{ "Event": { "published": true, "date": "2026-07-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-10", "timestamp": 1783728182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e4911b05-01d7-4bdb-be44-0004ae82377b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48f7d15-7c4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783680968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680968, "uuid": "b0a8fe34-efc2-44e1-bee1-0d391ebf0595", "comment": "Malware payload", "value": "06ab6a6078e179de8afd02a6318c395a", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680968, "uuid": "b6a43c8d-dc27-4cff-aae2-4ac150de4f7d", "comment": "Malware payload", "value": "00164d07594203e5db9b29f9f5d731a5c177bda5b536fd83d50cf96fd0afd64c", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680968, "uuid": "5ecfea46-517e-4622-884a-18f376e24fbf", "comment": "Malware payload", "value": "dc0cca199f3134f8caba5c6964f71b91c41566b4", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680968, "uuid": "5e3c1c36-4d83-4e22-ba4b-9ded536edf51", "comment": "Malware payload", "value": "09675e88567c1a30f26eacac95cf57544690b867a81c9af97f67822321366ef0da54efc910e4b91a0d3b6aed6260be64", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680968, "uuid": "6250d56d-6c28-4204-92df-067628a66146", "value": "T1B495128FEEA513F6D53E407890115211AB98BC124B10DEEF2B463DB66D63AEA0F39711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680968, "uuid": "9fad1a9b-f668-4d5d-9621-5bca13acf45c", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680968, "uuid": "9a7c818d-85b7-47e5-8596-421771506441", "value": "49152:7uWM0auU4uMuiu1u6CnFwJXPDj3fBHspgnNMHaSXs2/nXf:elj3fBH1MLsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783680968, "uuid": "3ef9ebcf-feea-42d8-9590-bcd9c69faec7", "value": 2054144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783680968, "uuid": "a0e19602-2486-4798-8153-b9ccb61aabe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680968, "uuid": "04a5202b-5ea4-4cff-a2ab-8a1d7b634988", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddefdb2d-7c67-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783692097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692097, "uuid": "3f8d8e39-71fb-437a-8a70-f999ce941995", "comment": "Malware payload", "value": "590f705b018e3310912a0c84ebcdacb7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692097, "uuid": "451b2f00-38b2-4f04-b366-8e3a4c069bb4", "comment": "Malware payload", "value": "049adafe2b168d59f8bc48e1809392a525475778b5f9d3576a6fcfbacf47b899", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692097, "uuid": "9a21961f-e8c7-4a64-bbf7-8f6cbcb53bf6", "comment": "Malware payload", "value": "b0a6bf38104b81d1eb559a18edabde415215288e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692097, "uuid": "16a447f7-3b96-482a-956e-e8ff73ca696e", "comment": "Malware payload", "value": "c03a269312d500f456a7e4e605243320bb71ad2f7d47f3b45a0167a282db61c48d72c0d50eada582fb3820f4465845b0", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692097, "uuid": "8b1664ef-5872-4f33-a263-023d910a2da9", "value": "T170662381FF86E92FC4B785375993073222559C1EC28297434AEC362D6CBB6D84FD9AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692097, "uuid": "d6db1617-daec-432b-a5ea-8b415a6b7f3b", "value": "98304:gwGm934No3dRawGy1qbjW66tE9Ga4kpKIZ98rKbJYrueTua/WehQ38BZ:gZpSvabjtd9Ga4kpKoRJiurqP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783692097, "uuid": "4968e7de-9a5c-4a74-ad96-1c535c733ac3", "value": 6532519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783692097, "uuid": "cb68f7d7-24c7-4023-9e50-2a577614130e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692097, "uuid": "5097ee02-ae5a-4680-baea-5d477c340979", "value": "\ud835\udff0 \ud835\udde7\ud835\udfed\ud835\uddf8_\ud835\udde7\ud835\udfec\ud835\uddf8\ud835\uddf8\ud835\udfed\ud835\udff4+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00b6fc8-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783706247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706247, "uuid": "9ebecfc0-4bc0-46d7-bbc9-936bebdfb07a", "comment": "Malware payload (Mirai)", "value": "251135040156bed88a5b66123b4987f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706247, "uuid": "c003c4ee-6a30-4e3b-b27c-01648c14c695", "comment": "Malware payload (Mirai)", "value": "056fe98ea74350671b92200b7ec69cb79bf2c389e9a08392b9feaefcd46912da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706247, "uuid": "92f95619-93c8-4d3d-ada7-47653435b93e", "comment": "Malware payload (Mirai)", "value": "e2955873af2440b674fbe77043a32dd75592003e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706247, "uuid": "9d8f675a-2dd8-489f-a519-b13db3890617", "comment": "Malware payload (Mirai)", "value": "d75b1cf0454d3bdca7ad9201b07889e2ad15c2233dae527e897f584bbe3f51a861350837bd17f480ae884ada33f891c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706247, "uuid": "4e9a17aa-fcfd-4fa9-977e-392273f148f7", "value": "T1B073194AB9829A11D5C5037BFE1E018D731327A8E3DD7223DD24AF21B7CA56B0E7B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706247, "uuid": "134750ca-b09e-4e0a-beb9-21a8b4c1e988", "value": "1536:EJnqSz2t3hyBuG6I7XZeya8Ev85Augc7am8B13VMmicFTzrwI53YgwbZnZ:DU2t3hyBmI7pREv8gc7abFTzrrhBwbZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706247, "uuid": "d80ff1ab-e5c7-48bd-8994-0307a17de3e9", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706247, "uuid": "8aac9d07-9602-4e0c-9d20-af7054e646a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706247, "uuid": "c2106870-471f-4a09-b778-39ed96a9e990", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc5e212-7c48-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678566, "uuid": "416d897b-1730-48f2-8960-7789ab57bc81", "comment": "Malware payload (SilentNet)", "value": "fdb078c737c4710932d64f1be5459e83", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678566, "uuid": "210f1c32-9d4c-4aad-886a-aaf13e59f594", "comment": "Malware payload (SilentNet)", "value": "09b4fcab98b3288dd1e7f586a1aa0edce9737bdbc32a889dc5a57dc4eb20546f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678566, "uuid": "0102fe3d-80e9-468b-8407-ad610b189db4", "comment": "Malware payload (SilentNet)", "value": "1998235767dc86656ecabadcb124ad6c9436762d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678566, "uuid": "b0d9a323-9646-42ce-964c-5b649ab98515", "comment": "Malware payload (SilentNet)", "value": "7eb68e9bcb340a74d08a18d2f9e9a31a42bd7afd01efbdc0ce267e500a4f6ada8b3e9554e574593572248dbfac9b670c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678566, "uuid": "7ca1552a-6504-439a-8cbb-f91d10f75f0f", "value": "T1B67533B909BE731DCFA3D9E1A2E5850C3D682BDB264F11B4B7690B40CDB9103DC629B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678566, "uuid": "649dbeca-82bf-4c9c-8aeb-9345c86ecf97", "value": "49152:l7Gs18zeNIdhKr2lWNraMEzHwJNAXvX5vgBK09kiX:l7GG8zeNcha2YhjovX5IQ09r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678566, "uuid": "4773ce6c-b69e-4d7d-957e-65acb686104a", "value": 1597749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678566, "uuid": "258dcaad-acda-4315-b0a9-ee00cee60d6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678566, "uuid": "0db6cd09-e647-46db-a356-45bd02b737d7", "value": "Prestige1.21-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc59b5b4-7c79-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783699771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699771, "uuid": "a59095bc-beb5-405a-b9e2-c23e5d18630f", "comment": "Malware payload", "value": "3bd6a40cc6579453c05d925f6b0b2895", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699771, "uuid": "228f1b0b-017f-4209-be93-b8a6a4c2ce84", "comment": "Malware payload", "value": "0b454d10005df0fbe3be6963d95956ae87b32345f8c487feb13b2fa380817184", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699771, "uuid": "c7438934-0bcf-4fab-bc79-5a590b0c5489", "comment": "Malware payload", "value": "5f4ef87a4fe793b5dce840d452b6bee734f90eab", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699771, "uuid": "fca6907e-ba4a-442d-abfc-c89dd2dbf84e", "comment": "Malware payload", "value": "1d2157d92aa088bd5a25fa805574e837bff2f7e5d262ee2426e7a60eda0b89fe05143a419d5859f26064b46923b25fb2", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699771, "uuid": "bd43263e-702a-4843-931f-2d02fdb2fe65", "value": "T15F6633D8053DAC6ECA1F5BBC15A832785280DB471FC722511473AA029EDD881EEFA7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699771, "uuid": "53fad6be-f89d-413f-bdbc-52119dbe1b89", "value": "196608:ImDKjIkptC5nCJCHUxrlWOnD+toeTDDiWss5iX:b+jIcmnCDrlWOatzTDTssI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783699771, "uuid": "b4444635-25b6-45b1-89f2-69a0ee1732f5", "value": 6974830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783699771, "uuid": "a4b4c1eb-e67a-404d-a23d-4a3b569566c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699771, "uuid": "4add8f86-58b1-460f-9bbd-f212b736e7b1", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4f864e-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783706246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706246, "uuid": "bb16dd31-648a-403d-9c22-4454b640cdbe", "comment": "Malware payload (Mirai)", "value": "1c49af552b60e23a6a509de917b5614d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706246, "uuid": "52cf1ec9-d35a-48bf-a8c2-0e98049493ab", "comment": "Malware payload (Mirai)", "value": "0bfa168904c244a3e126040f7b5c675044f8da1a98e533c71c3f2b7c74922d25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706246, "uuid": "83a84d99-a3b4-4894-ac69-d445ce31ff08", "comment": "Malware payload (Mirai)", "value": "cde33c8929fd2640b7232e663682ceea7a732970", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706246, "uuid": "7e42c9f5-ed8c-4e4c-9934-4601e1de65d6", "comment": "Malware payload (Mirai)", "value": "8c090577d74c36b4837b7c839010349c9461b2c01bb221864361d99fd210fb572772856c3058c5d48956691e90fda431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706246, "uuid": "847be888-eebd-483c-a20e-0365dd3cb339", "value": "T114631845BD82A906C6C943B7FA1E428D332563D8E2ED3213DD257F1177CBA2B0D6B162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706246, "uuid": "d53bb292-8442-484f-ac44-fed2ec0f0c8f", "value": "1536:FSFzCvpQwv6MbMYtaC/hiG/xw2Vqw7a5IvqchmcoXvSUa3zqwbZnU:0zCvpz6rYR/h5qLtIvXCaUoGwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706246, "uuid": "7599d48f-dcd8-4324-8d65-0a10bd3cae83", "value": 69384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706246, "uuid": "9d035a03-f3fa-4538-8b6a-ff261ee72148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706246, "uuid": "8c2b4872-1a58-410f-8528-d507e110f480", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7ee1e0-7c73-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697304, "uuid": "5169bfe7-a076-4751-8447-610196902a55", "comment": "Malware payload (Mirai)", "value": "b2a8952931a4c76ae45127ee0960602a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697304, "uuid": "9d9f1b50-0a87-42e7-8d30-ee68e80c24a2", "comment": "Malware payload (Mirai)", "value": "100498a8d749a4fab8176bde19dc864190fcff5c1d38008a5bbbeda0e8254027", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697304, "uuid": "512aaaa1-a078-420a-b0f0-b3abfd1a0949", "comment": "Malware payload (Mirai)", "value": "2dd93576f7d7181f1db0377c95501e8c53a979e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697304, "uuid": "a0bdc1fa-7d36-416d-81df-d3f58c52bdfa", "comment": "Malware payload (Mirai)", "value": "3327b788bac601e2a978f409614307814de4f4efb8e6693b66a6bb76ccd31250ad6fbacb0f5edb2bade321e7361e8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697304, "uuid": "198e4ec7-e75e-440f-a062-c0a37b3153a3", "value": "T18EC2D06422316E72C4A50E769C7510C3FF29BFBCD99F612872190C58A3DAA912D781CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697304, "uuid": "2d977d9a-9f70-431f-bb04-72d7f9d10644", "value": "768:IYC5mKrXEjfUoOoApAGhYoB0k92z63vGDAsK9q3UELoZ:nC5m6EYQAeY0w21DAUL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697304, "uuid": "bbca1d9b-f36a-4b95-80de-e1b9b8680cc2", "value": 27280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697304, "uuid": "dfbfb553-403c-46b0-9cba-94af2d7ba1c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697304, "uuid": "30444b07-97a1-4b6f-b4c1-32fd252f63ca", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7855f0-7c2b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783666323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666323, "uuid": "2c4cfd42-02f0-43b1-8e2b-be5b27f825cb", "comment": "Malware payload (Efimer)", "value": "1b05bb4b7783efd8ac3e9d0ea2cd0254", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666323, "uuid": "f7673856-5e7e-4ec0-a2fb-9bcb0bced96d", "comment": "Malware payload (Efimer)", "value": "1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666323, "uuid": "1d549667-4341-40a7-82a3-c28f16f17a8d", "comment": "Malware payload (Efimer)", "value": "9d1f8916a0a1b5379dc2138fb2ffc3b552d2285b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666323, "uuid": "f8d50a9f-e2fd-4f26-b536-143bcb28a560", "comment": "Malware payload (Efimer)", "value": "9704028d40036ac94876e7018002d8793b9a4746a16125ae2d148c3245620209a4b901e24825b7496bfb558250c06537", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666323, "uuid": "97a4cf41-08b7-4849-9730-d84d3c3f93cf", "value": "T17FE6335CB6D116FDEAA3807DBEE20A99E02A78250B76C6DF0B5443B56E1B0D0CC3C657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666323, "uuid": "c3c52500-076e-49bb-8d0f-2813096cc867", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666323, "uuid": "7d5c63b8-6a44-4329-849d-c1f5075fb26e", "value": "393216:evkeZZXmvVUWjWG0i9kXMCHWUjXrcuI3/PGTAI:evPXSVH7zkXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783666323, "uuid": "a850d524-5fe4-49a8-b3b2-8d487ff35610", "value": 14315605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783666323, "uuid": "710f291f-da86-417c-9b3b-294e28ffa156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666323, "uuid": "a325bd73-c102-4a28-a4be-478165581d83", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9af8fa6-7c07-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783650912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650912, "uuid": "47228531-4cec-44ef-bc60-f39724a9973d", "comment": "Malware payload (ConnectWise)", "value": "14993201fb686ee32a4d46aaa77efb25", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650912, "uuid": "a7d024e6-a126-40c3-9740-1a084fa3a2f4", "comment": "Malware payload (ConnectWise)", "value": "122bf0050365d7b9ceec62e7359d03d6285db98f3c7bb898ef3cdc22e6d70f24", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650912, "uuid": "4275efab-e4a5-4dc1-89da-9110af4cde97", "comment": "Malware payload (ConnectWise)", "value": "778a4f1db0d26016142b6dc1b7efd68d6ce5e9bf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650912, "uuid": "df10ccf8-ca5a-4b5a-b192-71df4ff56168", "comment": "Malware payload (ConnectWise)", "value": "9f3cfc5a5eb4938deca232f832301b5415d7f49ea5d087f1650448986e8591553ce66adb22f19251395558115c2b4bc4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650912, "uuid": "aa23f731-754a-4f86-90a7-3e9892a16883", "value": "T1A208335CEE93E2CFB005B9432FC2C741C648B4CBD6525989485B775B7EC9EC38AAC819", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650912, "uuid": "e595e72c-d7a6-42c8-b4c9-ae38f94edfe1", "value": "1572864:jd1/QC7/U0XT2vnBsMi49/GU0RY716Nb+r7ynetEyAlI4TVFMlZHax8:jP/QiXT2vnCkR0Yc5+rltEJ/34Fa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783650912, "uuid": "74923b8b-85ab-4aa2-a7b2-14a471c2e977", "value": 83027588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783650912, "uuid": "ba14ec5d-31b4-4fb3-abac-f7088924cfee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650912, "uuid": "05b66649-0db4-4c17-bbc6-8c52fdbf1a4b", "value": "winscp_setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f9761d-7bf2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783641648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783641648, "uuid": "13897a46-98c3-4b97-aca5-a6ded0b84b84", "comment": "Malware payload (CoinMiner)", "value": "25a24d759937813e28d65d08f342c3d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783641648, "uuid": "87cd5756-72e9-4916-b7ac-3f0c1161c697", "comment": "Malware payload (CoinMiner)", "value": "158380ebd870255fbf0ecc986480b6ec4601a5074db9bb2ff41cdb626dbee2be", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783641648, "uuid": "fa6ec48e-f1b7-43f2-baaf-6ce54df42f23", "comment": "Malware payload (CoinMiner)", "value": "965a6e624f0a24d09223fd0a3c41e0a7d92844c0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783641648, "uuid": "a2ad456f-83e4-402b-a9de-590f3dcf78b3", "comment": "Malware payload (CoinMiner)", "value": "623869d883f6a7bfecd081f598fbecd84c06df0d54c6e18aebba5ecc5f14c43bf80c622c00e59a0ea6ad007e0a2e2e63", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783641648, "uuid": "48d1fa29-26cc-4dad-9c45-2a97a7eef6a4", "value": "T1F932B31E2E4B0321DE5009B4E575424A517D2EE37387EBDBE633D6CB4AD6E4580C0AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783641648, "uuid": "ff74d5e1-4e50-47ca-9852-1260a8e7e466", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783641648, "uuid": "72be6bcd-a9f3-4b40-9b42-862517382db9", "value": "192:QIo2WBS5BQcxSHO8+59DtPFJxTEZmFhquc:ro/csuDfDtPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783641648, "uuid": "ad390edf-6bbc-4fc1-bfa5-a45879790c5f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783641648, "uuid": "b9b07600-e5ed-4606-bc96-760fa63c290d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783641648, "uuid": "ecef64cf-4cbe-42fc-8930-1de1169ce509", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf9ca03-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783706186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706186, "uuid": "9a821ed6-ef43-403c-889b-26b6ec879fa1", "comment": "Malware payload (Mirai)", "value": "3e12fec5836fd3c68d81ea84332336e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706186, "uuid": "06dee83b-fccd-4239-b5f8-42beeda991df", "comment": "Malware payload (Mirai)", "value": "15e2819ed08fa0daa1a860bc198fd91ad35a67f35bf4dc8f27a785bbd9393384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706186, "uuid": "5a6532d3-a5ec-4bcf-804b-43f027ae5d14", "comment": "Malware payload (Mirai)", "value": "7c57347e935329648b02319c5951adc77d9da178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706186, "uuid": "9ef8d856-2b47-4fa4-a9af-307668769083", "comment": "Malware payload (Mirai)", "value": "02fe48f30073e6578a622a018c13dd3380232a1dd8231f51e4a6cf6d94eb4250bf4fb75b646b59f7fc1427d9fdbfe9a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706186, "uuid": "f6f1255a-0f82-4b42-a6a4-d43da750b8f1", "value": "T18493950E2E218FADF76C833447B74E22F25963D622E1C645E15CE5012E6434EB85FBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706186, "uuid": "613acb02-3bc1-4c98-8be5-c1eeecd13fff", "value": "1536:Dx3WMEmSVjU2EhiS1bjERBbI/JE0AXCzenxRwbZn+jcc:5EhkhhERBbI/OyGRwbZn+j/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706186, "uuid": "6396ec58-bc2a-4bc7-9969-5d67c74579c3", "value": 92684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706186, "uuid": "573f056c-a109-4172-9fff-ef6f7f2b1ac6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706186, "uuid": "8f0c397c-ec00-4bf5-8fb2-731d9061fa69", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e548fd7c-7c33-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783669775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669775, "uuid": "c0cab34a-fdf5-44d3-b7ca-4bac39d5d69e", "comment": "Malware payload", "value": "6ce59af45b34467b4aceb149e0bb596c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669775, "uuid": "d1909597-0aa1-4265-9b6b-352cc4876635", "comment": "Malware payload", "value": "19b380d379426553e87f6e6a822169e02f7b1675cf18d629ebdedb9d098f3d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669775, "uuid": "2bfe150f-68ea-4188-aa4c-72fa8b198bbf", "comment": "Malware payload", "value": "4d59af2f43c8b9bf9ac1e3cc36923b94f4682e1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669775, "uuid": "654fef8d-1929-4f56-abdf-de9dd3c30276", "comment": "Malware payload", "value": "c3559f27df49a56074a68ce6ab2c67ab3e8d2c7f9f5824dd472cad97b65d9379899c8c445176094009f6d98ffa12a2c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669775, "uuid": "a0036546-1a22-4e66-9a9d-e93f7ffaab49", "value": "T1A508332C5532D05CE95D91F720D9FD63F384C221B038889D5A78AAE41BEB8CEE0DD667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669775, "uuid": "bdf582a6-83de-4fa8-a07c-f5c0c3eb4769", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669775, "uuid": "c8ccb712-61ad-4cbb-9c67-d1715667f7ca", "value": "1572864:ht9IKPlNCg1RWYV2IpeL+QvGRJMpuoF3bI3IRVAIa5Kl7:hUKbCg1RWKHpeLDGRaRBbI3ik5Kl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783669775, "uuid": "8b08ff94-170e-4c82-a23d-1acd6d499a1c", "value": 77246047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783669775, "uuid": "f42131e3-1105-4d9b-8e1d-8678a427e7d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669775, "uuid": "1e5ac356-66d3-4b00-b066-8220d0c71fe2", "value": "NAOLS_win_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612dc22a-7c61-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783689310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689310, "uuid": "d92cdeb6-1e29-497c-a62d-e68d5a97003e", "comment": "Malware payload (WannaCry)", "value": "981d4eb72393f6460c64e5444c963d19", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689310, "uuid": "b9dd8c9b-918b-40cd-a041-ddc91622f02d", "comment": "Malware payload (WannaCry)", "value": "1ab810f65b846b0d1aef311bda3d0e96dcc806dd7bdfc7eb414a68d53786a6ad", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689310, "uuid": "204ca505-32b7-4fe7-8598-fa33f1419e9f", "comment": "Malware payload (WannaCry)", "value": "040ec489b5490566e5f254d4a2ae864901878372", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689310, "uuid": "7ecb77f5-41d8-4b67-9c0e-9d945fb72c1d", "comment": "Malware payload (WannaCry)", "value": "1a5f84b54bcfae13f35e13c34b62f27f86243f91f16b03166ea554874dd37454ea2402d0f459a2e32a41a3f48b7d1767", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689310, "uuid": "f2fd1acc-31f0-41e8-9e35-1b0a2e980fcd", "value": "T1EB063358626CA1FCE0450AB844B38E1AB7B37C5967BE4B0F87C0866B0D53B57EFA4741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689310, "uuid": "9d94a3c6-18be-4e13-995a-833e5475f5ea", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689310, "uuid": "5a779a2e-7e4c-4af9-9c8e-426397e4b49c", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P5S3R8yAVp2H:DI8qPe1Cxcxk3ZAEUadWR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783689310, "uuid": "20158f5e-e11a-40fe-b092-9a6246c24ef3", "value": 3995648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783689310, "uuid": "f356707a-7c94-43ae-b60d-da638e99b34d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689310, "uuid": "14ca0d94-cc7d-49e0-88d2-21daea0ff09d", "value": "1ab810f65b846b0d1aef311bda3d0e96dcc806dd7bdfc7eb414a68d53786a6ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b14304-7c03-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648937, "uuid": "33d47c01-f659-4345-b99d-0b7d5c26c5d8", "comment": "Malware payload", "value": "850aaae69590cd576a589cef35768fce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648937, "uuid": "ef8fddc5-5f10-4658-82cf-ea47df2ae78a", "comment": "Malware payload", "value": "1b582f86043113376d91e7e699e0c7b9b62dce358a77a1ae0c7cd6f0d219a7d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648937, "uuid": "9476f773-e00d-46a8-939d-5200c50c4e87", "comment": "Malware payload", "value": "bc370d703a16fff1f376c2dd972bd7aa91f287b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648937, "uuid": "50bf721a-da15-4b9d-a520-509a96efea81", "comment": "Malware payload", "value": "93ddee13f88fc24214d4fc96f08fbb34da5f11db8b0c99ccdfb18c3ee137b64e86e27e01bd72434d7917a40d13855735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648937, "uuid": "d217664c-e8f8-4461-8d49-ebb93503a28c", "value": "T1C9B59832E6025FC2E72F57345D756F80D7CE26E7D43006AB921E773AE9E81A4881319E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648937, "uuid": "7f35f609-b72a-403a-ba09-d4eadcd4cccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648937, "uuid": "4d214b2e-f2ee-4c3f-980c-eb51b6c7e2ad", "value": "24576:kKi8lKKKKKKKKKKKKKKK2TnXEif/8stHVf/8stHvvMM8bVc8CKkVwU2yAXscvVo6:Hi8lKKKKKKKKKKKKKKKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648937, "uuid": "56369261-3e79-4105-b913-4e3124f5c1a2", "value": 2296320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648937, "uuid": "9b1f9733-cc8b-4b93-98e2-fa756cf35446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648937, "uuid": "401c9b61-d3c5-4275-887c-c9635e725b02", "value": "rSRL405120008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aca0f00-7c11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783655047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655047, "uuid": "e9efb703-a8c1-4745-991c-39dbaeccde37", "comment": "Malware payload (RemcosRAT)", "value": "6efcf29493c6363a552407059ab80c7c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655047, "uuid": "2c562222-4213-408c-ac1b-5fe775011905", "comment": "Malware payload (RemcosRAT)", "value": "1f08b33c61a20cb9327b1a529df79f2072ba72646631619e622eb0c1e6a6e8f7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655047, "uuid": "c21662ee-4ecc-4d1f-906e-cd79358196ef", "comment": "Malware payload (RemcosRAT)", "value": "afcd03023b10a951bb4a612a30602938389b761b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655047, "uuid": "9b71dce8-8849-4d6b-bf31-f2ea33da781b", "comment": "Malware payload (RemcosRAT)", "value": "83cdef3e1dfbcad1b6b5727efa25b6e0b1ee4f06553b775f0577b58c3e7ac0e30ee8e8f3907613f009e9ed6dfdc586a0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655047, "uuid": "b6a4a284-f23d-4f91-9954-a65b5cc54cc1", "value": "T1AEA24C76C94296445D070BB64C4EE62AD2954371E13100ED3E7CF36E2816A286FBDDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655047, "uuid": "14b7aad6-662f-4dff-962d-c24f09104f83", "value": "384:s+p2IwI3TSbFkKEeeMtNuCNItZMnYiZzuUulO07j7vva8BLM:suwb5dEhQLN3YvlNueM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783655047, "uuid": "534081cc-9c35-43f4-b1cd-c3ae370f45a2", "value": 22691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783655047, "uuid": "70c89c46-15d3-4fef-9516-de0691331798", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655047, "uuid": "fd2bc4d7-6a24-4da7-b70b-68c0721e921d", "value": "Laminaterne.