eb71-56d8-4700-8fe2-396f14cd1927", "value": "T1EEF6121EE648AD2FE8F7E3347C36466224255C698F03D58B7838B63D2DB74C94B962D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230151, "uuid": "8a9172b8-3d05-481a-a04c-b850031dd133", "value": "393216:SbTMkfCL144Cq0fpuFpNnkt7SRBAN5+XLq:t1PCq0fUFE0BA+XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230151, "uuid": "a70067a8-0efe-41d6-9b90-a31cabf0c372", "value": 16242430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230151, "uuid": "1d68e669-6b43-4f5b-b1bd-99bd193995d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230151, "uuid": "ce6c0d12-64e2-4238-8f4f-49ed0d7e8bcd", "value": "iMobile Lite (25).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a33fc3b-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244220, "uuid": "e47a723f-5a60-4ff0-902e-bfbcf3953262", "comment": "Malware payload (AsyncRAT)", "value": "384abb3d0e838ede58a0d7d90045eb0d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244220, "uuid": "febaed44-2262-468b-b63b-844d6472ef0e", "comment": "Malware payload (AsyncRAT)", "value": "cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244220, "uuid": "2f3d7549-e469-4722-86cd-16f84d7f3113", "comment": "Malware payload (AsyncRAT)", "value": "294dd97ad7d7de4b1506556ad643458f3b811c03", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244220, "uuid": "9f3f1072-c64d-4ead-a2d1-60d7c7e6c138", "comment": "Malware payload (AsyncRAT)", "value": "06a0671cb026b453256506256262fef9061c8b45446c4affcf03d6397946beea6c2aef8ca2750b46b76b6d6e1c9cafa5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244220, "uuid": "f8fca6fb-69e8-4204-9658-872bc74c2c53", "value": "T1EE050114A629CA02D8E547F40A61E3B513B44CDDA921D3078FFEFDEB787AB0A3509653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244220, "uuid": "be0f18a0-97cd-4020-8869-5ed652b3560e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244220, "uuid": "41b8a923-99d3-446d-91cc-18de9fca27a7", "value": "24576:v8+v91z4XstSIDmFiVqFlWLylIvESF3hu2Qo:Rvv4XstSIKFBs5vE8VQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244220, "uuid": "20ac2ba7-99d1-4a84-9d81-79463a175bdb", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244220, "uuid": "433bc1df-00bf-4944-9038-a7b38eb02f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244220, "uuid": "d9163031-8c85-4c45-960a-8d6207e45468", "value": "cb90f55f8558abb13b7480d61fb30341df3f068250d7e13d8bfbc6419a36a4a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5a6845-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778243960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243960, "uuid": "019f9c47-06d9-47b4-84e2-01683d896696", "comment": "Malware payload (PhantomStealer)", "value": "3e00367ce492be1be95163583eb06b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243960, "uuid": "338c069b-4472-49f9-98c4-e1128a0b8fa7", "comment": "Malware payload (PhantomStealer)", "value": "cbb7c0efe21f2608e505c657bd65e1921ab6ec7d05ba8531387b28d3857a719e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243960, "uuid": "e85f57bf-4d32-4a9d-9bee-edaa5f21f1ca", "comment": "Malware payload (PhantomStealer)", "value": "d1a3d6c7b856f3ca654d7a2a1b206567034fbc30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243960, "uuid": "a38e040f-f877-44ea-8dda-d1fb2f3a2f67", "comment": "Malware payload (PhantomStealer)", "value": "40c7deb1f0f363484c04a68a23df2cf102e21dbf53a41f5f511888c3cb77d810100b4c5ce40f982f8fc2c7f2d9671da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243960, "uuid": "c162c421-57a3-4152-b014-5bde33123be2", "value": "T1F4652269679CC802EDE917344571E7B113B11DCCF901C35B9FEDBDEB7968682B808A82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243960, "uuid": "05fb3a1a-0620-46f7-8887-cc480a1eba97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243960, "uuid": "b9ec30e0-41c3-43bf-8154-1f39c2375989", "value": "24576:NYYDnR8+v9x6aLcYSyqhBrIEptDvRGUpLwVPWOJUsIFQdkYxzenkJ8YBSNNIi/pm:NYYDLvz6aLcYNgaQvUUpLQTURYLq2i/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243960, "uuid": "da33b764-5339-4804-861a-4064f80d4c1d", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243960, "uuid": "41010000-3647-402f-9a40-e21264c6514a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243960, "uuid": "be20984b-4545-4267-bd6c-5cf2a3749bd8", "value": "cbb7c0efe21f2608e505c657bd65e1921ab6ec7d05ba8531387b28d3857a719e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168fdb87-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256481, "uuid": "6ced2e69-a7b1-41b2-9564-52017a85b5a8", "comment": "Malware payload (Mirai)", "value": "0ded9d297d33b2cc79d7960e120ddeee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256481, "uuid": "3dd32443-f4b6-49d8-9134-290c1a707c66", "comment": "Malware payload (Mirai)", "value": "cbfb83b43787208fbdcb28f37d9a21dd7327192e64ddf6ff3d912f1b71abcb57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256481, "uuid": "6e70299b-0e9e-4439-82fc-88c8769d8d58", "comment": "Malware payload (Mirai)", "value": "22cc6c78376088189dc57195d0f7d8422c85b531", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256481, "uuid": "4dcb79a7-16af-4487-9af7-c3c93e9e8d56", "comment": "Malware payload (Mirai)", "value": "053598c2538740390a01dbdac7f5f2e45742839f80be0c50779ffd1f7fc29860852f98bfc908deb6980e368d61533ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256481, "uuid": "73ecdffb-4681-4225-996c-4689db76f443", "value": "T1FDB34A0277394E03D1A31FB02E3B27E477AEE4C221B0F545299AAF5E8179A335945ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256481, "uuid": "60de67f6-7b84-40c0-a941-af7b6caffcb0", "value": "1536:OWJL9aYbBqwreLgd6uKaP14hJm3eJRvFh2tyRhIwjSjYB4wrXDwZwbZnlf:OWlwmqwreLgzyY3eJ9lhIOSVfwbZnlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256481, "uuid": "989491b4-2848-4573-9ae6-fe037c1f4acf", "value": 116368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256481, "uuid": "ebace8c6-ea16-4a3d-9746-cab2819306a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256481, "uuid": "a33992d8-dcf7-4e4c-99a6-c8a571706b75", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01126c70-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243990, "uuid": "0c40ffae-4227-46ad-898d-e43171fd65fb", "comment": "Malware payload", "value": "0538f351e118e325fc7858465a745856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243990, "uuid": "d4aa5b72-edf1-433c-82ab-75f31123ca3e", "comment": "Malware payload", "value": "cc2cb72a8485e5a9f8b411a80bd6a15d78660434659e31abd1ce79c737f52305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243990, "uuid": "1b997604-de80-4604-b0a3-5789396a84f4", "comment": "Malware payload", "value": "bac90fcf1e729b29e99242f578fd9de39f53595a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243990, "uuid": "421a3590-747c-4c81-b1ed-55d89f53e982", "comment": "Malware payload", "value": "baf906f3d0d4729bf347730617a89c2f454fac8938b5fd94aeba864f01c4b49b34958c9b53dd6fc6fd738d9392971798", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243990, "uuid": "585b5ef0-eb67-4963-96e0-6bbbd4c5cb17", "value": "T195E31256EF90FA37D16BA23634B20E8248B2F765BD268F3F8DC4443A0E132D11687765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243990, "uuid": "d6f073d8-ce18-4437-906e-dded9caeb683", "value": "3072:CEO3PkRMZbcgp/D2qTnP6es7B+51EKXmmZb0zCJyaNV6vaAdoX:CE3CZbb2qTnP6esUXZ10zgNQaAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243990, "uuid": "e51dba30-4d52-4cbf-8ee7-3258aa01a2e3", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243990, "uuid": "7b5752cb-e61b-448f-b499-49dc51d51d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243990, "uuid": "cf4dd048-20ab-4098-8b9d-fddf67e8c08f", "value": "cc2cb72a8485e5a9f8b411a80bd6a15d78660434659e31abd1ce79c737f52305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6df828-4af4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778254770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254770, "uuid": "bf73de0a-fc3a-4f2b-9049-97542696e771", "comment": "Malware payload", "value": "890113af94b78fae2f1b0cce707f5780", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254770, "uuid": "6615e45d-244f-4b57-a8f4-eea2e625742b", "comment": "Malware payload", "value": "cc82aca6548859fee85e1d9135f93ecb19c8ec829f01da0694b54c078654359e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254770, "uuid": "39c52e59-1bfa-4900-8c83-899b045ad197", "comment": "Malware payload", "value": "4d8d9eb9b6d8e0ad51b8802dab4ae17e41ab0ffd", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254770, "uuid": "26c3e923-3597-430a-9158-087390d90664", "comment": "Malware payload", "value": "5126a4a5cdb5fca1ca96c5b368b33ef28d95a764a3c224f1c1934c4e9a0a79c4ca1094426112702c33b277d5d3570350", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254770, "uuid": "cff91faa-e454-43e7-bf89-6b3c5c00b7ff", "value": "T14D725C4A973021E34F4E8FAB86A614EBCD54B0B6B1781CCD3D8F5CAE1D352B51A01E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254770, "uuid": "0eaf50c3-e71d-4ca1-86a4-1015146fc32f", "value": "384:OaD1pA8nsXPZPXXaeLAuT+gQghlHuKSroGy:RD3VnePZfXVLAuT+g9J6o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778254770, "uuid": "a2cc29bc-ca84-418c-9647-709d1bdec013", "value": 17560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778254770, "uuid": "4603fc25-5a8b-4cca-a5ce-79f566d7f410", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254770, "uuid": "a02f5342-69f8-48dd-b209-aed2ca4856e9", "value": "css.