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab498aea-7c04-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783649492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649492, "uuid": "d94cc9b7-bf52-4317-8e36-24d9e2b36721", "comment": "Malware payload (RemusStealer)", "value": "c4f11447afc4928a9ce8843fc81cb25c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649492, "uuid": "4d6573a6-17b5-49ae-aaf8-8833799ebc36", "comment": "Malware payload (RemusStealer)", "value": "1fc2634ee7f9bdddc44bdb2424e898e71d844b8935c2d9c6bb208a6a5befba9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649492, "uuid": "feffb6c7-9a63-4594-86cd-df264fc82599", "comment": "Malware payload (RemusStealer)", "value": "ac0ba770904dedc4cd0f713b89359048325993ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649492, "uuid": "c671b855-5b56-49f3-9435-4ef2cd1ad32d", "comment": "Malware payload (RemusStealer)", "value": "016707095b554393fb8b089a62488b1d7e372c4070aca33fa9194f9aaf2e674a6f219e2ed0886e92d3e3639afaf622a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649492, "uuid": "80ebd4d5-1262-4a4f-9df4-0e20cdc93106", "value": "T12324196BD25375FCD652C07852667232B732BA3847209FFB0393C7359E21AC06E79A24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649492, "uuid": "86cf0429-393e-4c8f-8d9a-ee2c4d9551f0", "value": "20f35ed688f00eacb2c7ea603d9f248e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649492, "uuid": "203d223b-6fee-4e27-81b3-7ff1b1a4a624", "value": "3072:n4lZxQqBgVY/9x82TLnGa3uTRWjIqdygeioPpXYHYyawyB7aQ1hp2YyR1:6ZxQwggL/uEIqdygetRxj77nU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783649492, "uuid": "6f2f93a8-fe4a-40d1-849c-347f0ac5fc43", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783649492, "uuid": "e65f1acf-9276-4d2d-8574-c90ebb361d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649492, "uuid": "872139be-f059-4d1a-8136-19e5a2a9a524", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c46698-7c67-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783691971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691971, "uuid": "2e2f6dc4-ee89-4fcd-a1a0-52aa13f94739", "comment": "Malware payload", "value": "117648e1c3c44a7ca0f77b30e9b9c583", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691971, "uuid": "dfc67462-4a8b-47b6-973a-faafe38889a6", "comment": "Malware payload", "value": "20fbd73d688c4458e00668df492de296dc836a480237ad7aeece700aa0a63448", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691971, "uuid": "2b2b0c1f-fa42-498c-91dc-62a80de00a55", "comment": "Malware payload", "value": "85f234f119b7c4bdc401fd96afac2d27cba69abb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691971, "uuid": "b97ef695-7180-4b30-bf2a-c9bcfe19bd0c", "comment": "Malware payload", "value": "0becf8a20642896d6f9d1c0e9d6f1f4bac2ec5ea7763e562fd415363fc5b41fb44823d99db88e8a7851a5017e7a5f665", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691971, "uuid": "1534a6c1-9b86-457b-a5ca-18037b0647e6", "value": "T1A2562282FF46D82EC07785374A564B3262569D2FCA83930785EC7A281D776E80FD9EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691971, "uuid": "10bbe8aa-3e5d-41ed-9e2e-f94c4e49cdfc", "value": "98304:NvORfCppHmqkp7UcaK0IqKf1zr3WLJoSNlGgYUQNuPDZCmd0pRGNOx5SrGNOcb8M:Vg8axUcrqC1WNoSNl/+YPDhGp6MwGOiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783691971, "uuid": "0a6209c9-f20e-4beb-aace-1356c1c2c4aa", "value": 6249464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783691971, "uuid": "21d2c11b-481d-44b3-a33e-5d1e2aee1c70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691971, "uuid": "f5b0251a-4b6c-4338-b4aa-05bb0b9035a8", "value": "\ud835\udfdb \ud835\udd4b\ud835\udd52\ud835\udd5c\ud835\udd5d_\ud835\udd4b\ud835\udd62\ud835\udd5c\ud835\udfd9\ud835\udfe0+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e3d9e27-7c68-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783692258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692258, "uuid": "a7174c57-f985-485a-baef-14c4dbaca512", "comment": "Malware payload", "value": "5db3b86e25a7da6a12b0c47bc9a8662d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692258, "uuid": "6d2f76e1-8e96-43ae-8127-13d16b89016f", "comment": "Malware payload", "value": "2290af43f9cecfcfcb7dc0a11318c7fb0b94f43356bd20b9ef8516dea0b05e3a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692258, "uuid": "6ec4c1b5-5fb2-4bbe-85d3-9d2d7685a53f", "comment": "Malware payload", "value": "750a6419ad1324fc63567b8ff3162b5850198135", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692258, "uuid": "56bf09bb-c5b3-4c11-adff-836a1d8deb5d", "comment": "Malware payload", "value": "f77ce04538beca661fb442be5050a96725a88a42a5bfa3ef6143add1a4b5a924a8c97c9119e1b36a44a9810b0f47de57", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692258, "uuid": "f393facf-52eb-4c57-acb8-08cb7f37e14a", "value": "T121662380FF55D92FC4BB05334AA3073536669E1E8682A70749EC722C587BAD85FC9EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692258, "uuid": "c85060ea-d7af-4319-aaaf-4d0d8f8ea4e1", "value": "98304:amD8iCdtjRIgeZx1KM3lE09EiclUsO4ysCTZOL5wS1bFdCyM4w3nMlGMcmFi:amD8fRSZ3A+C+Zk5wSdFdnM4w3SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783692258, "uuid": "66441599-a276-42d5-92b1-d081bd8ab230", "value": 6724608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783692258, "uuid": "bfc17654-c61a-44e3-bbce-ea6a401efa0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692258, "uuid": "92b53e4e-5a0e-4920-b0ab-d04bf5e294e9", "value": "P\u043epk\u0430Uz18+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2628b826-7c56-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783684487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684487, "uuid": "29af6381-ef6f-4f8c-9d51-6aa7ff8be617", "comment": "Malware payload", "value": "6859032df5ceb172a3f8dd34eb22186f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684487, "uuid": "8eda61c1-9fb5-4620-bc30-54db63252ac5", "comment": "Malware payload", "value": "27ed20da0e17778ec924f06b0acaa955c288a1075c28106a3a3b5ac5292464e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684487, "uuid": "f5901163-5b03-4263-9cb8-49591ca57e7d", "comment": "Malware payload", "value": "69c198cd3c292eee4fb5b477c2ee86ee0e110c35", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684487, "uuid": "bab69d60-ec25-4092-8ecf-97c686770190", "comment": "Malware payload", "value": "3cbc20ff7abe5b9bab724089658df1993b48d314e7df98f2172890a714a14f39bb07ac6af5e283028324f5b463e8b8c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684487, "uuid": "babec61b-3112-4fb5-bbc8-ab4da9c349aa", "value": "T1BA3833D0AE4BDAD111CF104A780EDD9B340EBE2FD0877292C8A8D2CF51F499E55D929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684487, "uuid": "2739649a-c1cf-4c57-9350-eaca33e5ba9e", "value": "3145728:uORGqO4k5q9KeLrVVLUaUJai0Vg4iYf7++v:uORGperVVfUJZ0C4iyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783684487, "uuid": "68d5d9e3-ad99-498a-a4e2-ba88108b3fa5", "value": 103197423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783684487, "uuid": "82c75ec7-ca42-4d42-ac97-5ad6d4c94def", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684487, "uuid": "9999f40c-8a4d-40b7-84d4-3432ed53c790", "value": "LG's Advertising Contract, Application Form and Products.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7a9c83-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648421, "uuid": "1b2fd832-a85f-4f0a-a9d3-1e7aece562d2", "comment": "Malware payload", "value": "7f4f2baabfab879d27720387a9378bf6", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648421, "uuid": "5857dd10-a466-4c5d-b91c-91ef09b0f687", "comment": "Malware payload", "value": "281d4d60fc99cf7f54819defb1c7c14b9202d46890936c4c6b9ebe3ddc75dd2f", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648421, "uuid": "f9587f55-41ac-4094-8898-4db0f6d2589b", "comment": "Malware payload", "value": "5d290d7f43963ff6a2528deab683954d4fb6c63c", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648421, "uuid": "b407dd14-b154-4ccb-a8ab-f1d2ad8ce075", "comment": "Malware payload", "value": "9cbab08e728f78513f53d9dbce6e90fea1f909c2196f8abab96d376deca59f9be144018ed37b4c39780615a24df70094", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648421, "uuid": "bdeadfc0-7922-44cc-b1d8-0425315972db", "value": "T19C23B44A77C1795123432EB7622BA5C5E85F0DCE7C90094AC12CBD90B9BB71AE4F7934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648421, "uuid": "4de52191-c071-42c4-a3ff-3634f16fd90d", "value": "768:UwushGrpmYmlUCYj+X3xWnThnhqWhv7kclz9x28cW3Oki2AvwV0eplOWJsT3otgp:KjpVBLRHIcWFW2KryNI1eJrxJcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648421, "uuid": "f9cda74f-09ac-44f7-af4f-7e653c488a00", "value": 46205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648421, "uuid": "940271d0-51f4-41c2-8637-c321f07ca466", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648421, "uuid": "c80d2ba7-8c07-4fb5-83f8-21b35f74383c", "value": "parser.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7469e9b7-7c62-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783689772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689772, "uuid": "ff58d0f0-d9bb-4237-ad72-1e8d64f30a95", "comment": "Malware payload", "value": "324eaa1afb425f7668c54b618f24ed83", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689772, "uuid": "ceaf4f86-a05b-4b66-84cf-f9b305ccfd3c", "comment": "Malware payload", "value": "28c594c6a9290f6953fdc578618f8f5ee0d96bedec6223f0ddef95beb92f121e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689772, "uuid": "6078fb22-9cf2-4d01-9810-c68414f68d64", "comment": "Malware payload", "value": "9ec1e2bbf0e39cc0e672ce2f06d2330a64e6c3e1", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689772, "uuid": "959abf5e-46e1-47b1-9916-2ec11f6ae175", "comment": "Malware payload", "value": "401986c4abefe7bbddd6ce51cbac75ac54eb0b71a8e1a17cf6e5816bea506c9f1b8a5858cbebe60d1f0271316845dbd5", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689772, "uuid": "f25bee19-1d33-4326-82fc-2ad0f6838ffd", "value": "T187C63394F2A409F7F4EB413CC653D439B676B9120F71C59F07B889A22E636E1593AB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689772, "uuid": "585dc3eb-3965-4d04-b7f9-5d015a2b0974", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689772, "uuid": "e94c792c-a896-4bf1-9d99-da8661a6a3a9", "value": "196608:4tokexuWZC0W+t2PKMmjdV6kh1DvgKaZca1pqhMkMgQvK3ehQeH2dCkBtp88cWt9:4oxuWZC0W+tHjdl15tFQvK3eaeKBpVtd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783689772, "uuid": "79ad4978-d917-485e-82f2-4a016c27a4f1", "value": 11620918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783689772, "uuid": "d2fcbe77-e18d-408c-9f46-73546fcdfb47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689772, "uuid": "56aec5a6-a86c-48f5-8f07-4d1996aba9e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9bd7b3-7cad-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783721921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721921, "uuid": "1cb62ecf-0833-4913-acbc-94581ca98df2", "comment": "Malware payload", "value": "3703e233b1a8dbd2010a2b7e6aa136fb", "object_relation": "md5", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721921, "uuid": "53caa3a4-cea7-492e-aad3-6a9e21eb0ef2", "comment": "Malware payload", "value": "29c252a26f6b8c08a89e1b83255bee5637819c50f72b1b974af217540df8fff7", "object_relation": "sha256", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721921, "uuid": "54b5960a-7abd-42b6-a5f1-041cb9d8eb6b", "comment": "Malware payload", "value": "4b6d2d3d8b7a8d0e53f9e305e3b4cebf8f9e6820", "object_relation": "sha1", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721921, "uuid": "c52d1ee9-642b-4785-969e-750ff1594bd1", "comment": "Malware payload", "value": "d0bea89497fa01a3d172fe0de94a71d1adc96c0f282795aa46bd67b69a5c7b4bd5713a5259713310098037f95e17d6c6", "object_relation": "sha3-384", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721921, "uuid": "6005d08b-f89f-4613-8338-4cce4c0a3a33", "value": "T120183333A25A602DE07A5F39697BE0368537FD316D274C5B66F4901CDF260903A3B39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721921, "uuid": "cfe7b294-85b9-4789-9f1a-673248391291", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721921, "uuid": "219bc597-72fd-4427-86af-6871a93f9062", "value": "1572864:4P5AgEP+C5MDEl4TKAAdVx5TL1/Ih1xdnoI+dgRH9qxKYmZf+DbEpX9d2sB0lOFf:X9DyAlSMxZBIPx6IJbq4LZ+DbE19d2sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783721921, "uuid": "28cec064-3a7f-430e-9929-c6e54aac4590", "value": 86918905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783721921, "uuid": "b879dd24-ee35-465c-951a-207fceaefea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721921, "uuid": "039401be-0878-4868-af5b-68150983b88d", "value": "Clash-X64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87427997-7c4b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783679925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679925, "uuid": "ea9d51ad-95a2-4837-b961-adb0e26cef8a", "comment": "Malware payload", "value": "b07f90a3df677165306a30d7fc479060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679925, "uuid": "05d00466-b1d6-462d-be8b-1b4fbff12953", "comment": "Malware payload", "value": "29f7aa7843b05ad7daec3204cabef2baea00f2ceba88f48724452bf6c54edcd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679925, "uuid": "093a0962-c976-4acb-9a98-329ad7b13889", "comment": "Malware payload", "value": "e8cb329108a77c9bec44566c97e9076d822daaaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679925, "uuid": "518c2cdf-2888-4d92-8592-59d0bac32d73", "comment": "Malware payload", "value": "27c9b6361f7ac81108516ccaecec11fa7170678ce2d20f8851ef229cde64438da49c64d5e54e6e653ae2889bf7b39863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679925, "uuid": "77dcc25c-27c8-4dc5-8097-a2060984dbc9", "value": "T14057CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC8B0E666EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679925, "uuid": "bf75d291-a171-4a89-916b-05c42a7848cb", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQq:cqYUQuVDt0TZEAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783679925, "uuid": "4b1e97ae-1c4b-4ee2-8cc5-2ed4b41b250f", "value": 29458432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783679925, "uuid": "1632d3ed-857b-4dc0-b20e-c46056428b8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679925, "uuid": "a0c92f2c-f12a-4679-af29-0da2c7899fe7", "value": "29f7aa7843b05ad7daec3204cabef2baea00f2ceba88f48724452bf6c54edcd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ba54f5-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648430, "uuid": "6fe7fbe8-e798-484d-8562-f8ca55240f61", "comment": "Malware payload", "value": "941573863e08a3efcba296e14a51b397", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648430, "uuid": "e80669bd-9aa7-4a92-9594-5b30cc326c86", "comment": "Malware payload", "value": "2d8d12f404151317ff562585b5d2e5ba728b7e8aba60d950835a1a80e6462c3f", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648430, "uuid": "4d339698-c982-4b17-bca9-4f9dc547fcb4", "comment": "Malware payload", "value": "4c6877085595a003d9e38e5608879cf4e98dc30c", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648430, "uuid": "a05628d4-9776-4dc7-836f-34008270217a", "comment": "Malware payload", "value": "96897bcf029499f0cf6c48d540b4bfc9c23fe2329530430d9447c6b269200a91613d9afd6a98653930bf239d25140e75", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648430, "uuid": "b41bec33-fd90-4d86-9bd2-71585044ee2a", "value": "T19B617593E46519B353B8C9D4298A21C836AB50870EEC3920F57DFE5CBB356A2727C607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648430, "uuid": "99e879cb-689e-436a-90ac-681720b5cc91", "value": "96:eUsMHCLJ/JBGzhbznugzlgQp9wyYK3RZyY/h/P:e3Yc23//h/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648430, "uuid": "7b47b716-dec9-4154-ba51-6e78e8a92cfa", "value": 3408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648430, "uuid": "b228c1d8-3b32-4bd9-83de-fae283f7f13a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648430, "uuid": "8cde382d-5a4c-4c72-9862-821e293529b4", "value": "linux.body", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c3d1d-7bff-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783647239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647239, "uuid": "27c82ccb-1efd-4e90-9ca8-9588b3d3fca9", "comment": "Malware payload (RemcosRAT)", "value": "0482c163b41a34dfa013b7371eb86f46", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647239, "uuid": "43b6fe78-12f8-465d-8d5e-66658a6ecfa2", "comment": "Malware payload (RemcosRAT)", "value": "3085170853d70615dff57549f0e44e6c3f86c35f36d658aeed03bf728061f2db", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647239, "uuid": "9f726a04-c983-4b1e-86f2-35fbf7423ee4", "comment": "Malware payload (RemcosRAT)", "value": "7cc4c5d9e9eb4aba8db82d4dc9aad12562fdeb6a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647239, "uuid": "5e07dd87-80c4-4706-bcea-b814b8533397", "comment": "Malware payload (RemcosRAT)", "value": "1faae1e239c73f317e4792a6651ff294b3288010527bb51a6238f251abbcdce07c11d5f3dc845ce7d487c1bc61c572c0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647239, "uuid": "67c20a8d-2742-4cb5-ac02-59304e4dffd5", "value": "T1A7A21B56CC450E849E8B2BF5580DB83195980771603245A4BE6EF3B7340EFA82E79F9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647239, "uuid": "3cda62c9-dbd4-425d-982b-2087d89668d0", "value": "384:s+p2IwI3TSbTgFdeNMVNl+hZKGAsKWzlsY8vTHCxYE5R3:suwbHAdc4qKAKWT8rm33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783647239, "uuid": "245a267b-8ac4-49fb-9b3e-776a878da95b", "value": 23252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783647239, "uuid": "149f9d4d-1924-4477-938a-db16310b91a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647239, "uuid": "5c86a48e-b3ea-41fd-88a4-6489ed7a6cdc", "value": "Gigantiske.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b42631-7c8e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783708879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783708879, "uuid": "ae614a3d-1629-4dc1-974d-f099425bfa97", "comment": "Malware payload", "value": "35e7f4289f5856d4265ec67987f8d30d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783708879, "uuid": "b987f0e4-77c9-4018-9095-6b3ea8e01a78", "comment": "Malware payload", "value": "31d54f8ca8b8f38857b719f97ad4e88218256bcf2690b3ae876196a4366abf57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783708879, "uuid": "c405b0a3-7a39-4bc7-9e37-ab470513c7bb", "comment": "Malware payload", "value": "dd053a9b191b448d1db8bd3722a902c86b0f02d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783708879, "uuid": "7ab1b335-283c-4e76-9fae-a2d67f04941f", "comment": "Malware payload", "value": "b34846e18e9ffc40755eeb8f4a48091a464237c8e9d12c032f579a443aa7a7dc6c29aba97a3de7946e439bb8afea92c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Bobik", "colour": "#339D7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "TrojanSpy", "colour": "#809E1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783708879, "uuid": "68a9cc2e-61d3-497b-abe5-8c57c8d948d0", "value": "T1BA74811CBE51E8C4CE692FF38BE65061577315C63EE2E253364A6EF8C7443A649A207C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783708879, "uuid": "3b792200-6710-4041-bf7c-9af25b111379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783708879, "uuid": "96009415-e8e9-49b9-837b-e413ee7654c9", "value": "6144:u52Ewp4YM3bxNF3r209EdRh+7lb8qFjG5ccRFRwWaXv6:A2EfY6J34dRWiqjCtnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783708879, "uuid": "9325624a-79ff-4c31-b8f3-484aa31e2bc5", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783708879, "uuid": "e903e801-fafd-4695-bf63-7bfa8e738787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783708879, "uuid": "ee0f0fcb-df3b-4b8e-b9a3-e8543a7edfe3", "value": "NursultanCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab6bcc7-7c73-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697245, "uuid": "f82e65be-43ad-414b-8c5c-e5809231170c", "comment": "Malware payload (Mirai)", "value": "ed1aab5ca873d27dcd23f617a1c39057", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697245, "uuid": "f1525467-8f46-43ff-b888-cb28f8030df7", "comment": "Malware payload (Mirai)", "value": "340bfb0fb2d53cb31ef8b089ef07b35d2a313dee510ea67b31c2dab1722fb14a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697245, "uuid": "2d969b28-23f2-4f56-9445-b00be3a5fff0", "comment": "Malware payload (Mirai)", "value": "d9e2675a2da983d227552ff5a92e9f436e59a92a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697245, "uuid": "4ee2759d-c678-48c9-adcb-a5e626946cb7", "comment": "Malware payload (Mirai)", "value": "ebd54e3e9ef919957bdeb7be0cd048c041fdf829a2534c9ad26c1b0b874d64fa11868569559db457692f0d843dc43971", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697245, "uuid": "795c0748-bbd9-4b11-81e1-f6633aa9f7ae", "value": "T170B39DDBF2471260C86246F007CB4BED3E2322816F27C5E77D2A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697245, "uuid": "56ad9972-63a1-4212-aa70-624b84e0156e", "value": "768:yK85XyaNNPzJPyTne9iXOCB/wsECoeIpCu2SZmKRT0FzBAVmmMRgIwXzpn554RZ+:ydX5NcheCBAPUuTAKJahmqgJXQ/LW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697245, "uuid": "4dad24e5-5885-4fad-aae3-3185940036ee", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697245, "uuid": "d3d9f601-5c45-4d14-ac9c-182d99c9121a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697245, "uuid": "683f6ff9-32d9-4e91-beaa-c541a1bb3228", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1ed34e-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783653013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653013, "uuid": "cdd0b309-0b3d-4b06-8824-3aa95a0b5000", "comment": "Malware payload (RemcosRAT)", "value": "13ed2a77b08df2b52e3420205e763a41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653013, "uuid": "22bfa8f9-5065-4a2a-9e1d-a2b986410ebc", "comment": "Malware payload (RemcosRAT)", "value": "34da1d049c92313152f28cdf5bad644bff93cc6beca25e139453e20ed7a1a85f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653013, "uuid": "f0ea21d3-a86e-4362-ab8f-092257838d35", "comment": "Malware payload (RemcosRAT)", "value": "6d8433dceb879d60c4fbcaf3c1fa66832d8ed101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653013, "uuid": "ea8a6422-c185-40dc-b818-ba85556b9b29", "comment": "Malware payload (RemcosRAT)", "value": "541c09597efdf72f70f779f520b12a6b70fde857e31e0ebd1c18d08a1e9c919db93e5ab8f954417f5681eb64789ca8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653013, "uuid": "e3de8f29-a743-4172-8b23-e53916a0be54", "value": "T1F8551298330ADD12CA925FF00EB1D7B405680D98F811D343DEFABEEBB57E6856D09291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653013, "uuid": "aa218b56-076a-47e5-acc9-0847a2ee0aae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653013, "uuid": "12831611-3fab-46ca-93e3-7a08f69189b2", "value": "24576:ImR6pFjWonBrNmUeBofK3O8GS6gSGtixOgWfdI8lf6vMwQEvPbof7jOd9EOae:IaixWIroUBSS8igVf6vMDwiOdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653013, "uuid": "75720ce0-a540-4f47-9c51-5dac57ef830a", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653013, "uuid": "45f6861d-5020-4737-967f-d113005ef3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653013, "uuid": "bdb8580f-f435-44d1-adf3-dae1c83d69a1", "value": "PO.