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "121ad3a1-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778244448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244448, "uuid": "e23194da-da39-48ea-889d-5047589cd8d7", "comment": "Malware payload (Formbook)", "value": "f0b8af99c4ba4ef314365a208d3d952f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244448, "uuid": "128ebcf3-55e4-44a2-8537-dcd3892abf0f", "comment": "Malware payload (Formbook)", "value": "ccf1c503dc69c6d217cfd867a4b1ca9e77b5614ede7cd623c8d8f4f4e3177c77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244448, "uuid": "12df9ee6-2cf7-43e7-aeb3-0a074accafc0", "comment": "Malware payload (Formbook)", "value": "3a96ac3b33e0ebb58985824fbd9dd6e2183f9236", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244448, "uuid": "169e83cf-ef7e-45c1-bbdb-fb36b5bfa74b", "comment": "Malware payload (Formbook)", "value": "a76517428fbcfb6892c66ab3614bfe281e587e0fe6e5738e619b664b9cb8fcd6e825934c4e445d8b3f1e726b1b7ee1ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244448, "uuid": "e55e2843-9d34-49a9-bbc8-4f96e89dedbd", "value": "T1EC35BF027381C062FFAB92734B5AF6515BBC69260123E62F13981D79FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244448, "uuid": "ce5af60e-1205-4fd0-9409-9d564084919a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244448, "uuid": "3fcee31d-6366-4168-85b9-8ed8a2d75164", "value": "24576:QqDEvCTbMWu7rQYlBQcBiT6rprG8aTdLTWdzq0Z:QTvC/MTQYxsWR7aTIO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244448, "uuid": "862a6555-1d54-4171-bb11-21be8b983bda", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244448, "uuid": "ae7c32a0-d9c9-4a3a-b55e-a524f09f372c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244448, "uuid": "d486afe1-daa0-4153-90b1-51794eef927b", "value": "ccf1c503dc69c6d217cfd867a4b1ca9e77b5614ede7cd623c8d8f4f4e3177c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15df9ffe-4af8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778256480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256480, "uuid": "5296bea1-5c4b-4c96-8c46-593df59c75fa", "comment": "Malware payload (Mirai)", "value": "ab1c87e9f7c61a1d3394640985eb2ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256480, "uuid": "b9fcb6e6-fb89-4e53-9ca3-083234d6e643", "comment": "Malware payload (Mirai)", "value": "cd271f2c1f620ddf7ba3bf36b8fe8de1d5f67fd48831b006238c3ad12ef53f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256480, "uuid": "44fc5b5a-b228-452a-baf7-98c4a2c9037b", "comment": "Malware payload (Mirai)", "value": "0772d0f99b229361b453a119683424369e0cb2d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778256480, "uuid": "9dfbb423-9349-403b-9f0f-acd79eeaeca4", "comment": "Malware payload (Mirai)", "value": "a33e9165378988df131658b6d11f092a36e0865c50df9aaa9d9e8ae58909b0b01569b9e107ad134e6cb64b6cf963e128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256480, "uuid": "47ceec1b-cf98-4b66-b1fe-5b761e014858", "value": "T10FB39DA3D1051D64C227413461F8CFB43B62A98642935DF666E2853E904BEAFF23D7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256480, "uuid": "c432b33b-3b94-47ab-93b9-d85e649cdcc7", "value": "1536:TaV/biDFZCYa4Ibs+3/e8l4kBfzskBwcnrdKGECq92pWCEmJ6CR7rXDwcwbZnN:TA+704If/hdzPXnYGm2pWwBwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778256480, "uuid": "39c75eef-4026-4f9a-9cf3-b6be7a082724", "value": 108072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778256480, "uuid": "756727fc-79fc-4511-9564-16e9b3e7ae24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778256480, "uuid": "236c8569-8a8f-43d7-be41-2505d56cbcdd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede544af-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246105, "uuid": "b9d9a285-be26-4feb-b81d-b621bbf9fd9f", "comment": "Malware payload", "value": "f5d2c06e69ff3ab2e6406ad78d23123c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246105, "uuid": "77ebd4f6-36e5-407e-bbb2-feb4b055c286", "comment": "Malware payload", "value": "cd34d0727aba72ba82c256537977dd718cd8593a9a34ec3f2a804add4e54c5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246105, "uuid": "51d03266-8622-4a09-87f8-0de0a2d01f0d", "comment": "Malware payload", "value": "5741902c7f7c6426bf2d90df7f1ed9ce3ea6101a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246105, "uuid": "783cc5c2-3bc7-4c2a-88e5-f6148d7a3c97", "comment": "Malware payload", "value": "75ddfb100826e70f6b362bef4e2efa95bb24af57132e82434a848461f95ffe3383db1e38c8e7da16492ca5d9c5d40eda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246105, "uuid": "02f45794-2c41-4996-bb74-eadbceb0eb01", "value": "T165559D105CB26A5CE52D0BFBD0E2404C2BF09C27D65EDA1B7EF876F46AB3681D806365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246105, "uuid": "1487554d-4cf1-4ab7-ba5f-367ab8f27d0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246105, "uuid": "17392da2-9866-4bf2-b2fa-517fb7ab8a56", "value": "24576:0LoENFfz1+qi5AC/AGMaVvOfuIFlpZn1ztLgej:08EN9zoq6AhG1cf9Pn1ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246105, "uuid": "e23fed81-c7a2-4329-ae2e-3da4ae54cdec", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246105, "uuid": "88200850-ab8f-4921-bc73-0f276a6ff5dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246105, "uuid": "60fce8d1-7f83-4552-9030-786ffe7f9ae5", "value": "cd34d0727aba72ba82c256537977dd718cd8593a9a34ec3f2a804add4e54c5b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c16005f-4ac5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778234640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234640, "uuid": "8c37643c-23b5-437f-8f35-8339977be030", "comment": "Malware payload (RemcosRAT)", "value": "dce62b651ca600b69a5caed45e3697af", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234640, "uuid": "2314e466-c005-45ad-aa90-ee7913a895ef", "comment": "Malware payload (RemcosRAT)", "value": "cde028949663773220906cf05908ad00429ff7359fdc4205006674e9d0ee5c94", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234640, "uuid": "c4bdd579-0703-4244-854b-e89fc4b4fb43", "comment": "Malware payload (RemcosRAT)", "value": "c6a07bf533d8fa9c13b1c642b594168fd6825bea", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778234640, "uuid": "52741298-eae5-4bfb-b2a2-cd8a348ee0dd", "comment": "Malware payload (RemcosRAT)", "value": "d521c238b07c2e5d6346c2061971393efa2125417d345bf0f9ffa2d20345a1ad2bbe41062ccc9a93c3e2cca371a7c4ad", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234640, "uuid": "c8ce8acf-acb3-4fdf-bb48-ef5005908f42", "value": "T1E825E036F94488CFC427C2B07A12DC910B4EAE56B758ABD2342E7B667773E5DDA83041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234640, "uuid": "cc640bc6-adff-4ce4-a9e7-87563778e53f", "value": "24576:m9rVcBeAK3odlz9rVcBeAK3odlPQRK+Zl28j:mhVUnFhVUn123", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778234640, "uuid": "98c5ce17-bb0f-4051-a806-29e116fcb9a2", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778234640, "uuid": "b785ac55-ab3b-45fa-b80c-2a0d6c958c7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778234640, "uuid": "880f6a7c-03f5-43ff-9ad1-c28ef0dbf5fd", "value": "Pedido final mayo 2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4668aba1-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1778246683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246683, "uuid": "00774fbf-20b9-44f2-bcbc-4476e73471df", "comment": "Malware payload (XWorm)", "value": "20ece47d89bb86cb14ec040297c3dfcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246683, "uuid": "9b171aa5-adf1-47fe-b0fb-6b9577903465", "comment": "Malware payload (XWorm)", "value": "cdff0bb80f281addc41f1e78a7326af25d024480cd47536a095d607859132053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246683, "uuid": "86ca556c-8d3d-4443-907f-a1743fa5218b", "comment": "Malware payload (XWorm)", "value": "1136857aeb7065e6c99e10994ca6b84fb5f9fd5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246683, "uuid": "44f165a6-8666-41ae-9eaf-ad9d5be9e6c1", "comment": "Malware payload (XWorm)", "value": "151ef3652c93c14185fac7be2ef8a9e8c49314cae06f76a409bbb5c52e7ec3a4ffc2540ab63175b2368bfb0f3a07f14a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246683, "uuid": "7d9e1d66-3526-46e5-baef-5c047847df48", "value": "T1CC859D05F3E216BBF6A78730C6954336D671F4C013A9EDEB0255A41CAE3B7D26A36360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246683, "uuid": "2af20780-8d0a-4db2-b52a-f3009d8fe74b", "value": "b3fe9ff157cd1279a3c0074c55838402", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246683, "uuid": "72d37250-da94-4ec9-add7-7923e3f58e61", "value": "49152:WmUzGl6vCmQ2IkDdwStD6d58XUx3ZzicXy:fmIAkJoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246683, "uuid": "f9b3c7c1-2d3e-443b-b679-f0e100be8dab", "value": 1805459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246683, "uuid": "4751e68b-4d9a-488b-a173-74d6e4e71e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246683, "uuid": "2c6b61cb-1a41-418e-b243-f5e0e609e4ff", "value": "cdff0bb80f281addc41f1e78a7326af25d024480cd47536a095d607859132053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b280d631-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778246005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246005, "uuid": "b6fa2498-544a-4fd1-a4fe-e4cf9296336b", "comment": "Malware payload", "value": "14af7803358da27b705d69a0522516cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246005, "uuid": "f70b755b-c989-4048-908b-edfdd8c8dba0", "comment": "Malware payload", "value": "ce8e9a597af7bcfb91e0b1ce14755822891a679078b41712cd449a5937b5e72c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246005, "uuid": "33c412d8-68b6-43f3-bbe6-6f1f4c310cf0", "comment": "Malware payload", "value": "60fb39f9958d7693bbd096ea8099ed4bfdc02634", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246005, "uuid": "8238ea3e-35a4-40f8-bccd-cef871b36f39", "comment": "Malware payload", "value": "b921b88364c2bfd95748ec9a7850af040037be391391fcc8f390faa76b3b27b27deed885a1a3f2a2d3d7e74fc1118382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246005, "uuid": "2867ecf0-70e1-45ee-acde-20dea3aef1b2", "value": "T1F3552325F39CDC4BD661297A8CE0E3B159A8FD2909959F0721D0FF0BBE6C1592C8C6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246005, "uuid": "4e8322fb-8cd6-4d6c-a2a4-792a82467457", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246005, "uuid": "91a6b403-0c11-464a-b330-d815c8ed78af", "value": "24576:S4ZXlP795BLLHXJK5aansmsRLr3DwAfh+g83h11rCzBMPi61KCrNt3j:DJlz95BHXUjsTRLrB+B3hnWy60Nt3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246005, "uuid": "f36554ee-1e38-44fc-b168-bcba544538c6", "value": 1354981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246005, "uuid": "d7db8000-6183-4d78-8845-5e090cb1a6c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246005, "uuid": "a05c70d9-ef71-4d38-84fe-84aee6c5c38e", "value": "ce8e9a597af7bcfb91e0b1ce14755822891a679078b41712cd449a5937b5e72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d1f6cc-4b1a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778271239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271239, "uuid": "46d81838-3124-4c3b-a5e8-391dfcaba387", "comment": "Malware payload", "value": "54cb2e6f0b85c9faa7914b2d2b58553d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271239, "uuid": "61d988be-de79-4dbf-964b-ec42878be0af", "comment": "Malware payload", "value": "ceb5c03beb50e94794729dfd07e35f4b745b04f93d835392e5f5f35e46992e37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271239, "uuid": "01ea2eee-a8fd-40a0-bdb7-1a544244a575", "comment": "Malware payload", "value": "38e29205f6dddf04b0578a02cc884a90861caf44", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778271239, "uuid": "c5583d44-4de0-4753-bba5-e345258ed811", "comment": "Malware payload", "value": "5c97aea7cb2f147417bca8ea8065c2295c3b60e524fd4fc92276de869dbcc501743cfc812b53df9e89872157db40a2e2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271239, "uuid": "b90157c1-2c3a-40ed-9a30-19ef6aaa1e2d", "value": "T138137D6956817C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C5969CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271239, "uuid": "66a0833d-4631-4751-9341-430c1b7cda0d", "value": "768:ba+/9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:ba+4co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778271239, "uuid": "f355e38f-b747-44e0-8437-e5248f20619a", "value": 45428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778271239, "uuid": "3b6c64fa-91f6-4c0d-826b-670035f5da19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778271239, "uuid": "0cf18dd1-7173-4c5c-bfcf-946f9398eb0b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e146ae-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246836, "uuid": "5c78f6f4-8730-4810-acb3-2272cbad08e2", "comment": "Malware payload (PhantomStealer)", "value": "5d3953ebcfa407f964daa55281552128", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246836, "uuid": "e3751733-9f34-42ed-9563-8bacdf55c129", "comment": "Malware payload (PhantomStealer)", "value": "cebdcd7a6269bdf76a031c9f1799ec5502e6d9f2973df673d724babccf214d01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246836, "uuid": "61b9e6db-e6a0-4dd1-a827-4c5e3a1b6e2b", "comment": "Malware payload (PhantomStealer)", "value": "b2adf628eb56f8de0d7e737493d617e4b15fd565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246836, "uuid": "5529c221-e77f-4808-bac2-14499921bfa0", "comment": "Malware payload (PhantomStealer)", "value": "cad8dd02378b5ddbf790a20dd5fb151e8e159fed7764f4af543ca9e941cd9a204da660734503aa4ae4f885deae7086b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246836, "uuid": "3eba1caf-f5f1-4d97-a3f7-a4b3fd684f1f", "value": "T16D7523092225E603D5253FF91EB2F1752BB82E9AB912C3494FE9ADF7B536F118C05243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246836, "uuid": "042928b8-230e-4277-b58d-86a731df8e51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246836, "uuid": "b25f11bb-321f-4f22-b3fd-9e77444b834e", "value": "49152:oebAlh8iMXsCqTOZbgYHbTCoEM7uOgnt:pcluiDmu8gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246836, "uuid": "4d9bdbce-d973-4124-aecb-44c846879c57", "value": 1604096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246836, "uuid": "f4602d0f-be2a-40cd-9fe0-8ec32ee29a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246836, "uuid": "a10fccde-d08c-44bb-a265-a87dada3a46c", "value": "cebdcd7a6269bdf76a031c9f1799ec5502e6d9f2973df673d724babccf214d01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dfd29c7-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778244226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244226, "uuid": "f20ee224-a7da-428d-b4b4-f6994a812ee5", "comment": "Malware payload (njrat)", "value": "a98786f0f8adc48018a9337279ac5622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244226, "uuid": "cfb4df2e-237d-4d1d-9854-cde1ff135c1e", "comment": "Malware payload (njrat)", "value": "cec44deec9cb423cb96529791d8eb65f2367d927c4f5e0b37c012bf58e98c4d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244226, "uuid": "20690697-10da-49c2-9d8d-a21fe17d539c", "comment": "Malware payload (njrat)", "value": "48cf7dc0c95cf873c800645ae3099633f98a88f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244226, "uuid": "6a362cde-a2a6-4051-936d-4d4635e238a0", "comment": "Malware payload (njrat)", "value": "f5b0a308bab5e3439bd57c38056aa382acc43e8b6a5008030647a434136ac3779e0c929c7e624bc541a11954afa17123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244226, "uuid": "1d08f6fb-4727-4490-b6ee-b4234851113c", "value": "T1E0051217717020F6E27B823AC4658516E7727C7207A45BEF167883762F276C09F3AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244226, "uuid": "8905ef51-b001-4b3c-ac56-fe8b6cd840bc", "value": "a453654622cc4ac6ac24d3f62715ebad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244226, "uuid": "877f9156-7732-4207-8b38-0d536c11e43c", "value": "24576:/eJH6KQfkJ3//ZfHcEPh/5/8hO+2PszTuf:VKQfG/ZfHbkCPiuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244226, "uuid": "05320340-6b1c-4e49-bdb5-e3ac51bf1dda", "value": 824998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244226, "uuid": "0b61b8c9-d3b0-418b-8dcf-104e380e06a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244226, "uuid": "da3cc12d-3ea5-4188-9ac7-16749197224f", "value": "cec44deec9cb423cb96529791d8eb65f2367d927c4f5e0b37c012bf58e98c4d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cd6532-4adc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778244808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244808, "uuid": "4e905da1-67a4-4929-b952-1ad76e2ed56e", "comment": "Malware payload", "value": "69dee370f9c687c05957bc3d71c049d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244808, "uuid": "baf394a3-790c-4c4a-8c64-1f037200ebec", "comment": "Malware payload", "value": "cf58232afd37f7cdb3962901926c0566000c85c117a08927aa6998497ead3663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244808, "uuid": "688f7b33-051c-4964-ba09-eb8c3daef2bb", "comment": "Malware payload", "value": "79b9a37248241e9345127938127696b00993b7b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244808, "uuid": "63cb9870-a559-405b-92ff-170e9915ec1c", "comment": "Malware payload", "value": "62bbf8d8ee439f9eec2bdcd545faedf1d0e40594523487826a845b911cbd426d441919f45d59675ab1bbecb1bee4cd54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244808, "uuid": "821ef350-1677-4eae-a1e6-f46ed15219be", "value": "T1A6D47D212E821E45E2AA4F7DC356168427F4DF924347EA1B6EFC71E04A73FC6CA5B811", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244808, "uuid": "c3167ef6-571a-4711-85e5-99ffffddff4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244808, "uuid": "7b0b8ae2-c6ac-4315-9cea-513e24e159ad", "value": "12288:To0/mFwe6Ikd+abrGR9ObL3ZF8L9BgfHHZjzulWhiFc+v:M0pI6+afGR9ObtuKnZjC3O+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244808, "uuid": "f6d2fe1d-cdcf-4462-b42b-724609ff1f2d", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244808, "uuid": "bd5c7e27-130f-48f4-b15b-e323dcb42426", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244808, "uuid": "c2c7910f-5425-43ee-a317-80a5a61cd5dd", "value": "cf58232afd37f7cdb3962901926c0566000c85c117a08927aa6998497ead3663", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d10984-4ade-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245627, "uuid": "fc8bf5e7-b07e-4cb2-8865-6bf51e440d91", "comment": "Malware payload", "value": "2732c8a4b19f7edadfe6357d354b757c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245627, "uuid": "9a899793-77c3-47ad-83ea-778db72ac05b", "comment": "Malware payload", "value": "d06f18122b53b825d225ea393cbe3d9d8dfa1ee73a124200389832a13b7b754b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245627, "uuid": "881e6a3d-b2f6-4ca3-bc02-c7e6fe60d479", "comment": "Malware payload", "value": "47b66594f21bb7ee9ffa41213c62f9e7d02e2fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245627, "uuid": "fbda8749-6b66-41c1-b601-9dc3ca288e54", "comment": "Malware payload", "value": "92a103e670945397fbe6659f5e18e007db827cd8954929a89ca76ab420e7e90ec4910384069ca92af0e00df9052e2375", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245627, "uuid": "7f2195c3-3d05-4e47-9089-c19c0e916517", "value": "T16145CF161EC21B84E1E94F79C3A5169423F49E971347F26B1EFCB2F08E72BCA9613452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245627, "uuid": "db4d3f23-452a-4b17-8489-1cbd8a41c566", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245627, "uuid": "dc2d8843-64a8-4df8-bcde-c1c3c51e6bae", "value": "24576:UlazGR9ObtuKnZ6XajVfES/Zth1KObGpXhx:xzGR9ItuwZ6XajSARI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245627, "uuid": "cdb59170-1721-424e-b844-f6dc5386c1e5", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245627, "uuid": "c9f7a50e-e429-448a-a1bd-16d66a9a95af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245627, "uuid": "2ebe6a58-083c-4a50-a3da-024cee9b6e15", "value": "d06f18122b53b825d225ea393cbe3d9d8dfa1ee73a124200389832a13b7b754b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963291fe-4abd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778231355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231355, "uuid": "788d57d1-42b7-4610-b21d-d8993a5893ae", "comment": "Malware