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d3c9fe-7cad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1783722009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722009, "uuid": "955ea75f-a704-4a31-bf08-dc1ad54165b6", "comment": "Malware payload (RemoteManipulator)", "value": "200c4f697289035f228c5915a5cc6115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722009, "uuid": "77cbb5b5-5468-46b1-a5ef-63f7cba5b5b7", "comment": "Malware payload (RemoteManipulator)", "value": "350db1326d8bdf921d5dfcea54a713d19c8d4b6dddc265b14c55ae0646eecb7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722009, "uuid": "48a50470-2d0c-45d8-9f29-cd6a67fbebd2", "comment": "Malware payload (RemoteManipulator)", "value": "2bb9ded1f4a462336e0f02c8642f5e6fdf70260b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722009, "uuid": "6dcd1615-b75e-4265-b5f3-150b65e3bf9f", "comment": "Malware payload (RemoteManipulator)", "value": "a598d2afa8f19c74bc91a9af044fe8ce331530056562086d6e252af9c4cb00ec82be834403c9145d9461f61911947df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722009, "uuid": "63606c54-8f61-44e4-8458-4776e3b255bf", "value": "T18EC7C013F2865439D4A71F35697BE3766A3EBE204616CD5BFBE4290C5E322C02D2A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722009, "uuid": "9bf34b7f-9d50-429a-a632-292cadd80dc3", "value": "9eb20214673ee9d29dd988abf1e53afe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722009, "uuid": "dbe14346-42e1-46b5-af31-8af8996c4931", "value": "393216:2nxlOJDm13rc2EeJUO9WLcbKb/fNRvvA9a1DJMsd035QLVvucFEg1O0PfDWh3dOD:eGmN/bKfvAARptBe0D0dd1IMTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783722009, "uuid": "440ca8e2-3689-4eb3-be7b-61b0183900e0", "value": 55212544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783722009, "uuid": "1098bb7e-349e-4779-8674-2891aa792f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722009, "uuid": "ab22cab1-4b28-4343-b2d2-08153db99233", "value": "200c4f697289035f228c5915a5cc6115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fa6be7-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678063, "uuid": "21350bab-59b7-48e3-8c13-f00cac29b2cd", "comment": "Malware payload (SilentNet)", "value": "359c70e0164079efe7f10ca0faafa725", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678063, "uuid": "b7042e0e-39d4-4b92-8888-ab746ddd9342", "comment": "Malware payload (SilentNet)", "value": "3539dbf3d81846f8d7276dd66c63c210d6f50d622d1fad39ee371d1dab5760e2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678063, "uuid": "448a5687-1da1-4ef0-a198-a9c4a3e12fe9", "comment": "Malware payload (SilentNet)", "value": "22e7cf24e898f8c6afceea396ebd5b4b3e3ac490", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678063, "uuid": "26c2afb4-6e96-4d8e-8983-e7fc0452f730", "comment": "Malware payload (SilentNet)", "value": "0602b24a43be9223453b48efa2c11371a3afccf33a12584b8226709eb12ef5490627a94e4e6c81a75121937cb4730835", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678063, "uuid": "f459f653-7606-446b-a8c1-3232ded4b1f0", "value": "T1DBD63303FF29BEBED13FB23751808FD2FA2C05D1C016612E3761588E99C66AB4715A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678063, "uuid": "7fdbc8ff-63d7-49d8-8092-8d16407f5b5f", "value": "393216:RvaDe2kSKV6sIWl8SPam58zrdecXmewRu7t+:FaBkS4IWlBP2vxmiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678063, "uuid": "7ff10801-91ec-424f-a0e5-60a98654155c", "value": 13659030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678063, "uuid": "b10f55a8-e90a-4136-945d-9c6d30d99837", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678063, "uuid": "2e93b16b-bfd1-4b26-9246-0902fecee22b", "value": "wockyupdate2-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7203e3-7c11-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783655109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655109, "uuid": "63849eed-00b5-4d00-92f7-0ad8d16e16d6", "comment": "Malware payload (RemcosRAT)", "value": "093be3d92f4fcba7045f5e7616bd1337", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655109, "uuid": "5dad31c4-eb4c-41d1-88f2-e15b7978f821", "comment": "Malware payload (RemcosRAT)", "value": "3563a0dd216236d5f6f8bc871afe1f98f5bff78afe2d95f80276906dcdf278e2", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655109, "uuid": "984d434b-bc4f-427a-bca1-7da6d249c3c3", "comment": "Malware payload (RemcosRAT)", "value": "2d07a981108feef3cff710b5fc4aa88f3785a080", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655109, "uuid": "73f558c0-ccca-44e2-834e-571002758e14", "comment": "Malware payload (RemcosRAT)", "value": "b0d419cf5b64ae3be2e1cbf112b8cad1432d8184d4a8736c0e9369cb4f9858c008b3de5690f49788cb85cb0f33bba863", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655109, "uuid": "80b82ba1-7081-4d86-b750-2211e8230aca", "value": "T1CBA2F9F5CC4106958D035BF69C08BA20D0B54BE3E53044B5AD7EF3E8590AA68BE789DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655109, "uuid": "43800a9a-1475-42f7-aa92-c17a6d75a935", "value": "384:s+p2IwI3TSbUBZldecpMLNvb6u0IEzisyt81+X1kz8wKDt3qw:suwbODd1py57Tt8oOYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783655109, "uuid": "eba7bcbd-e60c-418c-a0ac-cd183eed85a5", "value": 22845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783655109, "uuid": "7793a0a1-e4ef-4000-ae10-e3d633284add", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655109, "uuid": "68f98368-8a34-4746-8e07-f9a08ceccf7a", "value": "RFQGoodsLogisticsLandedCost20260710Returnurge.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad07351-7c81-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783703312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703312, "uuid": "62340b11-2895-4588-8d5b-b3ffafe0a580", "comment": "Malware payload", "value": "844c772727f2c39aaeb04c2e37aa2e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703312, "uuid": "c325388d-222a-4c8e-9ced-a0e558a3be09", "comment": "Malware payload", "value": "3600a7ce118dbf9950ac2734abcb8648408b3638085397b94e0c19c193cae3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703312, "uuid": "b3d0f001-9bce-4507-a631-57cf9e1ccc3f", "comment": "Malware payload", "value": "757921e440465cdfaf33b11bd9a567ee0e364314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703312, "uuid": "7cfaec98-8710-4346-a3ab-aabcc1d9ecab", "comment": "Malware payload", "value": "a29b50f7b8f6dc15bb968d53a8e17423c081a41eb72ad96a76f50671e6dfebc904bcd070c9e909583af717b6f822660b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703312, "uuid": "3355f651-e95f-4c75-8c85-7f8c1ebca7af", "value": "T151E73337F049523BE0AA2B355EB3A024983B96504D928D1BC7EC759CDB356303E7B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703312, "uuid": "c9b09e30-ed69-4c4d-ac60-d0ad0c9cbcde", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703312, "uuid": "6256725e-38eb-49dd-80c9-4c38c9c2fd66", "value": "1572864:4Ab5tU/EvsBLTW4qIIbDNCRJ062JC3JuuODB7SUOTa1B5n:4Ab5tUesoaI/NS2KJ0DUUaa1Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783703312, "uuid": "01fadbb5-9bd1-4a80-a6eb-61d681d3b6ba", "value": 65923936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783703312, "uuid": "a5a8a934-b69a-4553-a49b-7ecb9c7d73a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703312, "uuid": "6d00f417-1557-4e44-ab5e-3cd8616ba01e", "value": "PQ02HilYcX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5def4fa3-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783651939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651939, "uuid": "e7119142-8f8f-49d0-a495-98d3d7fa7a14", "comment": "Malware payload (ConnectWise)", "value": "660630762cf338cf269b41c3b9335c5d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651939, "uuid": "fa2b6919-82e4-4462-8f98-7a8167d192ca", "comment": "Malware payload (ConnectWise)", "value": "36bd5ca4aaedc3d7f377de097ba915eaf4774fb07cb080aec7e5359c7128c1a6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651939, "uuid": "62e4bcbc-1607-4860-b938-b297ae2f5202", "comment": "Malware payload (ConnectWise)", "value": "d42090aca71e2381227f71e6361f7deb29c27835", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651939, "uuid": "204e10b8-1aca-4f52-bf11-14c2d1c6dc48", "comment": "Malware payload (ConnectWise)", "value": "7dc8ebb3237d629f42ab28dd02a158508bd40ff80cddd93e867cb66c74fe5f0876c7d6f1af8b9bdc6b5e925d07215381", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651939, "uuid": "944c1c23-5f68-47c3-9ed7-cd87d87eef20", "value": "T1E9D73322745C52D92DAC0564E6079FEB66379B2703BCF11B3EDA1789FD875A38232E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651939, "uuid": "f7e93806-0a63-4310-8825-6a01e15ea2de", "value": "1572864:oxNJGVoP05MiR29l33xQdsDvRLh3+OIa5gyGeolzeZAFOMehv:GPcoP05M199WGNhOOIugyKzeZAChv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783651939, "uuid": "5fcb5a50-20e8-42f1-9a0a-8eb691be35c6", "value": 59953379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783651939, "uuid": "f3b1627e-2c88-4b15-a217-d9d6279bc9e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651939, "uuid": "8081327f-ca3f-4d5f-a00d-ea911afc12df", "value": "ivcam.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b3e84e-7c4c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783680517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680517, "uuid": "c87a260b-1e66-4f26-b13f-7110db440764", "comment": "Malware payload (SalatStealer)", "value": "3298425727d0644a337faeef0a259802", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680517, "uuid": "79322510-3b9a-4abe-b804-2e05a1aec491", "comment": "Malware payload (SalatStealer)", "value": "38b184d316cda0368a6dcead584e84fa7bdc53fd12b117860e16bee849f46963", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680517, "uuid": "b1ff4ef0-5927-479e-81ef-3baf46acd6ce", "comment": "Malware payload (SalatStealer)", "value": "507b161a23629d5a6ede55c8ba9bad5f6e0ed513", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680517, "uuid": "3181bb97-8b18-48b9-b984-172e07d7148b", "comment": "Malware payload (SalatStealer)", "value": "e474e3ba3263777c3ed8e53164428d5df4476abf9d1e4426fd7a101a99fabc6e0fa15127ad637383799ddb2ed3e2cd51", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680517, "uuid": "faa2f3ae-a1a3-4634-aa04-2656fdb5f4ea", "value": "T143F533239BDA3521CB4F81BA3E943AB233BF7949E4E34600E134EE9C65B93D54891D4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680517, "uuid": "06d5c88a-12d7-43bc-a1f7-c3f6b8abe1b6", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680517, "uuid": "a4153ec1-f3a9-4fa3-8d5d-f4765408f5b1", "value": "49152:buI8DepXqD3xooImioqgsuGbJF+VBuN8IG39zdsiYJ2Fdsv0qO3TF0h6n/sS:yI8AqDmToqgsuyY3uN3Gcig24q0h6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783680517, "uuid": "1030fdd4-4a52-419b-91fa-1823676526a0", "value": 3594752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783680517, "uuid": "54539a3f-5a99-45a2-8776-c4a4b71fa36a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680517, "uuid": "91cd8dfa-da0d-44d3-b490-7a03077a8509", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d83fde-7c7f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783702101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783702101, "uuid": "ce7dfd7f-fe02-48a0-a104-36c257faf215", "comment": "Malware payload (Stealc)", "value": "60dc698929db79870c6d04ddd5eab49e", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783702101, "uuid": "31699e2c-b832-49dc-b671-6c9c49be91e8", "comment": "Malware payload (Stealc)", "value": "3907be4e7ba8c00e7ed8222ed801fab49272147cd1e37120db827ba81e327853", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783702101, "uuid": "93c83c2f-0fea-488b-8f27-3e4a505624ec", "comment": "Malware payload (Stealc)", "value": "9583d61bb8d6eef05472fa306e585f5c95526a7b", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783702101, "uuid": "4284f869-cbf7-4974-99df-c2b4d04d7149", "comment": "Malware payload (Stealc)", "value": "045751e78e228ea5562120e3bf928bb640dd4076489737c6a42d2ffff3a5bda7c808ebd8d54fc904258ac2959aa2f079", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783702101, "uuid": "3ebe936b-24b4-43b0-9cd6-a30aa9711781", "value": "T11795234B07D590AAF1354375D6F281AB9234FD661B7892FF3241B62D2F325C8E630B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783702101, "uuid": "05c8de2b-2155-4dc9-9e7e-3b5e433bfc4e", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783702101, "uuid": "35601aaa-bcbf-460d-9d86-f4e05d4de3bd", "value": "49152:oGjHg2Hw4eSgvZDXr0WGPq7vCSlvHPBfe:TjHgbgg9gKWSl5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783702101, "uuid": "2b538106-9aa1-44e9-8b01-67b4d9252d11", "value": 1933312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783702101, "uuid": "1c465232-6c4c-4957-a914-e100fa9122ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783702101, "uuid": "59729c3c-e3e1-467e-8026-8572440a574b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c3e0ab-7c23-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1783662552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662552, "uuid": "62c38e90-0a89-481e-a001-eedfc2751d0c", "comment": "Malware payload (RustyStealer)", "value": "be24a7ff3d55f1b0b790dbec25fb1695", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662552, "uuid": "8a6c9027-b641-443e-9a0a-b94ee8f70ef2", "comment": "Malware payload (RustyStealer)", "value": "414d268d7f08654ce40f25c564ac3ac4b624007eb73c09a10e4bb2ff734d6295", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662552, "uuid": "bb397aca-62f8-4b2f-9fb8-529fc14e40a8", "comment": "Malware payload (RustyStealer)", "value": "2d0b2c22db90bced28ac61e4a32a185859c5ae86", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662552, "uuid": "fd1c8a37-9b5e-4c1f-8592-74b576bd77b6", "comment": "Malware payload (RustyStealer)", "value": "cce0a7a8b8d47d14c2cca3617b668e963b714675fb02b4e410edcd823d153418b607ff7db13ca92188c9e401de3503e4", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662552, "uuid": "1ef147cd-75bb-4f56-9df7-708b8de7b936", "value": "T11767F168024CE388745F4636E394F83FF2DC35997376E8A9BC39D1DAA4122C6C279587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662552, "uuid": "89919ed6-56c5-4c53-a32a-05d71316470d", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662552, "uuid": "d204de5e-a7c6-41e5-bfb3-f34cf131fe77", "value": "393216:fA/3ZmCXGq3DwQ+R/kJlCs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:fA/3Zb2U8SCahDLBtVbD1DT9SfhMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783662552, "uuid": "c4b33d05-fddf-4f9f-a96d-e21e45007804", "value": 32469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783662552, "uuid": "a939fec7-c0c5-482c-8566-14674e38fa37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662552, "uuid": "20d09de6-96ca-4058-b2b7-c492f69e4034", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78539795-7bf6-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1783643393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783643393, "uuid": "0fea5769-31fb-4d94-aee7-f6a1c265b1a6", "comment": "Malware payload (Cobalt Strike)", "value": "8d183531f684f78bfa407ee9b49709ae", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783643393, "uuid": "154f7f8d-7bd5-4199-92be-3110cda9a912", "comment": "Malware payload (Cobalt Strike)", "value": "41bfb4bb51823fd994d0f34504be227ea6367c9506bb99ca0f1bef6968fd7fba", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783643393, "uuid": "722ca6a2-4313-4546-8eea-568ee2e9a013", "comment": "Malware payload (Cobalt Strike)", "value": "17f23766491eb4fc2624dd99b84f7d82d58d7751", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783643393, "uuid": "755196bf-4019-4376-bd59-16eba267f6c2", "comment": "Malware payload (Cobalt Strike)", "value": "c772cf0a807d299f00e877c16788718b76dd2efaba81a137cba3ea52baaa029e61d8cdd70c64d2139843174d438ff971", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783643393, "uuid": "1817276e-578a-4ae5-bdd0-ca2c30398458", "value": "T186C1730633B94C9EF1E76B7498AB4672713DBC306D36DB2E4680522F28726044D0A732", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783643393, "uuid": "23036ad9-58dd-4808-8042-20e5d7bb6a83", "value": "7a1164872bc8cc127a4e2bc0d7a665cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783643393, "uuid": "4254a994-ab41-4e61-a362-9f7d4cb67a12", "value": "48:6kzj1JySISBDxoZ0rZx4DbQStOSZDpSbeEF09Ju:OSI30rZxhSXGbF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783643393, "uuid": "178cda3e-f4e1-490c-9f7f-20c59b7cbd22", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783643393, "uuid": "e3c54a30-4300-424a-9caa-b1895e4f26c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783643393, "uuid": "87a00ec0-6f29-40b1-a11c-ebba333c1b4e", "value": "javaw64_xor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce01a8d-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783678109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678109, "uuid": "7da8dc2a-c1ca-4e31-b066-5c90afc68bf7", "comment": "Malware payload", "value": "f0b61343e6d42bf08e24f95ef1a9fcee", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678109, "uuid": "2144e20c-c141-4801-a6eb-bdf306fadfc6", "comment": "Malware payload", "value": "482eaafcd2e09b3c766c51546bbe1a2af495eb1c7bada6f87deec4d27ce8c837", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678109, "uuid": "7d81d8e3-7921-4561-95d7-63a2810a1b43", "comment": "Malware payload", "value": "08a13e0f2f53e7972a4bb3c30d9310ced8a6afb9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678109, "uuid": "c46a77cb-3be4-43ac-8672-d1840156e500", "comment": "Malware payload", "value": "4ef70038f5e6ddb0b6572370f16188aec29bc3c7bb507d20856dff2375ac1d9fdaccc998da896bdd60d21ada778708c5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678109, "uuid": "9bb47d41-ab97-4805-8f46-8d83e2d13b2f", "value": "T101938EB2291D7178DA056BF4788B2966524013CCFADC7F17CB40D358EF8EA6B1858E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678109, "uuid": "54692efb-c943-4c63-a580-4a6c8afb4bd1", "value": "768:Ewq2XJPB4reOEPPaK6SRFaRXWlCs/1ui2HuwSFzeCpF7gz0Uw0y0y0y0y0y0y0yg:ENRnEPPtXAWlv1ui2HDSFzew7gwYf7kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678109, "uuid": "2a0cf406-3f75-45e7-964a-49fb4236de62", "value": 90348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678109, "uuid": "3aef8978-9822-4382-874c-7013c6112f00", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678109, "uuid": "b32b1fb9-6b1c-44c3-ba9a-5234f4b24ebb", "value": "1_11_4_1480_11.02.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bd3d78-7c4b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783679953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679953, "uuid": "284e283d-e5e0-4496-b061-7008a3c424ea", "comment": "Malware payload (RemusStealer)", "value": "19f235b2a219eaa317bb0cdf87464175", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679953, "uuid": "59a9e688-e77e-4fae-82f6-06e8145510f9", "comment": "Malware payload (RemusStealer)", "value": "485163c279b9dced626742d7fbb6dc9deb989459ba4781aac1a733c9f9b67596", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679953, "uuid": "c7d3a0f6-5f9b-48cc-a1d9-39ca3c67c2a9", "comment": "Malware payload (RemusStealer)", "value": "747d3e6a68f00e4d2f65a4bf071d2c2752a7d1ea", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679953, "uuid": "234af964-43b5-4b73-89cb-06d8f743edbf", "comment": "Malware payload (RemusStealer)", "value": "d6aad04a41c9a31a984ba032bad601df1d0e6db14e1ee3edb2fa47c9bed64c97aa98bba1ee04c51f7b1214b001be6cf2", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679953, "uuid": "e391cc08-40a9-4718-bcb4-85d2ea50f5cb", "value": "T1ED548E1AF7A908FAEE77913CC9524505EA727C164761E6CF03A04A672F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679953, "uuid": "712c4488-fcdc-4692-964b-41e754537433", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679953, "uuid": "e29a0ad8-1e1d-4ba0-aea3-1077c9c5c1dd", "value": "3072:CpD/7+957J14/FtcrTx+h0KpnzB0f1gHhCgw5m9FlIsinqKxVqNSwnQ5udgMH4Vw:KT0Uhr1zBE6YwLmCE69kikuRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783679953, "uuid": "a376d4cd-62e0-47b6-a4d6-1fdf6f9acf72", "value": 291328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783679953, "uuid": "5684b553-7fc1-48bf-acaf-cba646e25ce3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679953, "uuid": "9fad1044-a59b-4724-b9fe-d875285bab18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302a7ce-7c74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697367, "uuid": "24a522e9-9f29-42cf-9f22-a4532c01f808", "comment": "Malware payload (Mirai)", "value": "1e5899dcc38a475ac4de9430d47c9bfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697367, "uuid": "233bfeec-0d1a-4793-9f59-ae4a35a79078", "comment": "Malware payload (Mirai)", "value": "5126cc4c568a9b9894b04bdb9d9e095a22483a88c5a99da294e0d3844646f6ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697367, "uuid": "7d425407-2529-40df-a02f-777c8b1fce3d", "comment": "Malware payload (Mirai)", "value": "c217b736cb2ab49cfb1287c18dabb061270a72be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697367, "uuid": "ed8a2e96-10cc-4e18-b6e6-17be901a8688", "comment": "Malware payload (Mirai)", "value": "b18e400497e9208589b3afe329c38754aa6ce5dd90770a62b7fc15556e3033687db85c4ebca83adf55517d5f086ae1d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697367, "uuid": "2b10f90d-b3c8-454b-a794-4040199736ff", "value": "T186A2D078C5118FB1EADE5E320E00B1A1B6E41F1E3B9B9CD276829F81561BC636D01ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697367, "uuid": "cc95b611-5daa-4702-b11a-c348e4effe38", "value": "384:VoioDiGCDfeIepTfnCy8rdX0BmtUObk1/fQIFxpB/+RlnSHesEMfpM4uVcqgw05j:VovDeCprCyA0syam/DvpB/+eHQx4uVc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697367, "uuid": "aa184ea0-7beb-4e2a-ace7-fa2bc01d1f1b", "value": 21848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697367, "uuid": "007e069f-8ab3-48e1-8dad-cf9473f3fcf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697367, "uuid": "21c077e5-9439-4304-acdd-5b8614b6bece", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2bf5fd-7c44-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783677118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783677118, "uuid": "aea8e124-cfe1-4f0c-909b-3ec181a48681", "comment": "Malware payload (Efimer)", "value": "d9f41571617f5566313d683b8750483c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783677118, "uuid": "71f80f88-3f2b-4af2-a3de-9e494c350dbe", "comment": "Malware payload (Efimer)", "value": "518820c647ae2a73253b8cadffe1c3881be40936c228cf774c85af42a1c06b9a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783677118, "uuid": "6a68fb92-728f-4a95-a9d1-13683a7bc600", "comment": "Malware payload (Efimer)", "value": "43bf652c52e286bf637b42f2ae8a6aef92cf9f2b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783677118, "uuid": "7aad071b-6af9-44df-930b-c5b0c64ff372", "comment": "Malware