payload", "value": "08fa9a6fb147983a0ef5cab85df490b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231355, "uuid": "e8ea7098-3b03-4bce-a638-ea0dbf965474", "comment": "Malware payload", "value": "d1c171046650624ca41c7de32fb6bf8bf409368c4332756f1873c63a4fd09c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231355, "uuid": "15911072-c2e6-4e1a-8f74-863398cc8eec", "comment": "Malware payload", "value": "97cdcf95c73022750c5f869c044f7408b8216072", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778231355, "uuid": "04b1b1fa-7185-4694-a303-c1586d41e557", "comment": "Malware payload", "value": "a205b2ee429bc9c64498a7f5379905f5e3a1711738807689bbb6fdc2c5deed054ff81b277f108b4cd93c282e29a764de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231355, "uuid": "fda098c9-bec7-4b84-9092-d653df18056e", "value": "T1DBC4019237D4A701C5B465F5D0F79AA603F3948733B3E7843A0A82E06DC17E1CE5AB86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231355, "uuid": "6d0fa209-441e-4082-aea1-649888267816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231355, "uuid": "51d83096-d722-4dd7-8580-9927fa21f6ac", "value": "6144:IYGujFY1Id2Goei7YJ8dw7hYfBIth9TSfaJDav4R7GTKNMEldmR+q2gEMJXip9em:xNSpDnmWI/d70KNMEldmR/dEMJ4egwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778231355, "uuid": "ca887fb6-59e2-4c01-b708-b53d3635863a", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778231355, "uuid": "32112439-4479-48af-9fe5-8d5f4abe4153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778231355, "uuid": "51f7d882-9f2b-4806-bc31-8fc32716c3c6", "value": "08fa9a6fb147983a0ef5cab85df490b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05763e3-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243827, "uuid": "ce2a229e-a6cb-4b38-b956-65c77083ccf1", "comment": "Malware payload (AgentTesla)", "value": "69ff46bef85b10ce4d213c1149703f0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243827, "uuid": "dde7bb94-cb24-4aff-bc42-bc1c8e899312", "comment": "Malware payload (AgentTesla)", "value": "d2580cc8671622a3de8659e4d7bcaab6a3b7a49e9cd619e2d19148133ce69693", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243827, "uuid": "bb8bc5c3-5469-4caa-b799-22d83811316c", "comment": "Malware payload (AgentTesla)", "value": "170ab76952f3234bb831aca78a8798bbeb0985d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243827, "uuid": "6135d556-c857-4646-97e3-6bfbaefb55a9", "comment": "Malware payload (AgentTesla)", "value": "91f6feb1a491cd1af880dcf4d6045c7debbd6457ac043c7ed3b73f5f1e1f5f05ae132b4f451590e49c69bd0001f0b12f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243827, "uuid": "2164b579-0f1d-48a2-9238-19a9875c0c6c", "value": "T131A4AD133E40B776CB9206F0262DAD911673BDB4782F96CEE3D17ADBA6B2D8145381C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243827, "uuid": "6c4cd817-b749-417b-b064-f692e7b2cdf7", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243827, "uuid": "3033bdf5-0611-4281-8720-03b01c72c8a6", "value": "6144:GR+xXQQwnYELx8mLOtcytSt13T26bS6MNKhzNmKSdcnA:KswnbLx8OOtPtm3zoshzNVIcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243827, "uuid": "66d58332-be5e-48c6-8cff-a3f2d9a4f195", "value": 449464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243827, "uuid": "9b60e3e6-85bd-4e17-ad8d-ee10e4f65bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243827, "uuid": "66390786-acb4-4c09-a8f2-da2921a1d634", "value": "d2580cc8671622a3de8659e4d7bcaab6a3b7a49e9cd619e2d19148133ce69693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492fb9f8-4aa8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778222206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222206, "uuid": "07d25e85-5a60-4efd-99b8-47db9a1ae4fa", "comment": "Malware payload (Mirai)", "value": "ca0915076a90791c1755302a146e91dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222206, "uuid": "4800055e-5de1-4e83-93cf-673312f5d653", "comment": "Malware payload (Mirai)", "value": "d25b01ae500cdb57d2857892ae455cc3ddb78164782f6ed533c3686116aa7ec4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222206, "uuid": "1932e58d-3ea0-4586-a9d4-3b38af2fc942", "comment": "Malware payload (Mirai)", "value": "e3560efbae7c876b0d6a6632e59c62d3849a40b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778222206, "uuid": "4d0c7bc9-01b9-4c5b-9004-2ac3c5f1cf33", "comment": "Malware payload (Mirai)", "value": "210eb4a699c188372ce4137de83c1d1b211d26e73ad4c692b92c3ea8e796ef45511c471feecc996a9612caaed8d00998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222206, "uuid": "a6e928b9-82eb-4192-8c16-131203ada344", "value": "T175D3CF32E0086DA0DD2116B4347659BC0340DEB40BD59283EFBEE59E28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222206, "uuid": "e3fa8ddd-554f-4d54-93f4-acecf0f49340", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Zha:yulo2ubIVv3sXL5NZmOha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778222206, "uuid": "ad1bfb66-1b96-48bf-a2e0-f843e00ed8ec", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778222206, "uuid": "69311026-18da-4cdc-bf1c-6c3669f41635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778222206, "uuid": "985e8fef-09ba-4212-b1be-151adb69e173", "value": "xnxnxnxnxnxnxnxnsh4xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470de103-4af4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778254844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254844, "uuid": "46ff51b1-0a19-46fb-8707-a9f88a15478d", "comment": "Malware payload", "value": "f27572a4f28d34a06df2e514698bdef7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254844, "uuid": "dcbb4f28-5edf-45b5-b78a-c57736740b2f", "comment": "Malware payload", "value": "d26af8ac0a12fcb61a03cee557b317eb778d239d52a74ce42f1c240823d89806", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254844, "uuid": "a7fdc8f4-d682-469f-b250-4f22c9b83225", "comment": "Malware payload", "value": "f33db4c0689984e01689a3ee89db8235f797297c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778254844, "uuid": "5ae3f5ab-7269-408d-ac9e-7f8c6a509a6a", "comment": "Malware payload", "value": "2a22b799e71684d494cf5bad0cf3c3d0c1cbcdd9ff586547693d247fcae2141cb983e809edaab51f0ee66a8a33f82d59", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254844, "uuid": "922ec11a-7239-4ca9-b049-5cb0a53c2425", "value": "T1AE82D83A8508EFF4487A2292298F5C275A110701BAB5351DB98EC98C3F7B7A1CFD59F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254844, "uuid": "d6fac533-9b75-4bfc-b6f6-33eda3323af4", "value": "384:Kt3iaYzpZFCun8EixpweWdCbUxshwow7g+:KJiaYt4Q2n3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778254844, "uuid": "9200294c-abed-4f48-8f86-c186a185383c", "value": 19029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778254844, "uuid": "c41a8a08-ca9d-46cf-a337-b076cdad55d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778254844, "uuid": "1b12d24a-156e-4a9d-a498-b754a6424ee1", "value": "MPM DETAILS 08.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bfcc7d6-4adb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778244088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244088, "uuid": "8626fb24-925f-4993-8bcd-113e36d9b007", "comment": "Malware payload (AsyncRAT)", "value": "c6fbfa28bc5dd91579e237469d6d18ee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244088, "uuid": "011da333-d2cc-4aaf-b414-e2bffc2f5c4a", "comment": "Malware payload (AsyncRAT)", "value": "d26bede923e0b302c824ca4ab196c6ef3303e8b68a0c13ab8e3980ad7ac6d086", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244088, "uuid": "8a6399c5-f950-467d-82d6-49a8a72ea093", "comment": "Malware payload (AsyncRAT)", "value": "aff325a1d9a05879707bef5102e0fecb6d0684e3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778244088, "uuid": "4113b37e-709a-41bb-965b-76d89b4f4498", "comment": "Malware payload (AsyncRAT)", "value": "2c9597a78410b40151641b79218e01845ec7a652ee4a3b7f676e39d441d180e9979c891bfedccf597d57fd3ceae2b05b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244088, "uuid": "e9b9ab70-d618-4b64-9f29-b00be4f136a8", "value": "T18425E0513A1FE581F8AC4F710A62FA7807263EE8B810D2469ED4BEEB77F1B553416342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244088, "uuid": "185c8c13-4162-4d54-a568-bcf36c824f71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244088, "uuid": "045d8160-e771-45ce-9e94-fa65059a3afb", "value": "12288:QyH+YF+8+DbFdr9/OI2tjNLNR81qchFmikzAMzjL/RvBuyrpt1t7Jc3BUgi8Pmlh:0YE8+v9mBLpimb8Mbhtrp7tgqmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778244088, "uuid": "60fac93e-e9cf-461a-8156-7ffefdd809f7", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778244088, "uuid": "58cb5a7c-3f57-49f1-a28b-b76e68a919d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778244088, "uuid": "9de48835-7e8a-4102-97ec-e09ad615a472", "value": "d26bede923e0b302c824ca4ab196c6ef3303e8b68a0c13ab8e3980ad7ac6d086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dc0bb2-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778243192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243192, "uuid": "01367f87-2657-4114-a817-2546bd4cd76d", "comment": "Malware payload (AgentTesla)", "value": "d66277fa820f25ab3b69a0e0b0c2ba81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243192, "uuid": "589b4de4-6851-4ed8-ae7e-0188e23ee6ae", "comment": "Malware payload (AgentTesla)", "value": "d2ba388812286877fbf0d5eac45f0637ad30a2c26b60878263c0ce7e6919a51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243192, "uuid": "ecb742cd-e8c4-41b2-baf8-371d9bc54014", "comment": "Malware payload (AgentTesla)", "value": "82fd628851ccb1aa2b81e4304cd27f312306f7f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243192, "uuid": "79c7bf9c-4221-4b3a-b8f6-19fc313a0357", "comment": "Malware payload (AgentTesla)", "value": "ad6d8ccb550e15fccbd087f707199fa7ade1185af1f1505330365a28007ea4c078b4da30cbc33a9a8941e75568a2add7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243192, "uuid": "c3ce1c5d-340f-4b02-9eba-101b40433e16", "value": "T15C45F1543369EF02D4AB5BF40970E33487B96D595822E30BAEE1BDEFB9397016904393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243192, "uuid": "99c689d2-a1cb-4fd8-a87c-0e54d1790fe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243192, "uuid": "5016b73a-d60c-4749-b122-1adafc05dba3", "value": "24576:Mh3x27fOW9nnot8JYPnzXFvWYk9Cn1Q4keWJ0lNDq3SJJSHw:MRx5yoECXFvWYOpJ0/m3qUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243192, "uuid": "9bf410d2-92c9-4a21-b0d9-8edb07df51b0", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243192, "uuid": "f862aaba-dbe8-42e6-abf9-0b311c19b0d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243192, "uuid": "deae7a71-7d3d-4a9c-8468-a6300bead338", "value": "d2ba388812286877fbf0d5eac45f0637ad30a2c26b60878263c0ce7e6919a51a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244824af-4ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778241042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241042, "uuid": "452b0d76-babc-45f2-a72e-efb2db7efc62", "comment": "Malware payload (Mirai)", "value": "3a7d15116d45f5ac2c420b17a39c4a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241042, "uuid": "897f1fb0-0a6a-437d-ba98-772aebb9cdd9", "comment": "Malware payload (Mirai)", "value": "d2f88f5f93dba410f0c748141485238c3d96229f17c4dec885bfc7d8c5b9762d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241042, "uuid": "dd6b29f2-5369-430d-b2fd-509e7f902f63", "comment": "Malware payload (Mirai)", "value": "11b265333d47381acbb5868a7b50a9fc7b5c0a9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241042, "uuid": "dffd24b3-1bd9-4cdb-8dbb-6c67a4d54ade", "comment": "Malware payload (Mirai)", "value": "2fbadc2c5fd2b4eb23670519084dec8dd9580650cc319e19c1d0f56121b111d7a01e709de6d942f642c479a4c9b1e85a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241042, "uuid": "8a3b006f-f4af-449c-b782-d1df059aeef8", "value": "T1C433F1FBE332F1E6CB3A947959850146E4742D966A560FE782DB6DF44C333CD2E01922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241042, "uuid": "6aa3beb3-b17b-4e63-a0ad-0da280af5c40", "value": "768:Sm4ezg3OnSIdB6IG5CKY1nc+EPnde2MPVFn6cnh/LFmsxt3QkpsrvW/yc6DrXDdG:S3sg3FIT6IG5HYeTdA/6chftlpsq//iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778241042, "uuid": "2dd2677c-7d1a-459c-9a81-4a97010851c8", "value": 53892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778241042, "uuid": "a9815872-5622-442b-a5f6-1826d5011b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241042, "uuid": "3e7fc564-a559-43a5-890c-881306f1c4d9", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc575afb-4ae7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778249485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778249485, "uuid": "8ae1f8c9-9199-4515-b9cb-92892546892c", "comment": "Malware payload", "value": "e51f36a8d0462a7019973199907487d3", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778249485, "uuid": "de98e97d-0738-4086-82b2-12b78211cf39", "comment": "Malware payload", "value": "d3867291a296fed76bdeee21fa09c45cd4585bbf35970a16d437847f368bef98", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778249485, "uuid": "98689fe5-4fb3-4e96-bac4-4cedcdc52832", "comment": "Malware payload", "value": "85596fc5b835f8c47999fcecf040b2d1ea31bf41", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778249485, "uuid": "a1d62a0f-c909-467a-8d18-9b5aaf0fe2f3", "comment": "Malware payload", "value": "f79dc186fae8b32e0df4e4c6959cba8c3956be0d8fe5cd06f111018809e73f83937a2d37c4c53fa7fe22005256be5c8e", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778249485, "uuid": "2cdfa050-d534-4ad5-b27f-ffd7e83dd487", "value": "T129673371C2306C04CA0777363AF2F51C5AE644C01CB6B827BEB9894569D2DD7CDBCA6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778249485, "uuid": "d5507365-d9b7-4b0d-b98f-53716ac85ff8", "value": "786432:XVJ9YPvCS1xiM/edeLnz5jXgJR5YLsz1PukqI0dsGKll2t/YP0pG:XVjYva1erzVgsq1GkqZY2t/YP0I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778249485, "uuid": "1f083ed8-f25a-4d9b-abe5-f0493802a625", "value": 32066729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778249485, "uuid": "7b9de05b-b29a-4c89-b5de-c7088c8e1a40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778249485, "uuid": "9ffdc633-1baf-4220-ac6e-2abe3377e408", "value": "paul", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7ddc93-4b31-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778281028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281028, "uuid": "bb951581-7d99-41ea-8722-eed97572967a", "comment": "Malware payload (Mirai)", "value": "7976aff21566f98b56cc9eea7af59c16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281028, "uuid": "7568cf08-3962-4fdd-905b-9d06639304e6", "comment": "Malware payload (Mirai)", "value": "d389796333d8218581bf9563dd5eb8b5bd5944d190337e401dfa987e93aa381c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281028, "uuid": "bd5f337f-f128-4876-a87b-0b7b8234341c", "comment": "Malware payload (Mirai)", "value": "fdfd39562794f80109f91ac042999450046428fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778281028, "uuid": "9fd1c046-6043-4340-8356-b72b62654fd1", "comment": "Malware payload (Mirai)", "value": "bfaeb064e3a13c4d4d963cf41924ed19ec22c4618e0a316e3206ef733ea53bcba3e463e8bf1c87e5c6607772a847dc01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281028, "uuid": "a7169581-52b3-47a4-b0f9-fc103b28581d", "value": "T1CEB34AD6F801DE7DFC0EDB7F4457050AB621A36216835F3A6757BE63BC310A46922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281028, "uuid": "4720cc35-41a9-4788-b253-dab1428af835", "value": "1536:M/Fd8MNhs3SVr7fVnYMFgnzV2I1K8FFBGPtj6vpPc/rLU1BCuQJ0dOj0:GFd/GC/Vnrgn52I1bBe61KPuQJGOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778281028, "uuid": "0671990e-e902-4a5a-9600-9b06f1afafe3", "value": 114956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778281028, "uuid": "ff06abb6-4f4c-4452-a202-edc75b0498bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778281028, "uuid": "d1f05787-9ec4-4d1d-b553-7d736f6d0eba", "value": "nerv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daf4a49-4abb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778230455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230455, "uuid": "3d64cdb5-1741-482f-a4d8-160baf201ab6", "comment": "Malware payload", "value": "527839e907f4008f01f220f11eb1e6d0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230455, "uuid": "c527e21f-d4e6-41ee-a7d5-dab55436304a", "comment": "Malware payload", "value": "d3a3a7e4c9dbd83d269bc0f998b8c4975afab97bd4681c6fbf12d0a4e65336ac", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230455, "uuid": "73d804a7-ad73-4240-8354-0d5481326653", "comment": "Malware payload", "value": "7d68cbfb552ddc437a0b17c62200c14d1b426923", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778230455, "uuid": "a104faf4-f803-40eb-b723-31a999fb0b47", "comment": "Malware payload", "value": "d1820e44283bd845406a81fdc17c6b66b241191f7a705e227ae607eabd7595c6aeb00ce73eca0183ef3c2c5597fe7781", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Bank", "colour": "#17ADDC", "exportable": true, "hide_tag": false }, { "name": "ICICI", "colour": "#D938CF", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230455, "uuid": "63acb2c5-c3d3-45c9-b7e6-f1a32113fb51", "value": "T122E6124AF3095C2AE8F752377976433695135C668B43C68B6820B23C6EFB6E04F1DB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230455, "uuid": "36bdeb6d-f50e-434e-b506-cd5c5c480159", "value": "196608:L3AFuoW2RN6Ax15mSo5B+H2X44f3U0PAdQRq9Cya857k4Agpe6vyIdtCimLj6A11:LXUlVYB1rTodQR1q57k/iyIdIVLj7z1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778230455, "uuid": "c023aa02-d958-4cd5-837e-1a0de9a12a90", "value": 14868412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778230455, "uuid": "017a13d2-6bc1-4baf-b1ba-11e55f361e26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778230455, "uuid": "21160439-de05-4369-84fd-3a674f652b3b", "value": "iMobile LIte (27).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb3f2ba-4ac8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778236255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236255, "uuid": "a867c836-3231-49b0-8395-8500209397e3", "comment": "Malware payload", "value": "032f94f9c28aa546238be206c1b57f52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236255, "uuid": "f393ad95-c8bb-4dc5-98cd-ac7ccf13054e", "comment": "Malware payload", "value": "d3a3f0c0feca377ec772ddf404d3b19185a5713d6493cb348faa9bd0dc514181", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236255, "uuid": "a90d6e2b-1cc3-44bc-afc2-09cc4476e360", "comment": "Malware payload", "value": "95aa90d605b81aba6148f623832689111b75d7aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236255, "uuid": "4fce4799-8bcc-4a2f-854b-5c3b14825672", "comment": "Malware payload", "value": "13c43844d1404c9b5944c126c644d27b38e5063a302c99cbe308b87e28e808073840270233808f656bd3383a15ae3eee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236255, "uuid": "904f3679-e8d2-425c-bf09-d9fabb372328", "value": "T135A1330C54363D987B909306FCF53047731AE72B3A1D6980A34F9ABD2A45AC59E22BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236255, "uuid": "0794ad31-6d6f-4527-8e54-85e14eab19a3", "value": "96:dMjumOCINRPuflAHbYulSTPGFvrI9XWsT60eO+kmX:dMjBINqjG5I9XD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236255, "uuid": "35f82cd7-3e6f-41cf-9475-0d2099d7fa7c", "value": 4697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236255, "uuid": "673fabda-0cf8-4582-bdd8-83cc4da1d4cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236255, "uuid": "82e62013-a2e3-43a8-96bf-18fa692585c5", "value": "content.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208fe8cb-4ae1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1778246619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246619, "uuid": "cf7cf516-4290-496a-b0a5-7c46d586c60a", "comment": "Malware payload (RemcosRAT)", "value": "bbb921a6b68bbbe38b1bb9a4fa345607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246619, "uuid": "90b89afc-50c8-41d7-95b3-f3f7e4c5766d", "comment": "Malware payload (RemcosRAT)", "value": "d3bb945c2ee32337273af856445e85e036435e205fe1f100734aeb873d35cf16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246619, "uuid": "7535a9cf-0751-46d5-9785-c6988dcc8dc7", "comment": "Malware payload (RemcosRAT)", "value": "b56f1ba0fcf0f51f99d2abbf29cdc9737c15af3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246619, "uuid": "e89a8561-d690-4dd0-9765-10a7d3703a19", "comment": "Malware payload (RemcosRAT)", "value": "4bcbd93b2ddb2cdaa50be1e8e1cfa7d1ac78945fd1f187f8c27f9885162617b0319d9161e9016de8c33d0e9ead6f522b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246619, "uuid": "09196409-1c9d-4c04-a9b3-a2ac6e7399bb", "value": "T1C9B423A93191D83FF27915B2C9628FFB2E467E60F544884F87447C6F7F306604A2D68A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246619, "uuid": "320f76c5-3d8b-4ecb-af8b-8a7d6e5418b7", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246619, "uuid": "3d5aed1a-84cb-489e-85d7-76e9927205ab", "value": "12288:j+5FHaq59UcRsgy6izNNXx/hgvVOvpT+B9vcjOGL:j+mU95ugypWI+B9vcjvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246619, "uuid": "35a47ecb-daca-456e-a8ab-292b551194bd", "value": 528249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246619, "uuid": "a6e3007c-90e4-4f78-b234-08ada305b31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246619, "uuid": "e9233d06-88a4-4c40-867d-892f6b12cfb8", "value": "d3bb945c2ee32337273af856445e85e036435e205fe1f100734aeb873d35cf16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bcca76-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1778242759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242759, "uuid": "a086f606-1cd5-4991-9462-e1ad57a3ee77", "comment": "Malware payload (GuLoader)", "value": "b809f33f342e31c17dec91959dbf1080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242759, "uuid": "1b1cedb5-4c61-4d2b-a427-eb82cee8cba7", "comment": "Malware payload (GuLoader)", "value": "d3d21a0f0ac1f60beda190e650b70e5e085751d846f7f34f8ee12aff4c184784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242759, "uuid": "2cc2782e-d938-4d9b-b0f7-12a1d8b97905", "comment": "Malware payload (GuLoader)", "value": "8343c96e760cc4cf8b6f991f5431cc43b7ef5f18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242759, "uuid": "1ff6ffd8-ccb0-4053-8af7-a774d12aff0d", "comment": "Malware payload (GuLoader)", "value": "52f1c2fc43d318f475c4a5f990b2cbbf8f919970812ecdf8225403b2ee8756ff3675d5d0798949b918f0d2755c56ae2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242759, "uuid": "22c2cad6-7652-43c2-889d-219585902c4e", "value": "T115352383C7F0E451E8910D716FB21B72EEA2D5073DA1938B4321E66F2E73489B55B389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242759, "uuid": "7a16bc90-7abb-4bff-ad77-0b71d5d56013", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242759, "uuid": "0a539500-027c-4f92-b198-ab1ba178c9da", "value": "24576:rxRqLgrHuvaUL4eabLsdV3T+bqbCtgRQ9VaI9D4CUwpwu2:NRqUDtTbLsdVFCtgSM7wau2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242759, "uuid": "818541b1-d09b-40fd-b909-4775359d5226", "value": 1107896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242759, "uuid": "392b11a5-70c9-426e-a645-ca78a6ffde82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242759, "uuid": "af7ae736-1e88-4fdf-b955-20ef770b28a1", "value": "d3d21a0f0ac1f60beda190e650b70e5e085751d846f7f34f8ee12aff4c184784", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89abc7e-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778243895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243895, "uuid": "2e270984-bf19-410a-9358-29dda4f2866e", "comment": "Malware payload", "value": "6ac08fca006c848526b8993fc8ec5865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243895, "uuid": "7f64b22c-a05e-42f5-9f28-a83c791b05a8", "comment": "Malware payload", "value": "d47078dfe4e4959b49172d7d5416ff1d5d53917d7df03cc906ff1ae1dcc3d333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243895, "uuid": "c4eba07c-13fa-485a-8154-158536316c2b", "comment": "Malware payload", "value": "7656dbfd7a74fb0247aa572b9e6cdb050f6fd8d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243895, "uuid": "5ebd7225-f9fb-49d7-9961-bca35a0cb8ac", "comment": "Malware payload", "value": "2d255691f76c60c4dab3d5f886f8ad5cfa6cbdf665e90a615d2411df1501da6586d4b37ebe72b2333f7f7594be3ed192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243895, "uuid": "70a8081e-8283-403a-88ac-70acc6363cab", "value": "T19DD312C76BC0C236F7EE86B951B32B844178B278E9219B5F5BE6809B5E377024484763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243895, "uuid": "e30d94e0-fa9b-466b-8282-ff116cd686e4", "value": "3072:2eW7LjGHSUBzVumk+m72IaD7hH8M9UpSW:VW7LaHSUiykqnB8wUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243895, "uuid": "545b2cca-0aa1-4c5a-ac36-879aa75844a2", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243895, "uuid": "0a7c047a-1768-4914-a31f-ea860645d6d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243895, "uuid": "23aeb889-c349-48c6-b29b-3e3c93811fe3", "value": "d47078dfe4e4959b49172d7d5416ff1d5d53917d7df03cc906ff1ae1dcc3d333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b72b20-4adf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778245910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245910, "uuid": "1595c6b9-cd24-4643-97ba-02db6389f8d6", "comment": "Malware payload", "value": "1a158d71f629759f401ba60970d90fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245910, "uuid": "891c6b14-452f-472c-8e5c-ef46a63441c8", "comment": "Malware payload", "value": "d4f5f0f6e4d3ccafb68e3e261d92fefb981d419703c1803683f9ff11a0a34c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245910, "uuid": "cf5eb360-8211-41e2-a6d3-e284b6e04761", "comment": "Malware payload", "value": "50df820c7e2dcbae532220cfbc277f9c0e59eaae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778245910, "uuid": "f81cbf1d-888c-4d99-bfe2-1f305d261671", "comment": "Malware payload", "value": "a9d1144741fcae18cb90a82f18c075b606683e3b259c247a158b070540c824b0a4408a4d072cce993d271278c6ca7ff1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245910, "uuid": "f1fe2eb6-ddb6-475d-859a-b40ca5db9bbb", "value": "T15605AD249E462B18EA3E0BB8C067149C37F0D897D257DF5B7EFC91F06AA3B80D81A515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245910, "uuid": "3c474101-22e4-43af-a93a-2088dac42b2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245910, "uuid": "0c98f963-603d-4f6b-9671-280395d38c7b", "value": "12288:Lu0wkK5Ek7679316nvK/BeG+Dae7KGt6ruxRk0tn:C0wkcD76yC/AGMaTY6rmk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778245910, "uuid": "402a4a76-ace1-4f95-8544-e35d2171f848", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778245910, "uuid": "1cde6ce9-ac30-49e3-a726-23b1cd59c9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778245910, "uuid": "561fd70c-4f94-4da3-8091-b3fe0df68426", "value": "d4f5f0f6e4d3ccafb68e3e261d92fefb981d419703c1803683f9ff11a0a34c49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0e849e-4b11-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1778267573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267573, "uuid": "4ad24ce4-2717-4c4f-a02c-317688bdec36", "comment": "Malware payload (AgentTesla)", "value": "12f2d60eb7997c97550c635ab263cd11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267573, "uuid": "e774f7d4-bf6c-44c4-bb8f-fa3fbbbf77f7", "comment": "Malware payload (AgentTesla)", "value": "d50dc6ec340746e78b97c87199509b48f500c7522bd89a1e80255b77681c5337", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267573, "uuid": "68702e42-2de0-4b24-928d-6a514e528e50", "comment": "Malware payload (AgentTesla)", "value": "4b5539ac7880048604619278d1d6a0ed818b2d8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778267573, "uuid": "036cbcbb-fcfb-4571-a0dd-657b8e9e00af", "comment": "Malware payload (AgentTesla)", "value": "bc2d690a4e2c83121bcd46f5528c7a7e8b207a86e743e7250775d99b48fc0b53e4e7f1a5863ef68e642953eaa512790b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267573, "uuid": "1759383c-5e5c-457f-ac49-8ed1f6635bbb", "value": "T18945E008AA571E42D83E477EC4121858D7F0D24BD363C75FBAC8D5A57A62B8ECE4B2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267573, "uuid": "e4ed8f83-e0cc-4447-973d-0dd355d8bd31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267573, "uuid": "00e3c33c-466e-4b70-a523-1e0e8abacfac", "value": "24576:VkyiKly8dyAzyNshz/N5VpMe7HEQCvoGFfYGNf:VkyiK/fzyN+r3VpP7HOvvFfVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778267573, "uuid": "9e1eb64b-a7c1-46b5-8476-7b2191face86", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778267573, "uuid": "0bd2325b-a108-4551-a9f7-7300d5393482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778267573, "uuid": "8aacc512-c92d-463f-b44c-233e6bdc9aa2", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494302d1-4a96-11f1-a769-42010a9c0008", "comment": "Malware payload (LimeRAT)", "timestamp": 1778214475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778214475, "uuid": "ba63e89a-af5c-405d-8001-6bc2d8e9975c", "comment": "Malware payload (LimeRAT)", "value": "8c94f3d4525c6e094293231bf361a2ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778214475, "uuid": "bd3f762e-7069-4550-9227-c0d2f9a46a43", "comment": "Malware payload (LimeRAT)", "value": "d58a10b9880957e29e614f2fbfc9a0e50b9e2479820fafe2942eb1e40e9d2b1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778214475, "uuid": "b1bcd9c4-105b-465e-bd3f-d919555c58b9", "comment": "Malware payload (LimeRAT)", "value": "6447df273331e4754010e18bfc0356eb98942786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778214475, "uuid": "f6895329-c6bc-4c4e-b1a0-6c6b74cbeb4c", "comment": "Malware payload (LimeRAT)", "value": "74b87ef76c9d3945bdafc45f813646a2c45edc8f3a2f73df920420d22446cc1b86ce899e95245e778e6bd6d4ad727c6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778214475, "uuid": "6f739019-44be-4c05-83d8-b50300f134bb", "value": "T13D844B2437D0F01EC69D5AB28F86F0B816703D495E568A663ACCB3DF39BED904978361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778214475, "uuid": "3bc56def-9055-481c-98c8-a514fecb32b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778214475, "uuid": "a6041ff2-96f4-4ed2-a45d-2c647ca353df", "value": "768:Vf17VimixsFh9J0k5NDiXVgqCY6UugGwog1s3xg//L//////////y//////////K:VfKmixsJJXX0kiuxwo4uxg/uS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778214475, "uuid": "ec14e9da-06df-495d-ad24-82c6f510328f", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778214475, "uuid": "f367ba9d-f526-463c-ba96-cc300df36c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778214475, "uuid": "57dd7d1b-e033-450c-a99e-abc8b0add807", "value": "menangmulu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fc190f-4ad9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243136, "uuid": "bb2487fd-104a-4bc4-a280-e04d554d0485", "comment": "Malware payload (Formbook)", "value": "cd3cd13ee5b81e3bf5a4263304b1b1cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243136, "uuid": "48affa03-a420-4d79-b8ce-efa3bf01151d", "comment": "Malware payload (Formbook)", "value": "d61ba2199efe8d6e18c80aed5f35a137d7ed9e63c39a4864c279b05ae3f290cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243136, "uuid": "6f55b4d5-c087-413a-956b-c91b8c533c40", "comment": "Malware payload (Formbook)", "value": "1926ade5dd01d54e87d734702b47c8bf016d5803", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243136, "uuid": "0322eafc-f696-435c-b433-8a7cd82e1a48", "comment": "Malware payload (Formbook)", "value": "c56ac2406661979a8756662c02b58c0bb6f380ac798d1980b830d501fad72e064e30d434976573d1f0f36c922fd8cd68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243136, "uuid": "fd9cb643-4f7c-427c-b785-2156146792b0", "value": "T103551212BBC480B3D4762A324AB697105A7C3D312F61469F13D439AE9B719D2D732FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243136, "uuid": "49d6a350-edd6-46c7-812f-24513ad01914", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243136, "uuid": "3f53a978-f1e7-49d9-ab27-f91d5b54b231", "value": "24576:iN/BUBb+tYjBFHk+/O0AXXd+hGak2Fp//K281p3LXiM0hD6di/AQ:CpUlRhkIP7l/74p3LXiM0hDTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243136, "uuid": "c14342bb-c3b9-4d53-884d-5364f0ad95bc", "value": 1325649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243136, "uuid": "be098abe-cf09-460d-8b77-5cb23eaeb00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243136, "uuid": "fc0e29ac-06be-407e-a379-d1b73fecda76", "value": "d61ba2199efe8d6e18c80aed5f35a137d7ed9e63c39a4864c279b05ae3f290cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32db3feb-4ad4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778241067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241067, "uuid": "ad7fdcf0-c72b-4eee-b8a4-edde886ff7dd", "comment": "Malware payload (Mirai)", "value": "47edf8b0b0841fe075cb14d612dc1f2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241067, "uuid": "ad839d45-d09a-4a37-9f6b-07c75526cf1a", "comment": "Malware payload (Mirai)", "value": "d73e450e7481c58a258809d7d6a609e6de142266696eb462a41f69b9498c6dd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241067, "uuid": "6c7befdd-0fa8-4c9f-9766-9e1d9431d132", "comment": "Malware payload (Mirai)", "value": "8f8d42221af8cf25cc63fd257d05b412c32c1a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778241067, "uuid": "10b7b6a5-0070-41c6-9322-9f95dcd30c66", "comment": "Malware payload (Mirai)", "value": "f7b6e12d4d813735b621d6208f9d863307455901566226aae11d203341763bfcc13bdd33a7b40a0427b207108fb9b452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241067, "uuid": "fb4bda88-56c3-4a2a-9a35-05a627c41f4f", "value": "T1B4D35B17B5C0D0FDC8EAC2744BEAE226DA73B8291139B21E27C46F271E99F215F5D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241067, "uuid": "429721fc-b38e-469f-9a3b-5e1dd9800e41", "value": "3072:0q40xA6bmoFVjl1DxC6gcmovULfWTLPgZTDE:prVLcN/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778241067, "uuid": "8000be06-0b36-4226-8384-5446be7054ee", "value": 139208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778241067, "uuid": "3fa40842-23e1-444b-a4b5-ebcb44bad525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778241067, "uuid": "906dc541-8fb8-4103-9154-e41ac8ec7bef", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cffcee3-4ada-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1778243688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243688, "uuid": "d8b5d596-bd72-4adc-beb5-0ada5fb1e1ae", "comment": "Malware payload (Formbook)", "value": "0d1e8d692607cc3cd4e4ec2102d2cdc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243688, "uuid": "c1a72c4d-5938-48db-8984-fcd50d29e6f3", "comment": "Malware payload (Formbook)", "value": "d757052f889b71f80d4c641cb535c485d3b699a74b77d414d4dd53029036679f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243688, "uuid": "49fc8579-e756-4339-a42b-ab5d0a7135bf", "comment": "Malware payload (Formbook)", "value": "6a50379a02f050e5695d9a604000b111170991ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778243688, "uuid": "c62c6553-9aa9-43b4-9545-4cda82d485b2", "comment": "Malware payload (Formbook)", "value": "c62c6a683d7485ab218e6c0c950fc305d605fb8d2091eb6e270efb746ff4e6e2dd217ef8a30f007817726d9d5d4db579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243688, "uuid": "0842b88b-da66-434e-9f19-0abfee5b80ea", "value": "T19B4501857344DF02C9BB1BF45930E2B407B5AC89E422D313CEEA7DDBBA767466904683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243688, "uuid": "7b7efb27-2d47-47bb-bf3f-8128d3771b3b", "value": "24576:J5hBDRXbym3xKZVaZKIUuyUGiZDOBWmEp26rfJFUAvqtBYpJl1SJJSHwsc:ThtRrym3kZ4gIU6hDOBWTXvqt6R1qUwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778243688, "uuid": "1f69143b-6c5b-4bf7-8e5d-dd815124d8c6", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778243688, "uuid": "6b5903a1-7c99-4084-a499-e6cbf5702a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778243688, "uuid": "99fade45-1606-4ab4-907f-55b57d2d7a2d", "value": "d757052f889b71f80d4c641cb535c485d3b699a74b77d414d4dd53029036679f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f7d188-4ac7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778235566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235566, "uuid": "36baccba-de95-4f23-bf77-73ce8d4579ec", "comment": "Malware payload", "value": "91cb5f83c1a9421a353f2322935725c7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235566, "uuid": "dfd9c89f-e95c-4604-8222-bcbc4ec4eed6", "comment": "Malware payload", "value": "d75edc42b3c9f2af7dee42ec38a12ae12a43983b7012afee4f8a1959e1d6d8a9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235566, "uuid": "b30ca7c2-e060-43ff-b91a-7dc10cd2f072", "comment": "Malware payload", "value": "e959f071d9d6292e6b8ad1a49f4e007a5acf4067", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778235566, "uuid": "d9b92d8f-bf70-41b1-a10e-a64493075b6d", "comment": "Malware payload", "value": "2a41e892a196b555132a62f9d2a8d79366df22b940ed0b036183ffe182176717bc03d69de5935e9ebb0c251d966b7bf4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235566, "uuid": "7734852c-c9bf-4db0-b17c-62e4d13073f7", "value": "T199A633473E246470A7463658A427BF13F81D59F1E2AE6853AE9F728EE351BF33241123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235566, "uuid": "26e30caf-776e-41e5-932d-6d661ea568b5", "value": "196608:o6X4WMXQLzsowVgBR58ZtCDvXNttHDhpUM6pKY+ANTeuawy3zmm:o6Xt3k3ZkDLtYMYKtyC13x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778235566, "uuid": "353ad923-6169-491c-8c5a-ed391833d74d", "value": 10338254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778235566, "uuid": "fbb04fb5-4fb3-41c5-991b-865f768bc8f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778235566, "uuid": "1a2e1e52-f2e4-4da2-92f7-74edbb372a2b", "value": "House of Isabella Modern Living 5 Campaigns.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c21d05-4ac9-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778236508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236508, "uuid": "68e653e2-28e6-47a3-bd04-01f9d2404734", "comment": "Malware payload (PhantomStealer)", "value": "20898da5844984c40289e7f96e588af0", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236508, "uuid": "10d31bff-75af-4c18-85bb-e9b2fa4ba931", "comment": "Malware payload (PhantomStealer)", "value": "d77ba045e74c91810d8aceed90233c91467f3af7845f5145454966b0127b1180", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236508, "uuid": "96897e62-e532-4322-bdf0-f303b9e444a5", "comment": "Malware payload (PhantomStealer)", "value": "c21097d828edcf139e9b15e616e806e324b95a1b", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778236508, "uuid": "cefaa9c8-359b-4f80-86de-10afedaedd95", "comment": "Malware payload (PhantomStealer)", "value": "a386468ec36482aee6f84038b195b17cd9c76f063b93b812ac85ebe9a288e8cbaee487486d59bc6c6386ade7cfa9acb5", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236508, "uuid": "41eb8f3e-b3ca-455a-b235-f6c47819a3a0", "value": "T107C2843EC985AFF0035B71E26A1F3E166A0907236A703A4CB9CF944D37A9750CBB559C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236508, "uuid": "46425f47-773f-4fc7-bc02-c9872ce37bf0", "value": "768:Kxp5pO1ohBx+o8k3EPaTsP0jKt8tJhMZj:EpO1ohBx+o8k3EiI0jKt8tJhMZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778236508, "uuid": "4bc67447-e5b7-405e-8aba-d428fd7ca3ea", "value": 25998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778236508, "uuid": "858c0efc-6d5b-422a-948d-a08bd5082596", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778236508, "uuid": "8f772c13-58e0-42a8-b8c3-1b59f69f82d1", "value": "Factura 1-000800.