payload (Efimer)", "value": "22391628b8c0b223f5b349f06d247f8ced95b1cc5898689fc95279de8e037320b21f68ad23cb7ea291a89976f55907c0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783677118, "uuid": "49b93461-6a49-479c-9cec-2a98a7f88668", "value": "T160E6331996E042EEE9735139EFE253A5E52874A71F72CACF461883A0BE530F04D3DA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783677118, "uuid": "ac915ac4-2cbe-47d1-98a1-866954d1e68f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783677118, "uuid": "5baac59a-0dfc-4562-a867-83a91cde92dc", "value": "393216:2d6Ga3RG0jPq8T9HBM1ozduTxTX8pPXMCHWUjX5cuI3/PGTAI:2AG4MoPpT961o5uxX8pPXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783677118, "uuid": "d3bd8037-28cd-499f-97d6-2c906682ea1b", "value": 14316551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783677118, "uuid": "88035a64-ad26-43c4-924e-96da218fcbdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783677118, "uuid": "ac8ab2dc-9468-47bd-ba3c-7898fbf1e11e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ea5d41-7c23-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783662633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662633, "uuid": "226a2769-442c-4126-8f87-f1ad1c8c65b3", "comment": "Malware payload (AgentTesla)", "value": "2e6b7d23e38a68787f7a3615c98a4c3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662633, "uuid": "43b57724-1c69-47ed-ac19-94a9f4092cf9", "comment": "Malware payload (AgentTesla)", "value": "519a65d4fb032533e24e94fae4289c277f4a91c501c1b292f425962280369c28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662633, "uuid": "54814b60-5413-4ad5-85ed-6d617a6c22c7", "comment": "Malware payload (AgentTesla)", "value": "5a9102a2e14032be8a0c142381469476f2191a70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662633, "uuid": "cb3c99f9-6628-42a3-86a4-eff12605479e", "comment": "Malware payload (AgentTesla)", "value": "4acc38bb388495046d75ca938af391ec222cf286ca739cb5a9a99ccd9d4698a63ccc244d4e09329c806f2f9f4bce786e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662633, "uuid": "a230402e-89db-4af4-9c2a-d564a18cfaa6", "value": "T1DB659AB95AC87A6FC0911E619F1AFA40BC5CCD4CDA3AD78D6E2CD9F150C3D48A364836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662633, "uuid": "8ee483a2-f2d9-469f-a309-9030bccb93cb", "value": "96:/6X3RiQgVjmBLI7yRjPrh/gmSWuEWjM66RuRyR+o90CMHfHhHJUz:iXIQg5oLI78zqmSWulXCMHfHhHJUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783662633, "uuid": "a9b406d9-b3d9-4c7b-8d26-21478c085c1c", "value": 1519874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783662633, "uuid": "b8666bd9-0641-42c1-b4cb-c335983f1055", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662633, "uuid": "b04a375b-53b8-41b9-a2e2-dff48e87a470", "value": "quote#specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63a0812-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783653026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653026, "uuid": "e67a9253-c38d-45ac-8b4e-c2de73c5e7e1", "comment": "Malware payload (ValleyRAT)", "value": "1967745b78718a571407fce13485412b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653026, "uuid": "616a9c99-76e3-4fab-b0cb-ef53d4012d1e", "comment": "Malware payload (ValleyRAT)", "value": "539abaeb1d337bd77d51589b1debe5339e87f2e07f62235d9b1ada5a11d6d056", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653026, "uuid": "f3eec1a5-09a9-43f2-b7da-0387d3e258d1", "comment": "Malware payload (ValleyRAT)", "value": "08998ae5a8c8634c098e9fd80a59fdf085d04c7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653026, "uuid": "66dff6da-bd7d-4dfd-b277-bf2f2c7ef801", "comment": "Malware payload (ValleyRAT)", "value": "fee60befad4baffb16f087958b445bae798b5834789ecd3f9ab4cb2e02b788de26ea8facb0bc5a2f86104cd64b7bc121", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653026, "uuid": "b3414260-a9de-4e7f-90c7-5ff23f4e1633", "value": "T156147D217280D236C1DB1638A9BB9FB31D7D6971076A85CBB3948E790E703D1BA3471E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653026, "uuid": "ba0fba55-b842-452b-a886-195b303e645c", "value": "51854b55cb5d96f3c48379e874452e51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653026, "uuid": "eb011c1b-0cb2-4c3b-8163-38f76b814697", "value": "3072:WyNd6vSgEBrE5STBVOyyqGBoTPoEuEahUOl7vztHSd2GXxHJW8:WyNZBrxlxyqGGTpuEahUOl7LU1pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653026, "uuid": "9135f06c-cd52-4955-b972-56081186d908", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653026, "uuid": "9bfb332e-6d91-467e-9a54-9163753ee4f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653026, "uuid": "9ba76762-14a2-41c5-b2bd-a10e6d80ddad", "value": "1967745B78718A571407FCE13485412B.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c96a38e-7c08-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783651024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651024, "uuid": "122aa015-96ad-4756-8070-ced12f6f89fe", "comment": "Malware payload (ConnectWise)", "value": "4cabbe67c383da28e50dc3d48e1aecc3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651024, "uuid": "ba2bddd1-717f-4603-911a-c2e828e6639e", "comment": "Malware payload (ConnectWise)", "value": "53f0f718847c209a482f3fa3f52a5ce5245af57da1aa03ecb84d9c3133750955", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651024, "uuid": "ecbc260b-3580-4155-83f3-5fd3c64b0e8f", "comment": "Malware payload (ConnectWise)", "value": "ebfa946e7c15049e439ca507349c5ff4b92458e0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651024, "uuid": "379d0515-f058-45ab-ba14-72fce0ab4a7f", "comment": "Malware payload (ConnectWise)", "value": "5804f9e5e2604a7638863c6f86151d7e623023b319a7d74d452c057e12bfa02c7887c7ad9162494dc5f8562ca6cffe9a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651024, "uuid": "9ad6f04c-d9fe-4e6b-926a-82ac63dd0376", "value": "T1A208335172E6D02AF0BB1B322AF6E25088FB7E41A931D90E2691555D4FF3A406D3CF27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651024, "uuid": "27ac76bb-bcec-4c97-9d2c-33113c63680d", "value": "f1783104dc04202edb1280448f79953f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651024, "uuid": "c57fb77c-0e24-457b-b103-2459972fb0fe", "value": "1572864:BdnnKkFZmw7lq97FqK0+/PM6c/8PpqnZcbjmXijmEYZ0bNpUdJdYv:BBnK87lq97gCpcigZcbTjmVEzkvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783651024, "uuid": "68ac4abf-20c8-4b36-9327-8af6577db40e", "value": 83886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783651024, "uuid": "a43c641b-1d4d-4250-811c-96d3d045f488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651024, "uuid": "e5ecd30a-5d05-4b06-9c36-f8cbd06c6620", "value": "dsetup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d133e4-7c33-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Loki)", "timestamp": 1783669805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669805, "uuid": "950b96e3-3dff-4c5c-92b1-58f85de42db7", "comment": "Malware payload (Loki)", "value": "8ed6ba61d3f45cc25d65f72605ed3f18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669805, "uuid": "ba50c884-7636-4b3e-9cfa-3272eec2dc34", "comment": "Malware payload (Loki)", "value": "558695e3c131c802602abb91b368cb4a1f04b6cf48b4e8ffaf86f1ec30394730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669805, "uuid": "6ca6c627-8f22-4094-aef8-db2bd5eccbe5", "comment": "Malware payload (Loki)", "value": "0b021082f6584ff7ad306d7f81371a3d666febd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669805, "uuid": "cd8b554a-6d15-4521-9dc9-f954212f1783", "comment": "Malware payload (Loki)", "value": "8a28351178ca2714a89bd90b59bbe24bf7068d1ac7016223c47afb571d7bd1f49e937251eac385e0d152c315bad373ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669805, "uuid": "fbdb5278-9f9c-4895-bc53-7eef8f765bd4", "value": "T17DA31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669805, "uuid": "5b970fc9-9691-4c94-a322-80160a9967e9", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669805, "uuid": "6c190b53-d722-4fda-9152-1e6c88bf3f74", "value": "1536:6zvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:hSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783669805, "uuid": "c0b69a3f-fe10-41d3-b7bf-5a982ef8e7cc", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783669805, "uuid": "59f1e0fc-1ac2-41aa-9d07-598f1b814ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669805, "uuid": "988d474f-0345-4947-aac8-3459ca9bd825", "value": "8ED6BA61D3F45CC25D65F72605ED3F18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2cd23fe-7c01-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783648323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648323, "uuid": "d0d5cb5b-399b-4b00-814a-38001d8cf14b", "comment": "Malware payload (Efimer)", "value": "a1d1d914cd05bb1cbced378d002a44f9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648323, "uuid": "c33961f1-201f-4079-995f-efcaa27fd044", "comment": "Malware payload (Efimer)", "value": "56ca405fa5c12838051af41d5b515a3dc6064531eaabe635242d13e0e72de848", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648323, "uuid": "f6b6f5de-9591-4a62-a3c8-cf67b0cc0087", "comment": "Malware payload (Efimer)", "value": "e4ef197da5354c0a2948f6a2f14104c587a9b385", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648323, "uuid": "d6d4eee0-10ff-472f-b467-24833db94147", "comment": "Malware payload (Efimer)", "value": "47291c8295721c3cad2e10064e689313f642a7c81a3664974d46e2b8645903bc7a51397d0032be2cb54596f1d568b996", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648323, "uuid": "0eb2f3b9-0262-44ce-b4d5-22b5c5170472", "value": "T138E6330569E461EAE6A3017CFDF1A5D6E1F9B4A44372CECB0F5483627D431E08D3C66A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648323, "uuid": "667abf42-20fe-4b0e-8320-0b552848812b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648323, "uuid": "3e39b93d-b4c9-47b6-ac2c-1b96279a9e67", "value": "393216:dC6Ca0xirCidCmJwb3be815XMCHWUjX1cuI3/PGTAI:dokWiVwXeS5XMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648323, "uuid": "b6d4007c-98bd-4855-af27-b1fa7b6a2f86", "value": 14324244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648323, "uuid": "ae4ce2bf-e79f-4a09-9353-32079ed62db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648323, "uuid": "acf0611b-e033-4e83-bb5e-0e27629a175c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc596a44-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678323, "uuid": "0270c8d7-d18a-4b24-9806-1a67df125d9e", "comment": "Malware payload (SilentNet)", "value": "d55d6a4722973772857f242f86a2ef4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678323, "uuid": "ef8df39f-bfd9-411a-abee-5a4ddbb2576d", "comment": "Malware payload (SilentNet)", "value": "5867c518b37d23212e74e19ddfca7c78c1ffee07de17db413a75ded7d2d58b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678323, "uuid": "6be78af1-196e-4a57-86ea-e1e16b1b19c3", "comment": "Malware payload (SilentNet)", "value": "255f8f700beb2825b333fbb78ec584816a6c2954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678323, "uuid": "7c4458d3-8607-4b7d-8287-2a1ae2c50f4c", "comment": "Malware payload (SilentNet)", "value": "7d6649fc10e8ae5893c4e8dffa38c35f523b1abfbb8cfdaa934f0e386bd2f31977bd4482fb96f57631e0e8112aacbb3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678323, "uuid": "be94c226-2ee7-4573-afb3-0498be87ec47", "value": "T1C6357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678323, "uuid": "f2dca897-6477-4d4e-a1ba-d8d4e83d9034", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678323, "uuid": "3a4f437f-2e3a-4b60-93e5-1479e5485522", "value": "12288:SZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGpvPqItNquB:Scb4M06WpoPrwCvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678323, "uuid": "f668b7fc-1699-473d-b6bb-63fa817cdfcc", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678323, "uuid": "80f17fce-5af9-4a31-ab86-2f034b3f1ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678323, "uuid": "7bbce8c6-52f4-48a8-8422-2755ddd53d6b", "value": "Prestige injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c964391d-7c04-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1783649542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649542, "uuid": "ed7e57f1-05a7-4b86-9c2d-3690b3776943", "comment": "Malware payload (ZigClipper)", "value": "44faf223cbf8b4bd1d4221476322fab4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kkc-vogueatelier-cc", "colour": "#2EC7BA", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649542, "uuid": "11e8f1a6-8443-45ab-8c66-d9ee200b74f6", "comment": "Malware payload (ZigClipper)", "value": "59eb2fad261dc13a1e9bfab3a57cd51a4841f82787130202ff348bbaf2c6409d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kkc-vogueatelier-cc", "colour": "#2EC7BA", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649542, "uuid": "e7f51dc7-d20c-440a-bf4d-c936aefb6140", "comment": "Malware payload (ZigClipper)", "value": "a11f2aeabbb8ebfa0e66c457ecdc06d232b4ca51", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kkc-vogueatelier-cc", "colour": "#2EC7BA", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649542, "uuid": "30c6a6f8-2afd-4774-9d15-ae8e224d4c16", "comment": "Malware payload (ZigClipper)", "value": "ca1f44a62acba4bf1b8ca3e46a44c10ab89690de366829bcee8e832f9d667dd7a634982366a5e3d3b1c3962a3588ebe6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-RemusStealer", "colour": "#9FE52B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kkc-vogueatelier-cc", "colour": "#2EC7BA", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649542, "uuid": "d6512bac-7586-4567-bf46-6c9e0b1a7991", "value": "T18EF54A06BCA149FAC86AA23189B351927B75BC085F3233D72E90B7782F727D05D39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649542, "uuid": "491bc5de-8b42-492d-9816-fe87d282936f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649542, "uuid": "eb180d21-1d57-495b-b905-27bc3fca163b", "value": "24576:GY5HURZGU5LmtS1JbmfVzDaf0lGwhAR7wYv3iwjPZ2Bele5IK2J8yFKJ9yrbwARs:GYxw0iCcbmdfKAh8X71CZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783649542, "uuid": "692e9dd0-f5a3-47e9-8e3c-0676590c49f8", "value": 3409248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783649542, "uuid": "2ab61b26-8022-4148-80c4-bfafe4d62194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649542, "uuid": "d24528f5-757b-4edc-8d7a-5251557f78a7", "value": "nvd_driver_dll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61824c57-7c4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783680721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680721, "uuid": "e40d8dbb-a2c0-4132-b899-e32dda8d8253", "comment": "Malware payload (Efimer)", "value": "982be584be605ccc38f90ff57060efbc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680721, "uuid": "a396990d-7088-422a-ba28-e0febc8d3a6a", "comment": "Malware payload (Efimer)", "value": "5a2f726ab9db35f6fe00d364f017e09cb0cbd7a13d98e2a9cdbb12cc7676ce51", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680721, "uuid": "c354430c-162e-4214-a032-6156b52333b2", "comment": "Malware payload (Efimer)", "value": "e4f5fa66cc88f57cbf61c8d1881f36585298a466", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680721, "uuid": "916e58b8-d7fa-4322-90e1-aaf9f80a451f", "comment": "Malware payload (Efimer)", "value": "ffe1aa2ede9518818f3adacb320633f5743bb518523f6514838a2561fb3de369684320667a87eafc908366df237c4142", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680721, "uuid": "44c4cfe3-c460-48d9-b95c-bad2eaab72fb", "value": "T17FE6331C36D012EDEAE7503DBED60192E9A434A70B72D5DF07A8C7A12E773E08C39656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680721, "uuid": "5a6624f9-e1ee-4c9f-81d5-c03736281d3f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680721, "uuid": "08f9f901-fdd2-4eff-9fc0-efeac38af0c1", "value": "393216:BXP7iBftKT6H7S8k16GOwoh9vXMCHWUjXCWcuI3/PGTAI:BTWPH7S1TYDXMb8XoH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783680721, "uuid": "6c277ed4-d831-4aef-b902-9895fdc982e2", "value": 14312586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783680721, "uuid": "13566674-81c0-40f8-8370-882cd8fc21e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680721, "uuid": "f710bfe3-c203-4da4-b938-76e10d4e75ee", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba47c49f-7bf3-11f1-ac3b-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1783642215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783642215, "uuid": "368b8515-7f3b-4a84-a945-990d41f588d3", "comment": "Malware payload (KongTuke)", "value": "75fdea7fe58c169665fe42493e26b708", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783642215, "uuid": "bb9ed62e-31dc-4ec8-837c-02aa69371e89", "comment": "Malware payload (KongTuke)", "value": "5ac0761c29fc5487ce913ce7457117844a269cd1058e96ac0ce3b8b6ca017caf", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783642215, "uuid": "2503caa9-93f6-4de3-aa2d-a94c6a0a646f", "comment": "Malware payload (KongTuke)", "value": "a6a060db7d8754fd4b67071b8debd7ce8a7aeccd", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783642215, "uuid": "7b00778b-716f-4386-b57b-988165724e16", "comment": "Malware payload (KongTuke)", "value": "94582baa6b78b9a66a3546853cc85f1cc812e5acf0aea2c3343197f49354ddd452771f5de6bf0344e2a55659f22eaf9c", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783642215, "uuid": "8803a552-c7db-4536-ad82-9f0674a37124", "value": "T19E6633D959A5B53DCFAFBF3901C410629390FBCB1EC930A26C20E922954DC5A7E719E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783642215, "uuid": "a03dff2c-0ea7-4b8c-8e3d-46cf2d80cc12", "value": "196608:07UekvKjIiptC5nYv/UxKcZDv5euSQ/8Li2:07UekSjI6mnmAhZteu3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783642215, "uuid": "6ac61569-7fa6-4fc0-9bb6-4d87f6751333", "value": 6974834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783642215, "uuid": "2565c01d-091b-4f07-9367-73d63f3b9f77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783642215, "uuid": "b471b61f-e88e-4cb4-aee3-c59e031e69ac", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677209cc-7c01-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648089, "uuid": "b08d150a-d684-49ba-b8cb-65063764e338", "comment": "Malware payload", "value": "cdd760bb12371103fba3760bf4c71ba0", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648089, "uuid": "4e469c24-0c59-4080-a15c-42f81749897b", "comment": "Malware payload", "value": "5af50126946695fdd63c761bad06b5644f686a3b7ab3e3ac39d2c9ac870bf032", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648089, "uuid": "bf97f9d8-a467-4245-ad09-1c298da08cca", "comment": "Malware payload", "value": "35d0d812f96d2efd38b3f0cedb632f2214643e6a", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648089, "uuid": "19da77c1-6e54-46a6-b987-12fd5077ac8f", "comment": "Malware payload", "value": "0974586d028463cd0a3418d499b5dade1b61b103018b076f04a44a41f1d823387b5d3d51cd976cf3be7b1b82d69ac8f7", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648089, "uuid": "4e6379de-e589-4b5a-8010-f8b93174acd5", "value": "T122D633F6B02DA036B6B82087986322467CB89E402D3CE9D23FDF4711DE9534F1556AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648089, "uuid": "6665fc20-61c1-4455-acb5-4a655bd1fe1c", "value": "393216:U8kzpQVLUqJ8sifNoF+0j2cRyJJgN02bLNncXUuHPwUMi0:AzpQV9J8sYNoXqDJJgN02bJcXUGPwUMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648089, "uuid": "0683fad2-0e30-4a12-b7f0-2610d5307392", "value": 12840551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648089, "uuid": "5e239790-ecd3-4825-a94f-41fe35ec1eba", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648089, "uuid": "cb83c27f-f403-4418-bdd8-1d0752da650f", "value": "preplan.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d9794c-7c74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697316, "uuid": "655023d7-d085-40a0-9ff5-01d61f44f0d6", "comment": "Malware payload (Mirai)", "value": "1350bd23dccc878dd53fc6a7fb253e6a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697316, "uuid": "f16f0d07-e937-41e7-a785-6b09a82b4a45", "comment": "Malware payload (Mirai)", "value": "5b9df6a1e5aac72129980b89d769d7aab0a35099cec7c8559346f22f33093fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697316, "uuid": "444a9a08-8d14-4e41-aef8-78225cb7e4f6", "comment": "Malware payload (Mirai)", "value": "817866dc59399b00f62f7060e918f2c427d83d01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697316, "uuid": "0ee62465-cc49-449b-90d1-abb31562db03", "comment": "Malware payload (Mirai)", "value": "cf54b40b47928904fa5dbbaf777a8f371a4b75ffd602d4a204a2ca53b14aa9e53b7747aa4c40aff0fd81602e69061e31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697316, "uuid": "8f98cef4-0414-42cb-b9a9-ff33dbda9191", "value": "T1B4630A45F8818E26C5D5027EF92D128E371267E9E2DFB2239E205F203BC692B0D77D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697316, "uuid": "46a6addf-505c-4562-a0e7-499a0ac37e91", "value": "1536:6tnSZigkxMwIaIWDxqKlFaQz4dBALr5Bjc1I7iUCnr02fh:XihxdIUDxhjbVtCnr02fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697316, "uuid": "3a5866e1-0248-4aa1-8c94-24e77adf52a2", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697316, "uuid": "a85ceff6-9208-4e59-a7bb-796cb175599c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697316, "uuid": "1d265406-4d67-4a3d-9813-7244303bd1f4", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab421f01-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783652068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652068, "uuid": "9509a610-01d0-490d-bed3-9f0e5f09d2a2", "comment": "Malware payload (ConnectWise)", "value": "fa8a532dbd86570df852f5992d3b297d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652068, "uuid": "a3cbb2fb-d4ef-4c72-928d-e19019239a10", "comment": "Malware payload (ConnectWise)", "value": "5c01b3af2ca6b789a8006d902f738f81bb99c1696b352c1e6444fdd78b37cdcf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652068, "uuid": "8cf6a0ad-3040-482d-82b4-721947c4e9a7", "comment": "Malware payload (ConnectWise)", "value": "608aebc6b8a73526d4f9f0cd9d736b185e64210b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652068, "uuid": "60bf5454-4277-4fdd-883d-e252f2b2cd70", "comment": "Malware payload (ConnectWise)", "value": "72bae1234819a556e0870c6284fad9d831fa66cf52ba0365fc784f67f4e262e4391be410b65f3816bc5202b47b33cdec", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652068, "uuid": "beb4d6df-2e6e-4ec8-9046-c19e844bf82c", "value": "T168083331A1E25AD0B69872E950620C7C817BCB29DFC887FF734B5987E48B2D67854C63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652068, "uuid": "a64224a6-a1f2-46d1-aed7-63c050856d91", "value": "1572864:iN3ctthkiHPf/Ye0/7Y2VHY6sm0Xx+XnX1ijfydorV0oXvt7:I3ctvfn/Ye0jnVHZsh+Ujfr17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783652068, "uuid": "7099e5fd-eb6d-4a1f-9f2c-df5605156e1c", "value": 82638707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783652068, "uuid": "b6c80090-f043-4451-a21a-04ceaf6d0648", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652068, "uuid": "4f4d92c8-0913-4dd6-a8e4-c63905c28b7b", "value": "letsview_setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7905ab1-7c49-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783679174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679174, "uuid": "1685f9cc-e96b-49eb-951c-5bb47216d7fa", "comment": "Malware payload", "value": "1234de8debf75c7dcebd01e419614fc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679174, "uuid": "a5fe1895-f40f-4e63-a498-325a2730c5a5", "comment": "Malware payload", "value": "5c8f6b545303f7fb165ad781a113df34ed5008767888e129b4181cdada3977d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679174, "uuid": "6380357f-bf5c-45a9-8eb7-9733c6438b21", "comment": "Malware payload", "value": "c573df87b4536a01149db7ba3b6f1bc2f25173a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783679174, "uuid": "dbbf7ef3-8409-4512-8d6d-9b6cad30b378", "comment": "Malware payload", "value": "2ac6184cec15af5897ac7aaf4c519d704fb20b97ea39ad5b7cf59fa011d7921ab36ab63d78465d8dd26954a1278dacf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679174, "uuid": "5bc336cd-6d22-4319-a4d7-6b1953052f5a", "value": "T14BB6E67B63E44168C19E813AC052CF50D9F3BE76073FC6E702A11B1A9E617C4DE7AA25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679174, "uuid": "bed86a35-aa60-40b3-8992-bc06b4f070c4", "value": "c8dddb2d43dd7ad64cab9cd918876bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679174, "uuid": "8d459d05-e275-4d91-a0df-8c7689dd9842", "value": "49152:oATO0GILCbQ6nBQwEeygpI1qSWihTbviZZS4Acs+oeojrpLI2o4dienqZe95Zuae:zYnTNNLfoeojtdph9LuaHHsfN8jUYar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783679174, "uuid": "e528a997-1445-46f9-a0c9-d4facd4a6698", "value": 10984880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783679174, "uuid": "a0f51b57-f9ac-473b-815e-a6034c16f1e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783679174, "uuid": "d92e579c-3e2e-42d6-a3bb-ebaf02b705b5", "value": "Lumen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201ec80e-7cba-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783727426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727426, "uuid": "e2b9d82e-68d6-4c9c-9e9a-1ab9fe0eb127", "comment": "Malware payload (RemcosRAT)", "value": "7a4e204497445c36a0de08a68e0f6af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727426, "uuid": "64b1a21b-cddd-49ca-8ba3-05cd24321bbf", "comment": "Malware payload (RemcosRAT)", "value": "60314e99e9c7cf30f9b51fb1956852dafc4d87d996cb56cd05040640cdad99a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727426, "uuid": "1a649079-ea98-4a10-b170-bc3821108b26", "comment": "Malware payload (RemcosRAT)", "value": "345e668fb8a5200cb437ff160f79d4882b2d2b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727426, "uuid": "fe22ce7a-76e6-469e-8799-7125c6cd5e15", "comment": "Malware payload (RemcosRAT)", "value": "19d82343fd1b8e416942f4d41975384d1eb3f7536ddcabf4c6da9d96aafc6c55cad88ddf07cc1b3c6b9d55c20d80915f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727426, "uuid": "af59d287-f745-4784-afb7-fd32e3198680", "value": "T10DB4BF01B6F2C1B2DA7654300936E735CEBC7C21183699AB63D61D5BBD30191DB39BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727426, "uuid": "5604db8c-1afa-4556-9221-aec82fd35555", "value": "cd443d07fb22cc071cc33eee6cd16e2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727426, "uuid": "d3465dad-ff3e-4d1e-b749-1865e230017b", "value": "12288:i97mmDmUefn1CvVkeClYRLwvcHk2c+IsPZOr4s:ilxDmRnkvVkhYHk2c+DZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783727426, "uuid": "b1ba92b5-bfbd-4e23-b3f1-eb2d7c151319", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783727426, "uuid": "c79d0e7b-c1f0-47aa-94d3-f44afa9c6a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727426, "uuid": "9e1e2f8c-24d4-4748-ae5b-8b715ce37d27", "value": "SecuriteInfo.com.Trojan.Remcos.1074.656.7210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85b3ab17-7cad-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783722013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722013, "uuid": "404a32d2-d687-4325-9a37-05f28c93015b", "comment": "Malware payload (RemcosRAT)", "value": "fd1f184d36cb8474315a807522efa3fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722013, "uuid": "0e82c9af-34c4-41de-964f-bc58b6a4a72f", "comment": "Malware payload (RemcosRAT)", "value": "6144677a8ff6d6cb5b04403c9f07ea326419600f9b469a95502fa022613c56bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722013, "uuid": "2fb848b3-2720-4acd-be28-c9b72bf1c6ab", "comment": "Malware payload (RemcosRAT)", "value": "c61820b5c586d328c1afa4196a67132eaa81d316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783722013, "uuid": "9c5cb793-1373-4c17-ae69-ccd82efc2d3a", "comment": "Malware payload (RemcosRAT)", "value": "bb9742e2e9ee4e73fa6e0b603bffc78fcd2db9c94206dc83fa2da37448b029bc82b71761c5527772e92c498a42542702", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722013, "uuid": "1a2d4624-f8d4-4d5a-a608-68e01e27839d", "value": "T15DB4BF02B6F2C0B2DA7664300936E735DEBC7C31183699AB63D61D5BBD30151DB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722013, "uuid": "f40dd636-bb9a-4f0b-8b5e-4c601b561bce", "value": "7d5125df1b721f19e7f94988d3e3ee5a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722013, "uuid": "38fef26e-edb8-42ce-8a17-cdef93fc4087", "value": "12288:VlQAiR49ckiK7JV8AuE4lKC/kPHM9/IsPZSZj/:Vl0GcNUJV8i4mHM9/DZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783722013, "uuid": "e11a1a03-0889-4589-8d6b-fba0fb9388bc", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783722013, "uuid": "f6ede921-9cb8-4736-9794-9b23545f7c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783722013, "uuid": "e83909ea-750e-4f81-bc21-624c1152f58f", "value": "6144677a8ff6d6cb5b04403c9f07ea326419600f9b469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153126dd-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783705933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783705933, "uuid": "317fef8f-c6ce-4421-b9bd-3155bfb5e710", "comment": "Malware payload", "value": "b71e1c8f90b62ce4e508fdf18ff64230", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783705933, "uuid": "a925b89b-4da8-4af7-b51d-8534f2d87f97", "comment": "Malware payload", "value": "64e7d1a4a87ecc13cac7f59d2994e1bd0ed1fd275fc98a03a144b1ba4dd68e57", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783705933, "uuid": "5ab88c7a-609c-4e11-bd99-dbf82723af8f", "comment": "Malware payload", "value": "ff8a8b823b2bfe485dbfb864e97f043d135b3562", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783705933, "uuid": "193b1d7b-b770-46a0-a57f-ac1596ebe2ff", "comment": "Malware payload", "value": "79725c48249a16ad8930a8a186d55e4823dd0e8fb1e50a3a99b72a7254cb1e1731b29316dfbc12b9ff9ff812c618a5f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783705933, "uuid": "6e73d60f-b522-4852-b31f-9c4eb1b8b0e8", "value": "T1C2E6334C76E006EEE2B7813CEDD2A590E67574754B32C9DB63A4A7A12D272E04C3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783705933, "uuid": "464fbee6-f049-41c8-8113-70c0ec248b26", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783705933, "uuid": "b247c0b7-2571-48f7-9435-eea2ed10ee81", "value": "393216:9rKcJmB32qBzvApItjktyxe8uOtXMCHWUjXycuI3/PGTAI:9uca32MztjktyxefEXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783705933, "uuid": "09b8aa25-a55c-4a60-a4db-64faa8721281", "value": 14326989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783705933, "uuid": "2e5681c5-9993-4baf-88dd-d3bf7d1939a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783705933, "uuid": "d0bae8a1-77c9-4583-9aa7-2074b03ca647", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44b501e-7c12-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783655520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655520, "uuid": "5f2d0e3f-858f-4d48-961b-e4915981451b", "comment": "Malware payload (Efimer)", "value": "914f0b43128f5ede1083809ab35b144c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655520, "uuid": "72b5cd42-acef-43d3-9106-26d9b831c98a", "comment": "Malware payload (Efimer)", "value": "6953e6d2e8facd1ad7eaef3d95e3aae39f660a539329df240582dfab4501b49b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655520, "uuid": "58d5f2b9-3983-486f-8570-93e351245695", "comment": "Malware payload (Efimer)", "value": "daa33e089ca3b9adbbf5bf3b12153c6323cd01d2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783655520, "uuid": "67e9e2f3-9b28-4029-8d97-f550c66115bd", "comment": "Malware payload (Efimer)", "value": "b8f36779f0237cb0e6bbab0e61a9f6e39204bfe0637ce6ea17ff7bbae07753a9ac91a65e3de5ca0c5283095ff089d53d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655520, "uuid": "d2629711-080d-4c50-824f-870c0bc7e94d", "value": "T16CE6332878D000EAEAB3413CEED191A9E869B8A50736DC9F97D4D2B57D531D04E3A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655520, "uuid": "dd415bfb-f975-4fe0-8bf6-89e726494f8e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655520, "uuid": "faaa096d-2aaa-475e-8bbd-587fecf1de6d", "value": "393216:Vmqgf2Ssw+WfafHFBJcpzDFCaQuZy4XMCHWUjX7cuI3/PGTAI:VPJS+VNHcWaQu84XMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783655520, "uuid": "85e4c324-fcca-4ccf-a9c9-fd470af1df48", "value": 14286491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783655520, "uuid": "5a0ca1b8-68bd-4366-a0be-a9ba1b67430b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783655520, "uuid": "005da0d0-c998-43eb-b72c-61c8ccbb0297", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cbc0e06-7c67-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783691799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691799, "uuid": "ebda7992-12c3-4543-b537-0f55987bdce7", "comment": "Malware payload", "value": "015770c97dcdf990a54b0f9124375cac", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691799, "uuid": "003e45b9-8166-42fc-bc18-8b8d22071c40", "comment": "Malware payload", "value": "6963d22462fb4525e0e3208190906f545b8e507753b2146ffc9f5f7183042fa0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691799, "uuid": "7babf2b7-2c1e-4721-8432-c8cc429c6721", "comment": "Malware payload", "value": "df57abb605546b0956f92fae2d4b818aea070e3c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691799, "uuid": "cecaa65e-0ae8-45fe-819d-adedfe913579", "comment": "Malware payload", "value": "3a8239be06b15992e33f26e31a09ac628be0e0d8953b734049f826e19bd1307fb177890fd97a2cad6a7cc2606c2b66d7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691799, "uuid": "7c5e53ef-3268-4c51-878e-eb882807fbfa", "value": "T13A562281FF86C52EC4B754374E9206326696DD3ECA87A30784EC36285CB76D84FD9AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691799, "uuid": "bf6b2dbe-d72e-4af0-aa63-6619343cc298", "value": "196608:zczRly96o+DTCIPz5k8xFxUpWJK579zd3BAh5rEV:Gy96oU+Yk8xFqc679zdwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783691799, "uuid": "4faa4298-0f4e-40af-8d98-40ee8db268bd", "value": 6422184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783691799, "uuid": "2b5edd6e-6fad-4f8a-8620-e9377404c9fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691799, "uuid": "ff7bb295-75bf-47df-964b-d92177ef3024", "value": "tuktuk185245.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b4d520-7c01-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648086, "uuid": "056b9926-9b9d-4aad-9415-9e0e00926aae", "comment": "Malware payload", "value": "ef9bb7c80e2726a5870f42e1ea0d1898", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648086, "uuid": "336118e8-56bb-4a08-b054-0d6039af46dd", "comment": "Malware payload", "value": "6db4c3d2ab56227d36eff59d1dc9e13eadf9959996fab1e0b04591cc5e637d04", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648086, "uuid": "8ebaf0e1-91eb-48a5-bd87-6e4a5b2a8398", "comment": "Malware payload", "value": "d37f272e9a7c77d1c491296fea6ed62305bb15b6", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648086, "uuid": "4f6aca14-2c32-421d-94c7-87b3fb0e7666", "comment": "Malware payload", "value": "9eb7a9c9ada4912d838d6d8f3150d1bd4d1fc20e58646e7e59808703de166901004307a86eee46ca1dcdb773cc309693", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648086, "uuid": "dab381b3-a43e-4623-b9bd-d712087cd25c", "value": "T1AE03950879C1759023431EEB372BA1C6EE5B0CED7AC409C7D20CBDD4B9A1716EAE5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648086, "uuid": "c590b6ed-5024-4a5d-b5fb-0fc316c85119", "value": "768:8XIh1snfVY0dQFVd5vfbP4l2f/Azc3VPJDYjuhIPPF08bUp2n52ARGorqL2RLjdd:kIhCfdQFV771k21LcKN4tFL7olHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648086, "uuid": "d47333eb-375f-4946-af97-41227820d3d2", "value": 40072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648086, "uuid": "1eca2ee2-2ef2-4257-a830-e8e0ad506f04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648086, "uuid": "2ae63851-65b2-49ec-abdf-768f940f1c36", "value": "loader.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a30b04-7c74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697470, "uuid": "3b87944c-10a8-4f3e-95f9-d0113b570ded", "comment": "Malware payload (Mirai)", "value": "b87b7f4a28382e04494f7ca1158a75dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697470, "uuid": "ca49192d-9d82-4f12-9c7b-c94d2ab31f8e", "comment": "Malware payload (Mirai)", "value": "6ecef1c94e9d47e2da55d0a8c4ee45ddbf289bfe4bcbf7787b994d669b3009e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697470, "uuid": "1dad4fb6-271d-413b-94a4-f903d50fe2c5", "comment": "Malware payload (Mirai)", "value": "89b9882c336c3c0965477cd84d84b29aaef36a76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697470, "uuid": "f86022b1-c6d4-4f20-b2b3-566a7a524a41", "comment": "Malware payload (Mirai)", "value": "78ec3f319fbc5d75e4b0f7dd01518d4100644f3d4788755b224b0b2fd12abd84672dc5f7b2cba58e946bb72220af8e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697470, "uuid": "4350dfc7-4667-45a8-9bbc-fe82f87dd6cf", "value": "T1D1334A02726C0F57C0A31674252F1BE487FFEAD122E4F249655F8B6A8A38D371489F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697470, "uuid": "c5d8b2c1-2a39-4e5e-9778-30059f10fda5", "value": "768:aOXp1s5T7RrIhC3hI68OjAbYXQXaRHVo6rnFRf6eeGyyQgIktHwD:ZEHS683sXT9VouFQG8gI8QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697470, "uuid": "5792cf50-9730-401b-be0e-324395b942e5", "value": 53036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697470, "uuid": "01324a48-c2bd-4bd0-a1bd-1de12509e6fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697470, "uuid": "5f2f792c-2e57-4525-954a-0fa6896bdce9", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3585c191-7c49-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783678929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678929, "uuid": "5eda5545-a970-46a6-92e9-28679581ac78", "comment": "Malware payload", "value": "bd8916cd89710e5ef14fc1745c848b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678929, "uuid": "df469259-a2b9-4388-93fc-57429d774a12", "comment": "Malware payload", "value": "6fb08191292b05a4f8deee0561634954736f6ca0ab25b25f09bdbb12b1ba6560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678929, "uuid": "7116b760-ebf8-426f-9fa8-2ab112a209cb", "comment": "Malware payload", "value": "706395bd0edba3ca8ff1bb3e9cb9880651064321", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678929, "uuid": "c09e3845-fadb-452f-b823-2c08e88c9c2a", "comment": "Malware payload", "value": "9ee352309d253f23f83ce8d4b6e2c29f3223caffdb6edd22f83d4008e5d0968d68be18f060bf28685ea81ecf43e3db46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678929, "uuid": "93b6cec7-70d1-41e8-abed-8249a95b2449", "value": "T1C5168C06B8915D6AC499373148F27112B728B8085B3E27D72E61A6B63F333D25CB3F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678929, "uuid": "6ced5a33-19ac-4ee7-9b09-5c6295f117ad", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678929, "uuid": "abc012bf-a040-48aa-9fb0-01b9777ec165", "value": "49152:CBcFzF6h5a1ejI/Xc0hdLJf3qSXfE0uJ+H7GXT2YRY99NaVIU:CBguI/sgeSFuT2bACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678929, "uuid": "31ff1d0f-6bd1-41cc-a956-88f0e96b32b4", "value": 4059032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678929, "uuid": "14ce3f8d-c3e6-427f-9ac5-c3debe1d1d3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678929, "uuid": "18c594e7-ecb4-46a6-bf49-3ef3d1c4bf07", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3137eb59-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648428, "uuid": "4e137491-1bc3-4900-8bdc-2413be8ac124", "comment": "Malware payload", "value": "5481c71576080900fa6e2be030d3fad0", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648428, "uuid": "8dd2cc38-9588-402b-8bdb-93275f75c150", "comment": "Malware payload", "value": "7135a3a2239145504e6fdc81bcdef7bcbd69a06727b638a59ba1f3e76130eb1d", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648428, "uuid": "a7d11a12-32ce-485f-9b26-f224d1be18ee", "comment": "Malware payload", "value": "15c95b7ab4eb870d534d6e5f3c4d2b27c4c68895", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648428, "uuid": "bd33eba1-9241-42c1-b65a-1860c3be4e25", "comment": "Malware payload", "value": "16aabdc51a7a718b4246897325f86fdf3edc68250d637a2c9574bf691c67d5ca6cc0ac7740827ce7fabf74e4ac15f9a7", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648428, "uuid": "d6823dbd-6fec-4085-841a-9a6c720b7843", "value": "T138F0228748491972E7591ADC7A1C1842510C8BA20B8A4B79A2CAACE6BC13DF8711B309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648428, "uuid": "1eef12e0-83d3-4491-9377-83141defa5ac", "value": "12:xQB1/YB/di9BRrF4mas6swef/IKFnEHd4qK54EtwcIuH87/Zx:KBBYB/Y9BRrnY0fwEnU3xcpc7/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648428, "uuid": "4e3de327-c497-48e9-9419-dbbe84e88784", "value": 584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648428, "uuid": "7be0f7de-c072-4468-aa10-a6087a2cd28e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648428, "uuid": "79940a72-e03b-4199-a5f2-50f7e757d92f", "value": "w.body", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9222baf-7c2b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1783666319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666319, "uuid": "aed07468-bb7c-436d-85ad-977821b8e1d3", "comment": "Malware payload (GCleaner)", "value": "845a1bc9408c542cf748ba647c2e680e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666319, "uuid": "05d2800f-d24d-458c-83b8-753bcd7ec2bb", "comment": "Malware payload (GCleaner)", "value": "7197e9097b977d138f3856a8aca3a3b3c6b28b82cc76a3667ef1364e820195cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666319, "uuid": "0cfeb337-2acb-4335-b6f8-2a1f1ea7d790", "comment": "Malware payload (GCleaner)", "value": "caceab5925bfda9eac39d24585f42db05071f531", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783666319, "uuid": "47b6998f-c555-4626-889e-14db7cd9925c", "comment": "Malware payload (GCleaner)", "value": "653e6d440d92394472d15e593458e674b648e6c8d2284344cf97ab3f1bc18f9b50e8dd8227435458d72b374583c2d261", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666319, "uuid": "b56a4dda-8a0c-406f-8435-7194f1595fa7", "value": "T17DE49E22A1E0D437E1621E799C1FE3EC983ABE103E2554462BE45D4C7AFDE837966343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666319, "uuid": "efab2501-27ca-4159-acf5-293375b556b4", "value": "b214386fa7f97d3d3252c87b8bce8333", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666319, "uuid": "75cc63fd-146b-4cbd-aedd-8d2e418c717d", "value": "12288:f+ZPf6yIvNeNF682QTY8ZO5NDVM2skU1Ef0IrhQ:G9f0YKsTR0zDGJ1hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783666319, "uuid": "4ab34877-162f-4a3e-a99a-e7e3a68918cc", "value": 688400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783666319, "uuid": "e74c3135-639a-4b47-ba41-dbe200e04d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783666319, "uuid": "97635f71-e044-43be-bcf1-67f7d7ea2b13", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e992cb-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783706156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706156, "uuid": "a4b3b21e-1ad6-4c68-937f-c3fd5148f380", "comment": "Malware payload (Vidar)", "value": "82c702a0029990197ecb1b7a60bef9cc", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706156, "uuid": "26cd200c-1336-484b-81de-1b28c4186f24", "comment": "Malware payload (Vidar)", "value": "735bc2580f3949340bb0118c2c926f3036ece7ccef54c3d503584295b2409562", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706156, "uuid": "8fa5ee71-e1bc-496a-9070-3029fa6bf52e", "comment": "Malware payload (Vidar)", "value": "2fc558a2d35539f332f012e16a7f4745e8b2ac0a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706156, "uuid": "84e2b438-5a95-427b-8e9e-a64df9a870cd", "comment": "Malware payload (Vidar)", "value": "ff546dc72b50f320136ac5c6caaf637098f30b25c8f59b252d734f30b07fdb8a0b434454e11bb9976527c64772132899", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706156, "uuid": "a538c9ac-ebbc-45c6-ac17-75a8c2bb353b", "value": "T12CE59C06BC9208FBC4A9733189B2A1917735BC441B3A37D32E50B7782E72BE16D36795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706156, "uuid": "07b2f2c5-b89d-48a4-9a72-9642fc56f4e9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706156, "uuid": "2f40dda6-0ce7-4a45-973b-033e510a3b83", "value": "49152:z0z+fvxISXFNU5CSgIBLO/AZd3TSd9+gch9UGAh7R0:z08eUSTYje/Uzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706156, "uuid": "52ed4072-7214-4b7f-94ce-b750a657a30b", "value": 3255664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706156, "uuid": "ab841050-8590-4e14-b5c2-8ee729f067ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706156, "uuid": "3fb1b0c1-4c79-439d-b420-88b80e93c3b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5961e8-7c57-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783684927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684927, "uuid": "7c89766d-2609-4186-b16b-f97ec4301bd5", "comment": "Malware payload", "value": "7716e278a4fa0db12ef08524f3815fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684927, "uuid": "7d906be7-08a8-4528-8e1d-bd765f37d410", "comment": "Malware payload", "value": "74fef06cff2bb57ccfa1916228ff751ffda777c37f03fc92c46139311020900d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684927, "uuid": "e067f532-475d-4099-90e7-88dcb5f581cd", "comment": "Malware payload", "value": "973502bf2fb6319e18573f589daa99be9900dd77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783684927, "uuid": "b3ca440b-511a-4af3-b165-76a6c1465309", "comment": "Malware payload", "value": "402cfcee1bf70d116e92061bb9fb52bf06b128f8736ff10a6a5943835cb5f1434c180b90ca180d1abbc8ed5a42901cec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684927, "uuid": "0fab3dd5-a15c-4130-a266-6f56d052a4d6", "value": "T162C76BC09F02E5689AF7BD720949633DF38603214CB287799962F615797896FF343B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684927, "uuid": "436616a3-c362-49b8-bc32-b30ce126df9f", "value": "b51ccfc346077e98b4127daaef96f8e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684927, "uuid": "4f07b24e-6663-4ee2-aa31-d6132686b722", "value": "393216:85T/1bCIC5CQaeXpiboTf9SDW7v9RAOqUGQswQiz:taeYbw9t0Ojq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783684927, "uuid": "a37fe2fd-a076-4494-aca2-500625653ace", "value": 55239680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783684927, "uuid": "8c5ecddb-45e9-4b16-a8ce-e70903817bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783684927, "uuid": "ee36386d-7e7a-49b4-ba29-2c65a2201e2c", "value": "wdatasvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbf638d-7c34-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783669920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669920, "uuid": "832aa0c9-4fb6-4f41-afe2-be6b2255f619", "comment": "Malware payload (Efimer)", "value": "9ab13dc4c79fdd894774735987c9b60e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669920, "uuid": "0c9325f9-950b-4a7d-8f63-ae037d522db0", "comment": "Malware payload (Efimer)", "value": "760b4354419627ed1018cd9185c7fe4c7573904203b21dadacb7dec5e03f5da4", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669920, "uuid": "5c836888-c9ca-4728-bb9a-2c9828a11d83", "comment": "Malware payload (Efimer)", "value": "ba3822857415a736647fed9a5eeeb9dd72d5cc9f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783669920, "uuid": "59b75abd-e307-4ef2-b7e0-370e70386de5", "comment": "Malware payload (Efimer)", "value": "f786ffe238a46d59f83e28cb8515f69fad3a1cef1a4a1220b244b15b29e83c48e8eecf1def29f2e0c0198b31af9fb125", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669920, "uuid": "f272b566-a9e4-46b7-b1c8-66c4996a8758", "value": "T1A6E63304E4F452EEE133427CEDE3A9A1E15578750732CA9B571C83AA5E532E08E3ED27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669920, "uuid": "08e6962d-da20-4f8a-bacc-27c466c93f5e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669920, "uuid": "2ea83e0e-9437-442b-b0f8-d9a928e96d19", "value": "393216:grDV8CZ+VoIuFlXTojIXMCHWUjXscuI3/PGTAI:gt8cXXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783669920, "uuid": "3f75ef83-b323-4612-87f8-364769fc2c81", "value": 14303009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783669920, "uuid": "0fb071f7-0ebd-4b2f-baab-a31643d299a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783669920, "uuid": "1646faf1-1b2c-46bf-9747-ba042731bfe7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07223cee-7c5a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783686153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783686153, "uuid": "5f66ec04-f446-4125-ab56-7122f51f74eb", "comment": "Malware payload", "value": "926ee009a6caf31dc4f9b47681967a3c", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783686153, "uuid": "850043b7-9c81-4ddd-834c-e0439832cf32", "comment": "Malware payload", "value": "769346ae394c77317f2254e53b376ec2439d26b9fabe637cb2320c7825195103", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783686153, "uuid": "994bb735-224d-4e9a-9f5a-87a6ecd43b5f", "comment": "Malware payload", "value": "31356200f805fa98779c149d358d7ab64b1d68b3", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783686153, "uuid": "ba158bd2-2748-4a11-8651-765306ff9914", "comment": "Malware payload", "value": "49f6ebd7ea3dd1f5fa48844a49d7526554fdb98169e55a4e8b96ef4e8adc48ed9afd0e49bffdbc3a85206df7c078fc9f", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783686153, "uuid": "4c756eea-ff39-435e-b52f-3d09ec3c9da0", "value": "T1D9D16492DD248422D342ED8C84B28D50731E6E57D9096829FDEC66D02FB903DDE706FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783686153, "uuid": "8f3c564b-f68d-4b0c-aac5-14235743d1e6", "value": "192:D77QErXfeY0x1dazVS/1CxoTQkPS6B/4ty8ZhCHbXD5encoqcQte:D7rX2x1dazeeWZAQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783686153, "uuid": "574e6fc5-a5f1-4b9b-9821-53d3ddffd12d", "value": 6694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783686153, "uuid": "2e7177d4-c4b1-4946-9800-72fe1c87e4af", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783686153, "uuid": "fd93e696-517c-462f-9f47-5351084dae87", "value": "769346ae394c77317f2254e53b376ec2439d26b9fabe637cb2320c7825195103", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a65ed0-7c7b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1783700409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700409, "uuid": "8cdc2c67-8d42-4fad-8dce-f05e0f3d3754", "comment": "Malware payload (DCRat)", "value": "d82f8f7b42041ebb28438c9bb0a40520", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700409, "uuid": "e8dc4c11-e514-45b4-b0d6-db852281d17c", "comment": "Malware payload (DCRat)", "value": "76d09603b6280d22dcd73e00a87210a9b24273f93074031fd6a7134559544eae", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700409, "uuid": "212139ab-c049-4abe-aae6-f83a9f0b0c3e", "comment": "Malware payload (DCRat)", "value": "0acb7e84cec264ac0f560a5fdf3035ed67236e1d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700409, "uuid": "616aac82-05d2-492d-b376-7b0eacad07eb", "comment": "Malware payload (DCRat)", "value": "c515cfa1ddb72c06735fa2d7fd6ee57ca56f60dff08d732d06ba765681d0c86c51a5892ac59944abe0a84041b34d1e69", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700409, "uuid": "e1ee574b-1810-47a0-a37c-9ed567c78163", "value": "T1594539017E44CE11F0191633C2EF490847B4AC552BA6E72B7EBA376E65123A37D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700409, "uuid": "de83150d-b8d5-4166-bf73-084e0ebc3595", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700409, "uuid": "2e801de7-2899-453d-8fb9-0c8c9179fff6", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbZtBUPaHG8dasZPB877aMJO9R8rfQ5KAPVnYlG:U2G/nvxW3Ww0tQaHtasE7297Y9e77SzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783700409, "uuid": "3921bbed-3f86-4df8-b77c-49a8f4a5c1d7", "value": 1165984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783700409, "uuid": "23553139-4a78-4b48-a38e-155b80dc1a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700409, "uuid": "396d90c0-74a0-4ea6-9ae0-7cadd10ca2f0", "value": "SpooferTracex.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db72ae2-7c4c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783680231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680231, "uuid": "0a87fc94-87ad-4bde-a401-38ecbec28834", "comment": "Malware payload", "value": "20bc3246227cffd9a5ae73c575cf1ef5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680231, "uuid": "4c9ace28-9c58-4ead-a173-0896d85fc401", "comment": "Malware payload", "value": "78ebdfb4809d08896e072f3abb9948d1de9f6adc5f70a994b5d7d033f642abca", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680231, "uuid": "27444fbf-8275-4848-8f7d-775555cb96b2", "comment": "Malware payload", "value": "d0f655c1a2a2f0f66073d610344f750b30fae4b3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680231, "uuid": "555e9427-4367-4a47-8908-c6cae2570e1f", "comment": "Malware payload", "value": "843aa47f13372b346de64eaab8a95dfc2e44f3f19f5d8c8fe55fc2edbdbc23335ce2f442ad3496ea28d39da611441b09", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680231, "uuid": "db27452d-4bd6-4cc0-afb8-859c6865df64", "value": "T1997633A6B48B3570C98FC7B4845328AE793E3FC879AB4C0B79E93D120E33255557634A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680231, "uuid": "ac2edc88-eabd-4484-bbe3-f1d456a87661", "value": "196608:vXmrJlA7IAt/U8v6zySm3KzwhW+yvzNvx07me:vXmrJ+V3yu9aHNvxsme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783680231, "uuid": "05100777-70fe-4132-a290-bf7a829a4417", "value": 7741440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783680231, "uuid": "fce79fe0-0fef-49e3-9241-e5667c0dd6e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680231, "uuid": "b4f323c4-6615-4ca7-b1ce-dfb8ca994e16", "value": "zinstll.86382tt009.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbc0e75-7c74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697463, "uuid": "be7a5ca4-8b97-45c3-9b9e-0b4e827915cc", "comment": "Malware payload (Mirai)", "value": "8156f6715ba565b9ea1aa92dd51b2d06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697463, "uuid": "c0857eb2-4d80-429b-8b70-2d370029485b", "comment": "Malware payload (Mirai)", "value": "7e2c800894dda7d82725919c109efaeefdf7141391cd6321ea4791a52d450f7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697463, "uuid": "dd519acd-333e-4ca4-a591-52753b4302b3", "comment": "Malware payload (Mirai)", "value": "a35554e185f247291a9c005cf090793fc8533415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697463, "uuid": "28644ecf-f0e5-4932-b4aa-915897d44512", "comment": "Malware payload (Mirai)", "value": "021f6c6f778215e0bb4ccb29f27f2d4e7cec74a61f3c55f6fddb5b387df23b2431095f6d975d19a46bc19372dce10e73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697463, "uuid": "e60ac9e0-c773-4558-9bc3-ca561dd94ad4", "value": "T143431881BC819A23C5D4137AF5AE468D3B2133E8E2DF7217DE214F5176C682F0CAAE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697463, "uuid": "f5ef47e1-96a6-4fe1-894e-56ea4ffb68bb", "value": "768:bOeMEMDNVo829FdOcuYbb/Yi5ZQ/Ey8WbXZFP8Rt+sZ/Q16NS06gDAvUGFG7aJPE:uEMqdOcBb/lPry8kADPC1EWjbaoZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697463, "uuid": "2a255ffe-6dca-4937-867a-e72aeba2aac7", "value": 56064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697463, "uuid": "fb7f59d3-6452-4893-b2d2-37f598b20811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697463, "uuid": "5c270787-b7d0-459b-b416-efc317addea7", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f30c64-7c03-11f1-ac3b-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783649162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649162, "uuid": "9bbea2f9-1fe4-4d4e-b2fd-bfdf3ff6ee4d", "comment": "Malware payload (XWorm)", "value": "6e66f889923ccb7dc34641a4d7ddc234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SKYF1132-62070-portmap-host", "colour": "#3E6171", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649162, "uuid": "410cac70-2316-4635-86c6-4465f1118815", "comment": "Malware payload (XWorm)", "value": "7ee796a8fef94d38a6ef3d906fe3d37052b5b6c2435420dcc75e459fbc501a68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SKYF1132-62070-portmap-host", "colour": "#3E6171", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649162, "uuid": "7672ba6a-a596-45d5-99a8-60ef9816b868", "comment": "Malware payload (XWorm)", "value": "c4785f0696cae4e8630d28e545bbee207544e7e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SKYF1132-62070-portmap-host", "colour": "#3E6171", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649162, "uuid": "7497af60-f5e6-44bf-9fa9-da8a6302e847", "comment": "Malware payload (XWorm)", "value": "33ccacb8679090e0fafa952cc2d227f36219459455737d60eafc2d9c6c6f5076a2c36e7e29e355b9472a6665aa1e0daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SKYF1132-62070-portmap-host", "colour": "#3E6171", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649162, "uuid": "4ddc8f9a-f1f2-4233-8b74-a0ee93916b15", "value": "T16337336624BF9E13F588E17D00AC099E518753DE68D358C29BF847E7CC4B61A2F2E583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649162, "uuid": "730866b8-1a0c-43c6-846c-4442f28e2e6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649162, "uuid": "fbfe7b1b-da50-48c3-9f70-0fd66ca32f6b", "value": "393216:P9VgKASQW/v5LfypcrHshaoiM7C2Vj6CzKM1THaIas9Jp8SgdcMhm:1VgY9KpTaoikPNvT9zLzgdcMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783649162, "uuid": "000d026d-7b3c-42c4-befa-8d2655e9ac2d", "value": 23456256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783649162, "uuid": "1f22aaa0-9f26-4a70-82a5-b70ecd27c546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649162, "uuid": "ed87355f-be53-4011-9268-37148623345d", "value": "Nix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532d0af0-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783651921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651921, "uuid": "dd7fe9af-7547-4c5c-8b5f-db0991a43367", "comment": "Malware payload (Efimer)", "value": "46a7d8d9303db9b9c5301b6d080088cc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651921, "uuid": "fe4d4a3d-7d53-4dd1-9b95-56a3f5bf9e23", "comment": "Malware payload (Efimer)", "value": "81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651921, "uuid": "035bb4ab-b478-4343-bb88-e3ff36800980", "comment": "Malware payload (Efimer)", "value": "27312667da1771cefb8880a0364d41ed056b59f0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651921, "uuid": "9f71a343-1dde-4e8d-b8d5-edf787cd2146", "comment": "Malware payload (Efimer)", "value": "a8666417b697dfe9bc11120e583dc556b5139ee1706a6b6374b58d2af7a5912b200ed3d43a023a7da3cb844cab5056c5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651921, "uuid": "0c525e01-da70-485c-ac44-5c0517c06a90", "value": "T120E63354B5E020FDE9B7423CFEE1818AE4D570224F75CA9B47688AF4AF131E06D3DA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651921, "uuid": "4d654976-4d1f-4265-baf2-23f9adb661be", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651921, "uuid": "3fb6c22f-7855-4328-889c-5613811c3a2a", "value": "393216:4Xp7kyys4TMx9h4BdKDXMCHWUjXMcuI3/PGTAI:GhuTMJ4Bd2XMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783651921, "uuid": "3a06cf49-3958-4b43-a20b-0d9b6bcc5fa5", "value": 14321683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783651921, "uuid": "4ddd7148-f185-49c0-93cf-b26f96a0d14b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651921, "uuid": "37fcb377-ebaa-470a-95e2-3bb1daff8ad9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b157f384-7c7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783701041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783701041, "uuid": "e0c782af-54a4-43d3-9e4b-0b42277af24b", "comment": "Malware payload", "value": "7eaf75b3eefe5ea0939330effc356fc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783701041, "uuid": "21178a97-8c85-41ea-b96e-dbbe2bda4812", "comment": "Malware payload", "value": "8715bb53fad907f12ab1b5ec7bad49d2a4f72bf07f81bb2a6621fd1f9f55ffa1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783701041, "uuid": "b19875b6-568a-4d9e-8507-c77f319ea7a1", "comment": "Malware payload", "value": "b25a6e42ab7f2eecd5554780c3bfca14a8bbc0d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783701041, "uuid": "d3c2e5b7-2415-4496-bb5e-2cf93689d1a1", "comment": "Malware payload", "value": "579ba908fe548cf56d4402d9c29e4ff064aefffb7435ab5679d3cc79801987dc0cc7d202bebff4ef9cdb94e7189f9415", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783701041, "uuid": "62cb51ad-4ce5-4119-9823-4ba06b29af99", "value": "T163E52C2ED6A9C2F8C7BAC0348A1F4133F5B1781A971897C75028C6726EFB6C56E39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783701041, "uuid": "ff10dfb9-85b9-45c6-a0f4-cf5d15286cab", "value": "5bf3e23a459983ccf98096c50cb7d303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783701041, "uuid": "4b3a6e8e-d447-4a1b-95f1-17c60af25907", "value": "98304:mf5wcbhKfSxJvZb+Gey3FaeW0Z24tRuYOcLDw3:mf5wcbhKfSxJvZb+GJ3FaeW0Z24tRuYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783701041, "uuid": "d1cae35c-6d1e-4202-8027-c9d5dd8b83e4", "value": 3226128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783701041, "uuid": "8d9fa91e-c005-46bf-af1b-b0183562ef50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783701041, "uuid": "f3239d80-bcd1-4ca3-b1a3-59c2e68772b6", "value": "tmpe485.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7490f37e-7ca0-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783716401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716401, "uuid": "a58cb64f-9cd3-485a-8949-bc8c5f56a029", "comment": "Malware payload", "value": "2fbf7d22bfe700c3d86deb1d43a6b477", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716401, "uuid": "fcae811f-fae4-4414-bcd1-c321db8e370f", "comment": "Malware payload", "value": "8a400cbce796481b2cf5d7db0c864f7abd88428724c02dae5504292430afd50b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716401, "uuid": "3fe9865e-0d2a-4abd-a7e0-e93581b8e264", "comment": "Malware payload", "value": "10a46fc3532287c8c7c4e096cc5a1fc09437acd0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716401, "uuid": "ffbbf4f6-7de8-4eb9-b824-51909731ed2a", "comment": "Malware payload", "value": "aad0b434efbc52aac14f28808006f5077c2ebb20484453376e377ea2a9b3f986ade3f06cb278b9f9e66e5693b90978ca", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716401, "uuid": "813ac848-6733-461e-ad95-b348f4670ece", "value": "T16AD62233724B613DE02E15396E7AA122543B6E717D624E0F96E434ACCF3D1603EBA647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716401, "uuid": "a50a8463-107c-4bbe-abdb-f20b9f72dad4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716401, "uuid": "3fcc9a02-a3b8-4ccb-9b1a-a7a2cbc0162b", "value": "196608:Heb0GbB4dfuubX/ZBZf0vghMFne2nPreLoKXrYVN:HHIB4dfBrTaA2Paz7YVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783716401, "uuid": "deede955-c7f3-4e97-b01d-a1813668c0f1", "value": 13830436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783716401, "uuid": "8eb99ba9-e57c-440f-a8db-62c209ad6be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716401, "uuid": "0ef1147c-d4e5-459d-97dc-5f0fc3e4b027", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd1c57e-7c6e-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783695128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783695128, "uuid": "fd9c1a32-9069-4569-9111-5cc45f66dcf6", "comment": "Malware payload", "value": "b1aff26dd5a0d1d4677475c6397ca1f0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NexusPay", "colour": "#9A2963", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783695128, "uuid": "fdaf190d-b31f-49c5-9027-24b88b88539d", "comment": "Malware payload", "value": "8a9f9f3f3e38327bebc5096ba195d1d93c61bc277734fb18c4ce2f281bd08f3e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NexusPay", "colour": "#9A2963", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783695128, "uuid": "b9124d4d-f8a4-43c4-a09f-ed711c1b7e71", "comment": "Malware payload", "value": "73770f486f96e103010dc0d4d94677a5c4edf9ce", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NexusPay", "colour": "#9A2963", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783695128, "uuid": "d5733a72-493b-42a8-837a-914400b2fe9a", "comment": "Malware payload", "value": "505e322f0214226fe1e82bdc9e0dd21e0df35485eec3e2b6f6f527c49726a85cedce7f8d146bc3a458e9d31bb6806ed5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "NexusPay", "colour": "#9A2963", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783695128, "uuid": "99465d5e-39e8-4d0f-ba81-a91c747ccda2", "value": "T1747602CAF7C8992BC4735032C57A56F2454B4D1A8E83DF876A14360C6CBBAD44F4ABC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783695128, "uuid": "c8ce7439-efdc-4262-b85a-64830705c7d3", "value": "196608:67VQLc7rx9QYHxZyMPtWR8rz1DAmYtXs4f3KFL0W6wvZW33S3gq6:L4r3QYHHyMPBLYOg3fwA3S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783695128, "uuid": "9ef70e1a-26a0-4456-a607-bcb1106d7d68", "value": 7686843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783695128, "uuid": "6206d36e-9f32-45ae-bc0b-25eb32556d50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783695128, "uuid": "e6040e29-1972-4506-9299-7ba2a7a81bf8", "value": "nexuspay.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c50037-7c04-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783649296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649296, "uuid": "84b3fedf-b087-4559-9281-6d5f0a3b0140", "comment": "Malware payload", "value": "989a6991c5d8bb99e53fcbbed13aad11", "object_relation": "md5", "Tag": [ { "name": "51-222-31-217", "colour": "#7FF94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649296, "uuid": "e1490aef-d3b5-4385-8a68-6c6581ca349f", "comment": "Malware payload", "value": "8b218bfe6b176c32b971029e4c038f33f4619689c69246fc7e4567386c9ed8dc", "object_relation": "sha256", "Tag": [ { "name": "51-222-31-217", "colour": "#7FF94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649296, "uuid": "511fd894-d376-455c-a6cd-15b236a4f362", "comment": "Malware payload", "value": "78a7a577d665274711dc68db54ed06adf3d9bdb0", "object_relation": "sha1", "Tag": [ { "name": "51-222-31-217", "colour": "#7FF94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783649296, "uuid": "bda4fc51-57c7-413c-a5ed-eeeaed36f384", "comment": "Malware payload", "value": "4b900d4731c8dc0e1322d5fb8342ed79d8873b69d78e1d841c40739aac7cb8eda633f46237f62dfe378dc280a4192378", "object_relation": "sha3-384", "Tag": [ { "name": "51-222-31-217", "colour": "#7FF94B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649296, "uuid": "108cbbee-d7fe-4003-a53c-afdcf4545a59", "value": "T1643733EA0C52743BEC8812772EFE245F2AB52BCE2D59DAF5357E82E2800574A4F405D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649296, "uuid": "2752d01e-e9bb-4a1e-bc94-bbe01acd8b14", "value": "d9cb5cd51fb2795f802053b19b55331a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649296, "uuid": "495354c2-80ec-4850-96ea-010b929a3f24", "value": "393216:r54eSQOXZMnGADf/GMF0MIM37euQYHvO7dg42T0i3ei:9pOSnhD3GAXreuXOJZ2T0iui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783649296, "uuid": "8f8167d5-9e6f-4be2-a779-e9fb4b08c625", "value": 23460404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783649296, "uuid": "6ada56f7-32ec-4393-a3b8-7a2c8e796254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783649296, "uuid": "a5f166b2-395d-4a0f-9166-f4f0c0cd8b24", "value": "Dqgz6WdgM7ak.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac21e198-7c68-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783692443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692443, "uuid": "104b7d21-38c4-4bc9-b712-2a0ff65effba", "comment": "Malware payload", "value": "436eb488e9e99d0dc67b6688885e822e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692443, "uuid": "3ad9028a-7cf9-4f8d-88b5-70c0e973b443", "comment": "Malware payload", "value": "8c5e495c1e26a4bb6aee1a881ace6e7f139e03509cf09f98d7c687710899d383", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692443, "uuid": "a095e599-69d6-4473-b05a-28dce21f29b0", "comment": "Malware payload", "value": "36216a12373e2e4f5dec45c9febebdf5bc6bd433", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692443, "uuid": "adbe3c44-fc2e-4780-8701-0409e277744a", "comment": "Malware payload", "value": "2ff448e5b92a28d35460e11c1744d462419639b8eafd21fce75d4d0fa274065b7dfe130eddbe0008c11be25714b1ed52", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692443, "uuid": "30cf4863-5b99-4a7e-9258-9cddba686a91", "value": "T1A2662382EF56C92ED57381370E9607312266DE2ECA86B70384EC36586C7B6D44FD9EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692443, "uuid": "53879eb4-859a-4f6e-8413-e8ee1c0d1be6", "value": "98304:UJvBH9nCrjHohW88Zt26oyHQXdcpXuQIwDtx+O/+gRpY1MEIr:OB4PHoQrtpHmdyXMO3IMEIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783692443, "uuid": "feddef89-0770-4327-aaad-64d5e9f937ad", "value": 6483151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783692443, "uuid": "e3415a0e-6085-4710-af14-707a2d454554", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692443, "uuid": "e7cb0433-2dff-4d92-8fc7-c9e00ecc4102", "value": "TITUR18VIDEO.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300ca8f4-7c59-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783685792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685792, "uuid": "6376211d-4b0d-4c86-8728-67d905bc7ab8", "comment": "Malware payload", "value": "73e09c0e119cd881f4f8266bc9a1305c", "object_relation": "md5", "Tag": [ { "name": "103-68-109-59", "colour": "#828513", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685792, "uuid": "2e4e0e05-3c94-40ee-ade5-b69c174a0b4c", "comment": "Malware payload", "value": "8c7f9ec84782eac067ec0c97a307ad21b6283c2800c02293d2cc4bc789df95e0", "object_relation": "sha256", "Tag": [ { "name": "103-68-109-59", "colour": "#828513", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685792, "uuid": "5022e2f0-872f-4fbb-a23a-2b8ec42310cf", "comment": "Malware payload", "value": "92b79c546c4c189814363f6d5e808464a25a33ca", "object_relation": "sha1", "Tag": [ { "name": "103-68-109-59", "colour": "#828513", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685792, "uuid": "730f5408-451d-4db8-927c-1ee30e00e7fb", "comment": "Malware payload", "value": "04a7ac43e248365495fb3fbd9c575857b82393fe8dce2aefa7a492a334d81812fc6a1d889a68db9dd997b7daae8450ac", "object_relation": "sha3-384", "Tag": [ { "name": "103-68-109-59", "colour": "#828513", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685792, "uuid": "12b11851-0da0-4d6b-90c8-4e8759616d87", "value": "T16D044B55B3A45E43E5BF0BBB59731A1003F1B817A836D35E0DC250DE2EB1B908EA6B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685792, "uuid": "9ffad001-73e9-493f-8718-0c42468daac0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685792, "uuid": "ca687a46-2620-47bf-86c9-530331f346c6", "value": "3072:J4z0wC4tQve0koVQ6i4AxZU/j0jPwa/6jdFKbXpdBVYhpjkW:5q0bVQHZU/jgwa/6jdFK7pD2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783685792, "uuid": "bb5029fb-3e1b-4c2a-b2ff-e2352b7f3e10", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783685792, "uuid": "6ed4f7f3-3df3-4c2b-9f59-96db187bd2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685792, "uuid": "4bf8cb15-79fb-4dee-bdbc-e3853d9edbab", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8031846f-7c83-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783703965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703965, "uuid": "39bc7a8b-8af3-4d31-aede-50a1739a1ecb", "comment": "Malware payload", "value": "d587896e00d5dda2713fd07f0440e548", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703965, "uuid": "c4b38a12-40d3-45c1-ac57-9f37502c24b5", "comment": "Malware payload", "value": "8c87d9fadaa62189faa0030d6ac78fd6026de5c5d0116ab82a0f11887f398fdc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703965, "uuid": "bd160a67-520c-4ea4-8f72-f5e1eb8b25da", "comment": "Malware payload", "value": "6aba8b5c15231806c787f343ff6349a03ff6e389", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783703965, "uuid": "0c3e4b3b-900c-49ca-9957-16ac5967d764", "comment": "Malware payload", "value": "1fc758261c06a2a6629a083f64213fda66e7097069ffbab0a8ffde41e5349d2f8107183af26da745e2adc7dd204399ab", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703965, "uuid": "7c416ac8-2d03-47b0-b850-30b1a6416c53", "value": "T1D7E6334CA6D102FEF973803DDAE155A5E4AA74769B71C8AF079483B4AD030E04D7CE6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703965, "uuid": "67afa1e7-3c8e-422e-a2b3-9674a510f7dd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703965, "uuid": "1969d1a9-eaf4-417e-9998-b512d894576f", "value": "393216:bnirm9x1SAtU4PVK5nPjh94EHXMCHWUjX7cuI3/PGTAI:bDx1FtXE5HvHXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783703965, "uuid": "9ffd5d68-8e3f-43ed-9659-30a0b3c7b7d0", "value": 14307091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783703965, "uuid": "91bba80e-67d5-42d7-b7c7-639d492910cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783703965, "uuid": "d5106810-877d-4e0f-8b18-e0fbf26499da", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5ba85d-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648425, "uuid": "26beed67-7a36-41f0-bfd6-6802fbd2a90e", "comment": "Malware payload", "value": "9162f702cd17b716157f6edc51b94375", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648425, "uuid": "2981e0dc-ea70-4d0c-9fb4-9591642ca632", "comment": "Malware payload", "value": "9580aefa4e99bac7914a988a79688ef6173ee0e0175b993cdfcfea72cc40703b", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648425, "uuid": "bfb58444-14f3-4f09-b64d-37da400d964f", "comment": "Malware payload", "value": "39d76f15d40446a395a96b5cd5cdd9131e06f2a3", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648425, "uuid": "448858d4-6fe8-4c4f-adc8-3fe4102e2221", "comment": "Malware payload", "value": "bfe8e40652f0870608caa46560cde566f84027d2b502311d3d7b12ae29ec3a90c99e79ea84d84b82e7cdfeb78ab8f5ea", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648425, "uuid": "2e01e4ec-32e9-43b6-8694-37d6f849fe07", "value": "T125F09E02D7597D0A6970DC1F4790B64AC37407F1BC8CAA39D6D185C60FB8C87B649E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648425, "uuid": "7c9500e7-ca92-4937-a4c9-b60f330504bb", "value": "12:8q0HPNJ+t1V6mas6swoXwxtOJuuwcXAOvOkYV0VyVIVs6X:8RHL+t1BYZxtsPXsJmYCS6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648425, "uuid": "ce420fd1-cdd4-4e10-afeb-81750e7e237b", "value": 640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648425, "uuid": "2e13cbd7-6b23-406e-bea1-fb8a825cba77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648425, "uuid": "6c2a8560-0121-466e-a19e-dfa6de369803", "value": "l.body", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9226a607-7bf9-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783644725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783644725, "uuid": "227cb610-18ed-4671-a995-8c5fbef4464d", "comment": "Malware payload (Efimer)", "value": "0b4bfd9422eb241b2d324cb69d65900b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783644725, "uuid": "0c11e2ad-c4ab-46d3-bee9-d089feb3d1a4", "comment": "Malware payload (Efimer)", "value": "9a42d843c5c0dd751898a0bec5a68d0fc097364788f99cdba6533b2f125b4a5f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783644725, "uuid": "c9ed1938-5df5-495c-ac42-3000bf9bef28", "comment": "Malware payload (Efimer)", "value": "ad76e4103136992aef4bba1d6f5518fec9255c51", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783644725, "uuid": "ead0b910-3e83-4544-88bc-c263a7639871", "comment": "Malware payload (Efimer)", "value": "8ae820ac7a4fc1ce2240752960e7a24f723cb351960dc49dc91c97b87452eaee2cdb032db3adad2f99925aa888d047db", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783644725, "uuid": "2d6562f8-6098-48bb-97e4-f4f019b84c66", "value": "T1B7E63358BBE495EEF273603DA9F24611F766B0710771C8EF43D892A52E430E14E3E25A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783644725, "uuid": "04bdc859-9442-42a0-92f1-a91a43c0dfa3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783644725, "uuid": "14f3a0c2-c6e7-45ad-8a93-e710b0485cb1", "value": "393216:INpEmJzJY05JK4wGUfYt6XHlXMCHWUjX+cuI3/PGTAI:IDJfD50fYsXFXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783644725, "uuid": "ede50eac-6f52-4b2a-97ed-71f52a64c7ab", "value": 14311814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783644725, "uuid": "81499b05-245c-474e-9041-a3f8b252f983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783644725, "uuid": "f4a9e0df-875f-4fea-99ce-c6c989bc75d2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe76cef6-7ca2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783717492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717492, "uuid": "3b40ac5e-b811-49af-8c0a-f92b6914c5d6", "comment": "Malware payload", "value": "33874b4eecadf538643639e789b90dbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "thibahlt-lol", "colour": "#670BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717492, "uuid": "3e389e45-ea6b-4cf7-9dad-15ad3f3d1a3c", "comment": "Malware payload", "value": "9d33fa3e21518a55d1ca0e332aa81bc552c2384c4323f70e8ac8070d8920910b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "thibahlt-lol", "colour": "#670BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717492, "uuid": "b2f4b5a0-2e74-4f66-afcd-d5f1f9bf4a5f", "comment": "Malware payload", "value": "715d8010a479506e3e137359c366fbc3fac1cc3d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "thibahlt-lol", "colour": "#670BF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717492, "uuid": "835c4705-dd6c-4375-91ff-93155f41751f", "comment": "Malware payload", "value": "581e19f848085c4c9d19182994432c90805c1b879b9e631111aa45731f68d4a07d012b7a0c73a157d45f2708dc0ad1b1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "thibahlt-lol", "colour": "#670BF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717492, "uuid": "4d98824f-a39b-49bf-bb90-636003b24e83", "value": "T1AF02D82A737450BB95EA2CD74C2F410620B5A13B7D45E092CA25FD6660FDF4288B7B7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717492, "uuid": "bee26bb7-c0de-424f-ac25-3ec8dc4ffabd", "value": "96:25SVnnvaxvNLa93zLciOVgQ5mTwP1x/aI8m8//m257bAyzsQRyFtrorTC453ccOw:bvaZR23FoRnPL8pG0y/q3ccz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783717492, "uuid": "ad0c4657-ec14-4a35-b751-133424079af2", "value": 8602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783717492, "uuid": "d59ca3d8-a3c4-4232-9438-98055f5057ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717492, "uuid": "404a2525-59b3-40e8-aeca-e921976a70bf", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20a5a33-7c6b-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783693848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783693848, "uuid": "993415a5-832b-4527-aada-5126c78e43f3", "comment": "Malware payload", "value": "8bed271d3aefe39f58883888d5ddfe9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "misty-violet-6f68-protexweer-workers-dev", "colour": "#248F99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "still-snow-667e-protexweer-workers-dev", "colour": "#4A91BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783693848, "uuid": "df942c67-dd4d-4479-be40-b7cb4a1eeb4a", "comment": "Malware payload", "value": "9d924e9bd656a47ca6503d98f389ae94b83a1dd1cc459eefa00d914f61c1acbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "misty-violet-6f68-protexweer-workers-dev", "colour": "#248F99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "still-snow-667e-protexweer-workers-dev", "colour": "#4A91BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783693848, "uuid": "78527f87-e97b-4d3d-9020-b01dce700d99", "comment": "Malware payload", "value": "d5d41463803243ae888b10ecb76237259eaee4c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "misty-violet-6f68-protexweer-workers-dev", "colour": "#248F99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "still-snow-667e-protexweer-workers-dev", "colour": "#4A91BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783693848, "uuid": "20ab3092-6c10-4b2e-b37f-72e1dc5e6fd7", "comment": "Malware payload", "value": "2ee86e54827978fe7addaf34f0ed7cf1025f10fb7719a250f19972292ed13ffa42ae30543a09e3480b077fee2c7680f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "misty-violet-6f68-protexweer-workers-dev", "colour": "#248F99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "still-snow-667e-protexweer-workers-dev", "colour": "#4A91BB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783693848, "uuid": "97553295-a7d2-4c17-ac86-af5cefe75340", "value": "T12205E9535AE70CA9DDD36FBC21D7633AB635FD208B7A8B6B9244C23128131D16E2E744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783693848, "uuid": "2b8ba299-ccad-42e1-8d24-d588a6960ed6", "value": "fbb0f170512b58f09c3280d8814858df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783693848, "uuid": "3668e9b4-6d77-4ebd-baac-229eb548cf43", "value": "12288:JQYZspWzfV2XTe70oauVFfSHL6feQFZQ/EJH6rjbR:DfzfVxVVFjQ/EJH6rjbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783693848, "uuid": "41918131-7c54-42d7-bc29-7398435ba05e", "value": 864958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783693848, "uuid": "53a85809-1c3a-4a7a-9ccd-2edde54af681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783693848, "uuid": "47cc4b55-ec66-440c-89a0-d4c5e2294f0a", "value": "text.0RsqxRdk.dll.part", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59af9fa5-7c67-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783691875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691875, "uuid": "9d5a7915-92a0-46be-9f50-8371fe8ac433", "comment": "Malware payload", "value": "530b62315763fd66102c97bac3be2c82", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691875, "uuid": "7df7519f-f76c-432a-b0e3-d1389794f781", "comment": "Malware payload", "value": "9e9bbc587df1ca7d228791996f906303c720ad04ceb1692dbdae1f31b050f38a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691875, "uuid": "422d1302-0857-4468-9208-e83df02fe730", "comment": "Malware payload", "value": "c8f18cc5ed49e786385cfcf67337c5334913309c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783691875, "uuid": "12217793-a879-4883-8a88-74e460559473", "comment": "Malware payload", "value": "7e27c7fddd3327cca9c7a8ebb7b815408beac8c55bd77881fbfb8e8215c862b5e658c5b21b50e19a8631b6d6fe1c572d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SmsSpy", "colour": "#EFD783", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691875, "uuid": "088de39d-4826-46a4-87ce-3f052ce96ec4", "value": "T16C662382EF82C82ED4B7413359A70B3162569D2ECA96938788EC772C5C777D40FD9AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691875, "uuid": "df839a7e-5959-4720-a897-948957947eec", "value": "98304:mrJ41+hrrWF8jufn+WFtsIpADZBHBvjAiAoD/pdAsVtmKbI9JUoXjAoPG:h1+5rWFzvG3DDHGuhEKWXXQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783691875, "uuid": "33557014-be03-4e58-bed0-d0b255afda3e", "value": 6626368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783691875, "uuid": "dbca5e9a-0ecb-462f-aa0a-69aec67b257e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783691875, "uuid": "729a0fa0-7b75-4358-8310-c52e39e18ff6", "value": "Priv\u0430t21+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c0690-7c7a-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783699921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699921, "uuid": "d8c52264-827b-413e-98d3-d853d1a7bd7b", "comment": "Malware payload", "value": "9d27193d133a072ec98e7fb763942319", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699921, "uuid": "9259743d-ec95-4908-99d1-82d6366005b6", "comment": "Malware payload", "value": "9f572140cf3347a0485bc0fccb82e04c71558f5eb3e34627ff8ea292fcbf76e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699921, "uuid": "b089a811-9ba7-4561-9d20-ea62b1bc10e1", "comment": "Malware payload", "value": "6d61d91f9fc66e399998b6615a3e4aa089e030f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783699921, "uuid": "bdbd3a73-b0ca-4d2c-8f20-7656533b8b4a", "comment": "Malware payload", "value": "4cfbf303fd0dd1ef8a74c9300ed6e47542e660db1f3d50cd91bfc1627744c6844f1dbfad438e4fecb3d1fc15c9e0ecf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699921, "uuid": "cd073826-5066-46fe-ac00-b8b71665e684", "value": "T12808337AACF08B10C0AF5CF11CB2DB25D26843B62275572E0B2694CDBCD1A74DADF661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699921, "uuid": "96f4a2db-69e3-4806-a330-0f81a7fe48e2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699921, "uuid": "125f83b4-7c75-48a6-b89a-2a452311ce1a", "value": "1572864:Ct9IKPMMIEgA0neSZfNgJtWEd5lGLcN8daRJNV2yaCOfUuolzIsAOTFdLtA97:CUKF7gA0JC3xf8LHdanNV2yyfUJlM23q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783699921, "uuid": "27011c96-0ce0-42ab-819b-b0bad163a132", "value": 77318760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783699921, "uuid": "ae5000ab-4f2c-46d7-99a2-f2f153ff7233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783699921, "uuid": "32a20dfd-15e2-4eec-a91e-ca12102bf964", "value": "NAOLS_win_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b890c-7c7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783700897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700897, "uuid": "ee645dc0-b93c-41d7-85af-8194895349ce", "comment": "Malware payload", "value": "dbcbd3d66765a89838836454aee4e406", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700897, "uuid": "ba7a8554-92cb-4f45-9a04-0968f0b128b2", "comment": "Malware payload", "value": "a0d1e6b471522635bcf7ca0176d6ee8febcf90184078b5e8ce24e0eca970b532", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700897, "uuid": "023c3ea4-bbda-4294-b5db-eff86831d677", "comment": "Malware payload", "value": "caf2122b8035e68df8ab0d61b03661661cd807a4", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700897, "uuid": "9fc1c84e-dd51-40b0-bf6a-14dd36d89236", "comment": "Malware payload", "value": "08b580b71c0d4734baafa02f7bcf537b4ea397d8a17de56a5ea88944987bf32b3168158c2b77c7134131fa6517df78bc", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700897, "uuid": "95b69aa8-3a1a-4fcf-973d-9f43f1bf8f26", "value": "T1912533AACA3C1504E2AF33B333DB7079E43A546D6345E264311BA59A4FD2981531FF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700897, "uuid": "174d7926-31a1-4248-a8d9-00f63c1ae654", "value": "8933df726af36aee00de71ce238a1868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700897, "uuid": "13bed0ff-6df1-4d27-b3ab-59a3f37981f5", "value": "24576:FO0LWRegDmPzReD55m4k2sgC71BWQ3+UmqzQSHFfs:g0LOade95mKCr+UfMEFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783700897, "uuid": "8d675a7f-0f31-48b2-9088-a3078a5d2db9", "value": 1013111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783700897, "uuid": "785076a7-27e2-4e3d-b181-b17a624bfa23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700897, "uuid": "e0c64ff5-d205-4a6e-86e8-f21468aac03a", "value": "photo_2026-07-08_16-28-06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00099534-7cb2-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783723937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723937, "uuid": "831c6a5a-ddc5-4ac5-b117-3fa71c4eca77", "comment": "Malware payload", "value": "8adb10c728ac1d7bd528d53153d98be7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "static-stacksupport-cc", "colour": "#B5022F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723937, "uuid": "0c2ef4ac-1fab-48df-963d-4eff0ede50f4", "comment": "Malware payload", "value": "a2f29f078ddd41e2544e3750feba5e60c6f70a8a185e1ec960fcf3cadd663d28", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "static-stacksupport-cc", "colour": "#B5022F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723937, "uuid": "789dd3c3-44ed-4617-8d1a-b5a697b24ac8", "comment": "Malware payload", "value": "8e86a7d71809de8baf27b2a9e16787145e504ce0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "static-stacksupport-cc", "colour": "#B5022F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723937, "uuid": "57f1904e-c336-42e9-8752-b96c9a43564f", "comment": "Malware payload", "value": "09e8887d48a2a8c2bde703d2eae1a06d6be16b836936f4ad74b2eac3dc2b9a214b2b7fb2b1540af68a494197ad6d31ec", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "static-stacksupport-cc", "colour": "#B5022F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723937, "uuid": "e834da9d-5665-4045-b489-d7c273105ad6", "value": "T1B485231912D8506EE0A28B748DF256A65575FC668B309FDF22C4B93E2E33ED5A130F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723937, "uuid": "0a2af65f-d3ac-4863-bc8b-c8f1ac09bbb1", "value": "e387f9bdbdc891a56417c52c45ed0b91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723937, "uuid": "238a88c8-db83-478d-8daa-5af0f58b26b9", "value": "49152:5reBF2S+F8WNvvK064gHFuih7B6mahZP5YRaSRfGcShCpAMTi:xfCB06rFuCcmI5e0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783723937, "uuid": "ae8b25dc-2da7-4c18-b32c-c58e498dc112", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783723937, "uuid": "7fa40023-8560-41fd-96f2-f223ddb68744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723937, "uuid": "0ec37fef-b680-4ca6-a0fb-17aa0984a126", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb7db04-7cb1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783723929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723929, "uuid": "51ad7941-5e9e-4ced-a951-af6fd4960b70", "comment": "Malware payload", "value": "a23aa949c4d73e0d6f58d978783f2535", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723929, "uuid": "8526371c-62a0-44e7-9707-ec1d73f48913", "comment": "Malware payload", "value": "a62121caf724e944291bd1733fd65da8af3d205d27be8f40af9d02cb647189a7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723929, "uuid": "31f61f52-8f5e-4886-81e5-e3499deed0a9", "comment": "Malware payload", "value": "3b635fade4c6edc611c76b78093543a7e7908c3f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783723929, "uuid": "f9fab209-78a2-416c-9cc0-7f62c2a891a7", "comment": "Malware payload", "value": "aa38ad61d1670a4f503f5b309321a50754d9ebb0f7ae9db968f7171ec950ea6c3639db535161079931c0f467551fcc10", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723929, "uuid": "5f2a927d-903e-419c-adfe-ba92fd1d77e1", "value": "T19DE6331879F043DBF2738039CEA254A5F569B8BA47B2C9DB4794A3A53E1B1E04D3C613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723929, "uuid": "01f8473b-bdd8-4a81-a682-77d94dced252", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723929, "uuid": "c5578e74-1b7e-4697-baa4-80178225ba35", "value": "196608:aw2+i7T54wViXEGv1Kb/3JAaxXMCHGLLc54i1wN+MCmPIcu9KYK39sI3PPGTMrRd:aoi7TEXMJAaxXMCHWUjXRcuI3/PGTAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783723929, "uuid": "eb1456f2-9e3c-406a-94c7-d0c9a74fc180", "value": 14306235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783723929, "uuid": "335fe14e-b0f8-4f48-bd6d-5a2f5a52ced9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783723929, "uuid": "aec7771a-e1c8-4b00-b611-fa840e7d3250", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e2ffb94-7c07-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783650758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650758, "uuid": "91bef5ae-d1fe-45c9-b063-5e2e6eba03e7", "comment": "Malware payload (SalatStealer)", "value": "f77dafb7f7cf6d7c3318f8ff01fa5e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650758, "uuid": "24703e2e-3d4f-4e03-9dea-d7cf49afcaee", "comment": "Malware payload (SalatStealer)", "value": "a6b325e695644ddaaf6edf0c41604179fd53d1e515afa52e5d526426a4644d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650758, "uuid": "cd8f3aac-e49f-4b6b-9394-963de6475c3f", "comment": "Malware payload (SalatStealer)", "value": "cf236e17e176cacaa951e086637bf62c04635080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650758, "uuid": "6cf9ab29-0133-4958-83a3-c8bf11640e49", "comment": "Malware payload (SalatStealer)", "value": "ded9ad679b49d47aa899b8206ef85b6f1409b0c476c38205e2a75880bbb32481dd9cdfe8c8c59d2e17f4ff32114f8030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650758, "uuid": "0201e8bf-63d2-4a75-a539-eb09ce11650f", "value": "T1BBC66B11FADB95F5E903583101ABB37F23315D048B28CB9BEB547B2AF87B6A11C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650758, "uuid": "7d0f95a0-2820-4edc-9e2f-54d8de3fdbe3", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650758, "uuid": "cc11e680-d032-40a6-a041-0bb50532daa2", "value": "98304:QyK5IeG7XBCrevMqG0arl+4HR4SG2Z1OENf:gInYekkarlvx/l9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783650758, "uuid": "0044d48f-ba1e-43fd-b0ea-5171263c06ce", "value": 12574720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783650758, "uuid": "83c3f40d-ba42-43ca-b7cf-6654ecfe956e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650758, "uuid": "619560b6-310f-4395-8b06-2fc7914799a4", "value": "setup-Happ.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dc07d6-7c90-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783709530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783709530, "uuid": "860808f7-f4c7-4b9b-acf1-9e165770da6e", "comment": "Malware payload", "value": "085818055b8b99a09609f586d16009fa", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783709530, "uuid": "4b58b2d6-a197-4ff1-935f-f7df95e530b0", "comment": "Malware payload", "value": "a76c02a5dc0c2c128e5876f96acf02f63fc1607b9d3a8912d9fd173cc41e65b7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783709530, "uuid": "a25cdaad-5e51-47ec-b33f-b07a140f8e2e", "comment": "Malware payload", "value": "e39bc2faae65006681841431c3db7e9e96d44b24", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783709530, "uuid": "94068456-b1f4-4057-86ce-5ef73442533e", "comment": "Malware payload", "value": "2e659d48e2c4adbacc0523322718acc24a8eb80b3475d1a580dd96c775fb976fbef640a0ec55b048037cfc2251d02c2a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783709530, "uuid": "f2e75891-2cd5-4d53-8cb4-794f1e4cb0d9", "value": "T106E6339C9BD011FED677903CEEE366D6E0A5B8B217B5DE4B175882257E231E0083B742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783709530, "uuid": "2affaf6a-f6ff-42f5-ace0-6892cdc30ba8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783709530, "uuid": "e1491ed2-b1de-4017-98b8-fef66482daf3", "value": "393216:ENOBO9wf7h8utkrXMCHWUjXxcuI3/PGTAI:EgI2V8umrXMb8XmH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783709530, "uuid": "ecd2aa20-5ef6-44d1-91c8-5bd20e159485", "value": 14296940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783709530, "uuid": "9ef92c41-f4d8-40e7-be62-1425ed023ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783709530, "uuid": "cabf80c5-be68-4ef3-88b5-f291f4879135", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f68455-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WSHRAT)", "timestamp": 1783653006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653006, "uuid": "16f41edc-b3df-4b06-8f8a-b4dbe0f0a924", "comment": "Malware payload (WSHRAT)", "value": "7cfa26870f809a4d0a02cc23b7d4e648", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653006, "uuid": "f72b7912-577c-4fd1-a43b-43e400010d69", "comment": "Malware payload (WSHRAT)", "value": "ac255036bfc86ebfedcc638e79fb2cf98ac70942c325a52e45fa33c2eea0f063", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653006, "uuid": "8fda4cd2-cded-417d-9a22-b700ddeb5188", "comment": "Malware payload (WSHRAT)", "value": "5169c7a72a0868efb00c18cd807a198b4a4280d5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653006, "uuid": "75439d5e-716c-40a5-a170-67627cfe334e", "comment": "Malware payload (WSHRAT)", "value": "e8758d53662dbada7cdeeb7f96b3d7b67cf86578274baf1f4eaaeee587960660518833c8ff2b6867dda22896bc1a07e8", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653006, "uuid": "ffe5beb6-ee69-4b6e-aa77-b90f51638a1f", "value": "T1E12477023D0BFA3C169F2D0466301E3A5F8EFE72D619615616492F3C93AB58D07BF52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653006, "uuid": "5339b20f-bdaf-4cc4-9ee3-85091235f5c5", "value": "768:0iSgol5ZKpOyMsHBU1D2yrxllzG4YtXkD4oLlmKmSP75N5xxw:7OpsHADr64U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653006, "uuid": "44f10496-57b0-4009-be1f-06496e48449f", "value": 222449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653006, "uuid": "96ddeddb-2ea4-4c73-9242-1e86835b6a1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653006, "uuid": "0ac8206a-6295-4c07-89af-8303adeeed72", "value": "ORDER-27098-07PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132650af-7c59-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783685744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685744, "uuid": "a89d1b7e-8010-4e8d-b539-c97c0a1bfc13", "comment": "Malware payload", "value": "f29f918a99b09d05051326d623df89ba", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685744, "uuid": "5dc62101-f02e-4333-ae0d-096b8a49f81b", "comment": "Malware payload", "value": "ad6b7658635192bbbb428c0b8b78db842c7d4f3501a4998cd69def8a1fa84b20", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685744, "uuid": "054f10bd-0092-4346-b881-4c9c5311de46", "comment": "Malware payload", "value": "a34e0d1f408d7df4130c6b3c972cdf1ebb51d354", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685744, "uuid": "1f4a52ec-f015-4a99-916d-d612faa004c2", "comment": "Malware payload", "value": "42bb61b3cddb9dad64b363889dfc4a883e4e81dc753682e4b0bd14ad8ce3e5f2bdcb0537ba27c677fa5783612b3f75dd", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685744, "uuid": "d47464da-0bf9-4211-893a-36fc98b1d367", "value": "T1AE1733855FC31D28FD437DDBF9AD757C898A28BFA8E6C4586405AF21BCCA07C848522D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685744, "uuid": "4c3bf8b1-e96b-423d-98e6-62a5e3183851", "value": "393216:DmOZMpIyjgrMw5qELNwRPrPTeXWVCSObfaLbbu14kRVob6aDiYu:lZmjWb5qIepSYOW09n8pfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783685744, "uuid": "f3bcba98-f7ce-4da6-9776-f7b356c31ef8", "value": 19201389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783685744, "uuid": "84f545df-d8c1-4076-a702-e7cbd467faec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685744, "uuid": "949de14c-591f-46b1-8846-2612a7fbc6f5", "value": "\u1780\u17b6\u179a\u1795\u17d2\u179b\u17b6\u179f\u17cb\u1794\u17d2\u178f\u17bc\u179a\u1790\u17d2\u1798\u17b8\u1785\u17c6\u1796\u17c4\u17c7\u179b\u17c1\u1781\u1780\u17bc\u178a QR \u179a\u1794\u179f\u17cb ABA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7faa774c-7c58-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783685496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685496, "uuid": "30f17f69-5f8c-4fa0-a140-167bf5d7e0b0", "comment": "Malware payload (RemusStealer)", "value": "bb7d6536cecdff9abacfb25618aeb2d6", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685496, "uuid": "b032b681-0746-42b2-894b-91030ff417d7", "comment": "Malware payload (RemusStealer)", "value": "ae887a7346ca3547c459962ff760fda8b221c16d96fcde758422586fe7a886e3", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685496, "uuid": "308548cb-5585-4f13-87c9-8f26fbec7c48", "comment": "Malware payload (RemusStealer)", "value": "0a23a08199e61347c0f4a56fa3204b5774e1b63a", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685496, "uuid": "c65524d9-62d7-47fb-b2ec-76a8c4ddb6dc", "comment": "Malware payload (RemusStealer)", "value": "daccf8e3085441707726866adab89b06ac96ef3095dc8ee7ef69a92cb83173dfb237b58f949cedeb4b85d527cdd5b7fc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685496, "uuid": "9a7d7b2e-595d-4f28-a05c-65e7d7dcd583", "value": "T1F7B56A06BCA149FAC4A9733189B261927B75BC081F3A23D72F90B7382E727D16C36755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685496, "uuid": "a21ea5c2-a2d3-42c5-988f-8b01b3297e09", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685496, "uuid": "b49d09ff-ac0c-48e7-9f4f-4d9af5e9684f", "value": "24576:QL4eysWJfTgzkGi1yCHsEPOdYvC/CkVq6nyJJxBpOgwFPZ2Bele5IK2J8ypKJVeu:QLhPWJLgXio78OakI6nQr6Tb7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783685496, "uuid": "d8f2e94f-137b-4543-9ed7-dff5017d656f", "value": 2385768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783685496, "uuid": "aeaab9e7-9b28-451a-b3bd-ca82fa213278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685496, "uuid": "2613270d-0940-41eb-8505-69a9f8edb492", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7807901f-7c23-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783662720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662720, "uuid": "b8560b32-f51b-4736-9077-6bc2519784c0", "comment": "Malware payload (Efimer)", "value": "739d254907a3a933f0718634112582bb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662720, "uuid": "b63fbb0e-d602-458e-8bd3-4f3d71b347a3", "comment": "Malware payload (Efimer)", "value": "aeb57ec14b5c7cf3b5ecf41bc4e783cd6a917ab56202404183ab42bd8bfed3d8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662720, "uuid": "f11a7029-6194-4909-a8fa-5f2b65b82900", "comment": "Malware payload (Efimer)", "value": "478d9285432671ef3f2672d4581ff7625f6f0708", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783662720, "uuid": "5dbd54b3-7f8b-4365-aa4d-e6f1d8b2d571", "comment": "Malware payload (Efimer)", "value": "de12dbf8b83e989d750ebe9d43c30963be8888e86479329d4516f45b90de9aa99b4ed7b9f29c8b39e17d9ace4d18bc0a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662720, "uuid": "1d0d9bfe-fc6d-4d3f-9ef5-0295df803de4", "value": "T175E6331CE3D012FEE2A3803DBEA161DAD99070764770CA9B5BBC67A66F131F05839617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662720, "uuid": "a167f94f-d94d-437d-a5a8-66a1e34a1a24", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662720, "uuid": "9ac61150-dad8-4230-a34b-cc552a34404e", "value": "393216:6UslpwIzRXbVNchAQnAYKXMCHWUjX+cuI3/PGTAI:6NxiWQPKXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783662720, "uuid": "3d167670-e73a-474d-8fa8-ef322974d69c", "value": 14295112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783662720, "uuid": "e6bf3021-1392-482e-8747-f846a34cd3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783662720, "uuid": "a2fc3b9e-5c5d-414d-9ffd-719cecb88e80", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e68427-7c71-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783696345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696345, "uuid": "ca18f0e4-de95-493b-890e-b9ef8d79fe98", "comment": "Malware payload (AgentTesla)", "value": "a92a378389972228b965e99541c9b2cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696345, "uuid": "49fd552a-de47-4ced-8cde-8e2ecdc56bde", "comment": "Malware payload (AgentTesla)", "value": "aedf930f08b6f91f5762aaab686d143cd519ea6c0bf4c648337a98e56e14e8a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696345, "uuid": "c585bda6-7c0f-4210-ae5b-b7304c258d74", "comment": "Malware payload (AgentTesla)", "value": "a1759f9932359ed0a9e93708db29b5070f29bf49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696345, "uuid": "645452c1-f03e-4237-b340-991f7da97da1", "comment": "Malware payload (AgentTesla)", "value": "f2dc09337bad3739beec8b28c1c2118844ff496533cbcd3786d535962abda9f3dce0351bcbca2cd696662965fbe9a429", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696345, "uuid": "a469de32-0781-4275-8841-165c10ccd024", "value": "T1C165F2105FC46F7B86AC5A28E07F266DF3E10AC551976CCAFB727D09AFA670042235B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696345, "uuid": "bb029e06-5c3e-42fa-8001-c2149e310077", "value": "24576:4cbnQu7OrWD+WfixfvZDBxeTZ7EoRd9cFRF/TzlcTsxR:fkaYfNe97r2pT+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783696345, "uuid": "3d457669-8c05-488f-8b0c-5302e3ca5865", "value": 1497212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783696345, "uuid": "48b94a1c-37e0-49e8-aae2-35e4ade14fcd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696345, "uuid": "39905059-56ba-47f9-a5e2-f1e0b9e1d5cb", "value": "CELSIUS GALWAY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc43f64d-7c62-11f1-ac3b-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783689920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689920, "uuid": "3158f31f-baad-4e0c-bd6f-20502d1f3c8c", "comment": "Malware payload (AgentTesla)", "value": "7e82d1b7c45bb678e013aa2594d11af2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689920, "uuid": "fad2fd01-5023-4f6d-a874-f38e5dda86f8", "comment": "Malware payload (AgentTesla)", "value": "b134976f75a1260a86d00ac5c7b990bf29c2e45daa6e7c320835132b0956ddee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689920, "uuid": "823cb08f-7faa-4d35-b0d3-a21584d53303", "comment": "Malware payload (AgentTesla)", "value": "6bab197cb7b96f763a0e253443a5f48ddd87c343", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783689920, "uuid": "d3beaf2b-38d5-4520-a4a4-78c4fcb7a135", "comment": "Malware payload (AgentTesla)", "value": "48769ce6620998a0cb7db55a1755b0b99bfbd0303b0b1da055f7ebf32d35b9d12e3855c2cec948d393d4a6c98b36413b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689920, "uuid": "f7b7ab39-ccd4-4e19-a4a1-857d9881e614", "value": "T1A165B9C8636D4E5797E4DB6A6F42BC66ACC84207878187353438354AA8FF060DE6CD7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689920, "uuid": "9541f990-f854-4edb-a7be-0456f2c722e0", "value": "384:h1CllbJZ/rPYcxDl6GZzlJ31WG565wS68DJUdJeZlMdCUNcOalzda5hzciK/qAc1:fqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783689920, "uuid": "6f2324e6-effe-4f65-88dc-a1087b7ee789", "value": 1500633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783689920, "uuid": "10070ccc-1336-415e-ab2b-c7342fd001bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783689920, "uuid": "3821a4ee-7455-47da-8e36-fb032606ad6c", "value": "Especificaciones del producto.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7304c0cd-7c9d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783715110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783715110, "uuid": "3f25bb66-c034-47c0-88b4-c5e0501594d6", "comment": "Malware payload (ValleyRAT)", "value": "16307d047efe925e8c34064306948541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783715110, "uuid": "8b908a36-c196-4fac-a445-91dca7825366", "comment": "Malware payload (ValleyRAT)", "value": "b3369a20d7c603b4d1078010b008a9db1b49dccf694a05e6bd49ede2762a8075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783715110, "uuid": "3b164728-e298-493a-8ec7-9a7cc42cc8cb", "comment": "Malware payload (ValleyRAT)", "value": "56fa917487e7a2aee0b8327774cc99c6a9b86651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783715110, "uuid": "d389e3e3-aca3-4a6a-8114-011dbd63809c", "comment": "Malware payload (ValleyRAT)", "value": "5ed902d8c49e5793320dba88210c63b185831c3067ccbdb167d5e2041c34359eb8e0ff1fcd83a94a83c67c489a9e54e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783715110, "uuid": "2c926c29-0cfd-45b0-8c10-5223bc0e4d18", "value": "T1AEE37C21B1C1C0B3C8B6253158F4EE759A3DF9701F245DDB63980AB99F302D29B39A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783715110, "uuid": "75e8d447-f98f-4fd3-80a6-50ba98e3a876", "value": "95d95a460e8783695f0245e2dce92576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783715110, "uuid": "3d9d2b19-0173-410b-9fac-c1002cebe1a4", "value": "3072:2L+xFSlh/WjgRGGs1tsNA1m8omzdZfwcMorHShKLBUpFUJKHclbafkj54J:GqSv+jgYT/s6MmzffwPIyhKWmAIyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783715110, "uuid": "001237b6-31cf-4bc6-9a2b-3f1fe3e1ddcb", "value": 152064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783715110, "uuid": "a7e80a06-10af-45ad-bd99-a4a1289735bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783715110, "uuid": "493ef46b-9d13-4878-90ee-3f2e0b787ca9", "value": "16307d047efe925e8c34064306948541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad9a94e-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783706184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706184, "uuid": "06a81645-b93e-48be-986d-824116d416b5", "comment": "Malware payload (Mirai)", "value": "96560e9b05192dc7282076cfa9e943b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706184, "uuid": "978ad88d-583c-43ab-97d8-ea1fa0828a25", "comment": "Malware payload (Mirai)", "value": "b3e2986e69683d452f04b4305f5454f03bda2b8a6fce080a97ea9d77699291b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706184, "uuid": "c943b80d-a27d-49c2-9aed-60a4cd7b5984", "comment": "Malware payload (Mirai)", "value": "072d2670585d2bccabb59ec1b6c1d95d09209cf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706184, "uuid": "296b80e2-571a-4496-a2c8-8d50ab81c26e", "comment": "Malware payload (Mirai)", "value": "655deb595eb195cc7d3c6c5eb8e77de04ea5c4863b88ddbff7526b14a0e0ead90631c60271771373843abe8faeb0452a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706184, "uuid": "14305e53-fa29-451a-ac8f-5a8e6b2c2b77", "value": "T1E693830AAF611EF7EC2FCD3B46E81B06318C640A11A93F797974D928FA1A10B45E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706184, "uuid": "9513b182-7322-4b57-ba4b-4be8aabddba4", "value": "1536:zc6DcA5z2G1lkTVH5gldNsxnuWMviN4p5tso/wbZnq:7DcIz2glkeCnukeeWwbZnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706184, "uuid": "74ccc562-1cdb-4867-b9b9-ba518219aacd", "value": 92988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706184, "uuid": "0134cee2-c051-47f2-837a-0d92701e4be7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706184, "uuid": "e619677f-75c9-411e-b66c-32e413632dee", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f303cc1-7c59-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783685978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685978, "uuid": "c9087ae2-b735-4ba5-9fe0-7e5f4e8520d3", "comment": "Malware payload (ValleyRAT)", "value": "99a4d8df4398e163b45594e6204fd2c3", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685978, "uuid": "ce483fb1-60d0-4d7f-a599-00affdf82901", "comment": "Malware payload (ValleyRAT)", "value": "b433ecdf855beaaf91d57522eebe9c9e1c3fc756f711bd79ac1b3ecf6c75016c", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685978, "uuid": "2b875817-ddbd-4428-bdea-a477a5f37368", "comment": "Malware payload (ValleyRAT)", "value": "cca9f72a37173b12d4812644dd288909133cf6e4", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685978, "uuid": "34b825a4-c6c3-4216-a34f-43470d9fe54b", "comment": "Malware payload (ValleyRAT)", "value": "591fc75318a4518798d34f30bf00042205b476bc2ee7fb0ec869409d70cbf32efa1c5fc38cf6aeb96f3513881bb48e7f", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685978, "uuid": "b7913b8e-7f51-413a-9c1e-cec3a8b01caa", "value": "T1975733157B6EC27CDA99441EFC64B28938A5FAE531BCB048C03E68E904BD0FBB076D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685978, "uuid": "ed739a94-d419-40a9-804f-39ec9746b102", "value": "786432:KHnTi9j9jG4zU+ocyToF08XOVh301iyNKtKTP:On6jG+ocyE1Q301LsATP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783685978, "uuid": "a6044872-3301-4661-9744-65327f6f0c8c", "value": 29191779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783685978, "uuid": "cf0ef018-8aee-4fea-b711-71f959a065e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685978, "uuid": "62f2ed0c-1166-4974-8d48-7a25fefec4c3", "value": "LetsVPN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766862ad-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783651980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651980, "uuid": "beda2970-be24-4200-a429-ff3505e14fd7", "comment": "Malware payload (ConnectWise)", "value": "7a8a4e95d3d586b050d51e9fed7f1315", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651980, "uuid": "edac0f85-85be-4934-8e50-fe0fdb303418", "comment": "Malware payload (ConnectWise)", "value": "b4d0f84e44a782b5c98c48a34a5442bde600f59e451a067f5ea28d3cbe528966", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651980, "uuid": "35b78fbe-b94e-4bfc-840b-8eb12acc21d9", "comment": "Malware payload (ConnectWise)", "value": "aa2dd7567fc5df4ccde7fee6efc7669920451031", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783651980, "uuid": "8fd7d2db-a55a-4a16-bf3e-3a730ef20c03", "comment": "Malware payload (ConnectWise)", "value": "4b07f41b458b252bfc4bfaf8ddc64621b3ac2bef3b55b21bf910924a7a77f5ec3b367244a55813fbbc8fa3f0c3a9055d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651980, "uuid": "858df339-487d-4e67-9487-76ccc1e6876c", "value": "T17AD7334232E8C075F1B20EB47A79D2E25D773E5126BCD14E2A21776D1AF3780A438F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651980, "uuid": "8b2f594f-8140-4608-a5e3-a70ab23ce366", "value": "f1783104dc04202edb1280448f79953f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651980, "uuid": "c07ade34-97a7-489f-9448-f04429592cf1", "value": "1572864:0nphedyp6W3/22dI1DdnBynqT9cFx1O0w0DMuuceTJGtdsIe:0XYyp6W3+2S1ZUqExA0w2MukJGt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783651980, "uuid": "0ca8db07-7e62-486d-a4a3-4e75dd13de56", "value": 60429824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783651980, "uuid": "f480051a-505e-4741-809d-c3814a327c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783651980, "uuid": "860069a9-7b3f-4d15-8249-021b97ebb584", "value": "dsetup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca98e827-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783652980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652980, "uuid": "215705be-8aae-4913-b5af-cae4f1d0bc45", "comment": "Malware payload", "value": "fb2c1ff3b9fc5ac2e422ff889d2e5ad8", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652980, "uuid": "7fc3f1c3-eaf2-4f77-a2ca-76b5d309a00b", "comment": "Malware payload", "value": "b8165568c11eabc56eb6f059fc02c64a7ae6e1ac6ab723abe76f99badc1ce293", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652980, "uuid": "0fa0314f-f30d-4c67-8ef1-84d39e7b7691", "comment": "Malware payload", "value": "5b1c8db8da4cdecbf22bd3d1e669e758bb4ea7e4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652980, "uuid": "77094610-42d4-460e-b931-599889163bf9", "comment": "Malware payload", "value": "275e438287aae3c77aa7b0f37953900debde0ac33355f648261d9ef841b1c2e42f4229b30e51571664990ace5bbe74f3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652980, "uuid": "19778425-505f-4a7f-9467-b7e8cc0e1b37", "value": "T1E295128FEA6907F5C93991BC44215312EAA8BC024F10EEEB29A53D765C57AFD1F39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652980, "uuid": "5abe6b87-18b1-4ec2-8d95-1dc371410140", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652980, "uuid": "a53c67f9-bfdb-4b90-a93f-51020fa903b0", "value": "49152:5trVb1mWmnvHO4ZP6bRXgCleFFvnWSuRJiQ6wN2quEaKlqU/:+1GQC0jWSkJiQ6wUqu0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783652980, "uuid": "b9eda4e4-2ce6-49b8-bb4f-fbb0c3a33cfe", "value": 2046464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783652980, "uuid": "78d7a045-0114-432f-a7e9-ef1226a09660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652980, "uuid": "40482d34-a6d3-42a7-a49b-d2079a14b7e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c772b05-7c93-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783710831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783710831, "uuid": "34c1d989-37f7-4a7a-999d-e2a971e2e7eb", "comment": "Malware payload", "value": "9827a9093277e0eca14ea6cc158ed1eb", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783710831, "uuid": "eab421d0-b22e-479c-9b8a-ee07ea5383b0", "comment": "Malware payload", "value": "b8a082c41ffee3aed36cf5e6746bb9cbd7cd50fb5f40f8d645bbe3727b7655ff", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783710831, "uuid": "75d61a91-5ef8-42b6-8244-594c7152e443", "comment": "Malware payload", "value": "4d6ed0fbe709e88eb86c48f0c7800a370a6c0500", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783710831, "uuid": "44d71a66-9e30-4563-acad-3390a9d56193", "comment": "Malware payload", "value": "ce598121c283138675683593bfecc7da4d6136e90ab6669b6b1fa648b244d073c9bfefdc029e5a90da3abd92ebb1dae1", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783710831, "uuid": "6496fbe9-5c30-437d-8787-c27b7d5c7acd", "value": "T14AD512527F51E942C1966A71CAA4C7F86332FC0C9A62839B74E3AE5BBDDC6C34D120D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783710831, "uuid": "f668bfca-cb44-40e1-8d06-fecc3cf27807", "value": "6ae4905beb20d7fee037c53c118208fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783710831, "uuid": "8d568d29-ae5f-486d-884c-98c9919b8092", "value": "49152:k6UtbIX+WoUA2KBz1dPQjnnxXwhXeKeVJa+EbWxLK8yLR:GqKZPs+beVJaxWZKlLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783710831, "uuid": "785a297a-2ebf-498b-9702-aff80ecd6108", "value": 2877768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783710831, "uuid": "73452a66-995a-4d7a-a708-0cdc25ca83dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783710831, "uuid": "b8e56c21-a5ae-4e14-a1f6-15ff9ff0d577", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b68edb0-7c53-11f1-ac3b-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783683261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783683261, "uuid": "9bd75544-a03a-42ef-b981-e16f47573195", "comment": "Malware payload (PureLogsStealer)", "value": "1c9f8c3f1a7a6cb53ac3520d2247e4ae", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783683261, "uuid": "2ae94a5f-5ae3-45d9-864a-c839c6fff957", "comment": "Malware payload (PureLogsStealer)", "value": "bc238716915c304156134fbea50602ff998524470d72bd71edd69d7c943c76a0", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783683261, "uuid": "1f1ec8dc-5937-4d0b-bc48-f6899c74914b", "comment": "Malware payload (PureLogsStealer)", "value": "6c4a2488daf41cff420b9e05815cc6fa4636289e", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783683261, "uuid": "b686ca88-38ef-4e70-94d8-1c6b99e3da92", "comment": "Malware payload (PureLogsStealer)", "value": "639ff7481b893bfe9614bad494adb708a989b65a6475dd92fa0f3eb3165e984b0b8727bd431693345a73a65fc6a2b72a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783683261, "uuid": "46eaba27-504b-4acb-a622-3ee14dd3f20b", "value": "T17CE6E4AAFD454B6762F624C83EBB23E4861B56B10C994D45FED0CD0C483794C8EDBDA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783683261, "uuid": "4e333f74-f03d-4a99-b824-f0b203eb531e", "value": "384:8vtjBks2RU2u6LYMR5bP/KE7PuFQgjNI/ox1T5CO49r7WpDwaiw8zMvTjqUqL+QS:ZrC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783683261, "uuid": "5af386fc-0b5e-48ac-8e56-6fcbf32fe16c", "value": 13953858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783683261, "uuid": "2e7f133b-d406-4aff-8550-0eb9d7dba395", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783683261, "uuid": "90d53bf1-2035-4c82-9a45-5af18e80cdef", "value": "IMG00300 Rechnung DE00320-003200.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdeda1e-7cba-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783727528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727528, "uuid": "84d6e499-00cc-428a-9f38-a4dbb7613c01", "comment": "Malware payload", "value": "e29dbe534aefb80c169bfb057a94acc3", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727528, "uuid": "5a309a1d-b912-4510-bbdf-f7b83c99a0a8", "comment": "Malware payload", "value": "bdbacc0365e49c8df5d9f604db4bed0a67c161e82c4d6a06cca9bba101db7d30", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727528, "uuid": "58c3c3b0-d9a9-49d7-b2fd-b835cbaeae4e", "comment": "Malware payload", "value": "d035e574daf220495be1ed33e07793005bd2bbe2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727528, "uuid": "33ff2d3c-2085-49f6-a060-580eae438475", "comment": "Malware payload", "value": "208e399e8c8ca68b38b331fc4ecd0f3dfbb8f96038541d9298a64b2108cf79939ef1f03667442fecb98dddf7b4fe3d46", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727528, "uuid": "cda81047-811c-4a65-9c20-93a43eef476b", "value": "T114E63358A9D049FEDEB3003CADE2A9A5F53978740B23C99B039857A0BD572F44E3D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727528, "uuid": "67a5e41e-9cdf-41de-aa1a-2b04386f9cc4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727528, "uuid": "d3165818-2ab1-471e-937d-7c81a736d36e", "value": "393216:8g3xxOJ81gIfhohIlyS6drXMCHWUjXGcuI3/PGTAI:8g3HpohI0drXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783727528, "uuid": "4d0c3900-54f7-405f-ba90-ad5708814dd0", "value": 14319646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783727528, "uuid": "581edca6-900d-4082-8043-734981d6df6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727528, "uuid": "296ce34c-719a-489c-84b8-ef6d9f2ebf2a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c178b22-7cac-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783721407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721407, "uuid": "a9b78ca2-4549-4bef-a7eb-33407f0d0f22", "comment": "Malware payload (RemcosRAT)", "value": "e9b604db90c598ac9815aa3b61a0f489", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721407, "uuid": "af048d1b-e721-47fd-b63d-77b27eada9a3", "comment": "Malware payload (RemcosRAT)", "value": "bfcab5e114b87543cb400b328ba6555da34ddc0bcd05e0313baa3236e6cd671c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721407, "uuid": "f1896042-aa84-4378-87d9-f07b2bca984a", "comment": "Malware payload (RemcosRAT)", "value": "ea06cbe5a6380dfe388e5c84f75b113d6b83a2b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783721407, "uuid": "a1572370-8d4c-4831-91a4-1f0606914f0b", "comment": "Malware payload (RemcosRAT)", "value": "7e08170803c83c8f4de4af415c5dd8ef91491f36311cd2a3bc41f7c6c1cfba9d71fecf03a3e86d16f74720a3520bc43d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721407, "uuid": "8137cb3b-fc66-48d1-b91d-709498441