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979c13df-4b06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778262711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262711, "uuid": "01dd175e-0ade-4025-abde-dbbeff32d91f", "comment": "Malware payload", "value": "3b67ea25fe8336d31ff480af4c857615", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262711, "uuid": "df38cfb9-e7d2-41ab-9aa8-4547f401d61d", "comment": "Malware payload", "value": "d7b7cbd3e34838cc2c0cf137237d1d2f926a44ce3afc7b8c6be7fed05e8d89b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262711, "uuid": "a95ef3b9-92f4-4021-87e7-e3ea552c4d3b", "comment": "Malware payload", "value": "1e8349e9440b2c4a8f2eea82fd995f18f19be940", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778262711, "uuid": "d4a5298d-fb0c-4fce-97c8-a7bd560acf03", "comment": "Malware payload", "value": "e28bb2f0c857a72162b4fc699f8e64394062376917ab32fe82daa73b1159255d6bf0a63f95eb96b7a19df44bc14c499c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262711, "uuid": "e48b5cfa-13be-41e0-9109-1bfae12af058", "value": "T1FBF0FE85F271F9771593D4972B950410B007B9616A92DEA0ACCDB4F48E449C6345C94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262711, "uuid": "36a6db5b-185d-4351-8ecb-8f5b46dd9a42", "value": "6:lOnFflE0F3WJilWJ6xoDWM6xnE0DPWngusgaW3fWvoi/o8:v0F3W0lWPWzPWj7aW3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778262711, "uuid": "a0057bbf-2a52-492f-bc61-693961b2baa6", "value": 488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778262711, "uuid": "39f891c7-02f6-4bb2-9c58-342d7966acef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778262711, "uuid": "09c85866-8788-4af4-a134-7f5f8e8d9ccf", "value": "phantom.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db5a8dc-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778242803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242803, "uuid": "0ba93883-de36-4708-b173-015685d713cc", "comment": "Malware payload", "value": "71184dc7fb77ef13773c48421b35a1e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242803, "uuid": "0bcdf2ca-9e63-4035-89a6-99c7f268580a", "comment": "Malware payload", "value": "d844bcc4569f80eb7160ab445a8fcf5c13526a0cad72f236b71ae9b08644e6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242803, "uuid": "7e3baaf1-f0ef-4c70-9d0d-4c09c0d5fa72", "comment": "Malware payload", "value": "cbdea71aaec2ad6919c27ca2ca613eedb359cbcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242803, "uuid": "decbf862-e5f9-4ced-bedc-22b1c2b72dc3", "comment": "Malware payload", "value": "0b624a807f8376ac7357a094744b23aa4f3944ec80aec40253b09079bdcc61c7239364f9863bc3ad2aab94864717404f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242803, "uuid": "66098b7d-2baa-448c-9091-08a5bb0ec76d", "value": "T10CD40A92E284C5AEC4170176CC3AEA712527BFA94974861F256D7D2B76B3383107BE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242803, "uuid": "b0608712-6969-4956-9b10-bd7346650926", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242803, "uuid": "dd2f4cac-778b-4474-8099-71ce9528ae62", "value": "6144:pOYGXaPNxdgSdcq2pVZPOJHAbK/qAoMGGGGGGGGGGbGGGGGGGGGG6GG/DGXxeXJm:1GqN/XdctpVtkPq2KHjlZ9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778242803, "uuid": "4f35e6f3-f038-43a8-8b11-072e61d41915", "value": 604033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778242803, "uuid": "a89fa8dc-c25b-4303-ae65-902489a8456f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242803, "uuid": "222fe718-f826-4513-813d-37cbfc46dec2", "value": "d844bcc4569f80eb7160ab445a8fcf5c13526a0cad72f236b71ae9b08644e6cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e4760b-4afb-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1778257847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257847, "uuid": "ab59d3a1-dfa2-4eea-a81b-4df0f0fd162f", "comment": "Malware payload (SnappyClient)", "value": "d6ce9f565906457bab4d83e3f3c95523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257847, "uuid": "c4571031-bb8e-4fda-b75c-4e5f7a0eb2ba", "comment": "Malware payload (SnappyClient)", "value": "d90f827be6e1f82b18603b2576248376e04a843e5fa31b2cc39cf151c16273f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257847, "uuid": "417d0dd3-7b0a-46d1-b6c9-3f5262f682e9", "comment": "Malware payload (SnappyClient)", "value": "22a3ee1299dd2af9fdbe60c9d66fcac703a4d20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778257847, "uuid": "7e4cfb23-9878-4d17-9254-0b84f26d414a", "comment": "Malware payload (SnappyClient)", "value": "96eb0d3b3d767d81d955f665964e41a06f77dc2a485cb0f7ba37c2747b39f6ffa8e3ddd35bd160025f5c5da9376e043f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257847, "uuid": "90a8b983-8b6a-4cdb-b3af-26689f2aa2aa", "value": "T1F476B4078B654646C035A53494BB0322BBB93C845B315FCB25F9B3252DAFBF42EB625C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257847, "uuid": "759278ff-5eaa-48a5-a09e-4ce01f9e1549", "value": "af45f6a8617586c8e3b550f4f0a01a8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257847, "uuid": "9dca236f-37a0-4215-b3d3-ff18fd1130e5", "value": "49152:101bWzdEJN6WeWRUAVnkhOmq2IlPlgUcpUllCC8cseh:10+sVnOwgwc7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778257847, "uuid": "fc346dc4-c1f3-4de1-a44c-0e44082d6c76", "value": 7740416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778257847, "uuid": "7bcc886f-7e1f-45d1-a73a-ca4ca17cb74c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778257847, "uuid": "bde99494-dbad-4311-ad03-f0b71941f9c2", "value": "SecuriteInfo.com.Heur.21628.9949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b1ee95-4ae0-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1778246356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246356, "uuid": "5aa279e4-abe0-4787-b51c-d59061e122c0", "comment": "Malware payload (PhantomStealer)", "value": "ab9e23609c35627258c0479f4884bb4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246356, "uuid": "9f66e872-aa2c-41b1-895b-f862c5673d26", "comment": "Malware payload (PhantomStealer)", "value": "d91c06524bb806a2159d9ea10236f7724fbf4c3c63efe33da6b107d99c771d15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246356, "uuid": "9fb933b5-bde4-4020-92a1-2b56c24320a7", "comment": "Malware payload (PhantomStealer)", "value": "abd83cf0c5fae9117a45a663f46197e34edbcce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778246356, "uuid": "e54d1fb8-6972-4fc0-a104-05a9d0a4091c", "comment": "Malware payload (PhantomStealer)", "value": "e8be323ac4915b0dafe371f0de2d29d01d1e807c85552acfd2b95b3948505e3ed25157613341a94dc391233d2d2a0585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246356, "uuid": "9a65dbed-ef47-43a3-9052-3eb0cba06f88", "value": "T195F4DF6873F81A01F1FF5B71A4B59951AB34B513A9A1D71E15C080CD0EB2B918F8AF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246356, "uuid": "fb5ff1df-a7c6-4e50-9d05-d43b513d1495", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246356, "uuid": "8361f6b2-7133-4c4f-b1a5-3194c4eb4bc6", "value": "12288:p9dsBGtikqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQabQLdlLUwi:p9dCkqjVnlqud+/2P+ATAS/JYeSlLUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778246356, "uuid": "f2a26de6-b5ca-4687-9a07-da6494e8d978", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778246356, "uuid": "65ee2d44-46aa-4960-ae36-03d82520816d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778246356, "uuid": "6dbcc2f8-eb5e-47e7-b690-8d8bc744902a", "value": "d91c06524bb806a2159d9ea10236f7724fbf4c3c63efe33da6b107d99c771d15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b64105d-4ad8-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkWatchman)", "timestamp": 1778242772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242772, "uuid": "ac3e7f0b-f5be-4788-8eee-00a071bc6f1a", "comment": "Malware payload (DarkWatchman)", "value": "956933f3d293e2b9db6d9f6448fa5073", "object_relation": "md5", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242772, "uuid": "71790e6b-30ff-4089-96a1-48abdbfcc963", "comment": "Malware payload (DarkWatchman)", "value": "d92b1af05253ca10448a3761a067851ee1c1089f3f8b182f3e5a36b66dc31e92", "object_relation": "sha256", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242772, "uuid": "c080b89d-3852-4bf6-af9b-0a6efb331760", "comment": "Malware payload (DarkWatchman)", "value": "49dbfbcc3811e0e1b3cec9acdfe86463a64446db", "object_relation": "sha1", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778242772, "uuid": "ee959932-fed9-4877-98b6-941b45406412", "comment": "Malware payload (DarkWatchman)", "value": "990a522b2887ea84f7b111fe93ba190f649676e9060c922017c8161ad2344289698a9204658b4544400d72b88d087161", "object_relation": "sha3-384", "Tag": [ { "name": "DarkWatchman", "colour": "#06FC1E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242772, "uuid": "dde6bb70-5aca-441b-8da5-54aee1cd10e1", "value": "T19FD4F992E284C5AEC4170176DC3AEA712527BFA94974861F256D3D2B76B3383107BE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242772, "uuid": "8aa59ef8-a310-4b1c-be25-a17ff64f11cd", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778242772, "uuid": "0038be3e-159a-44bb-ad67-4cbadc0cdc0b", "value": "6144: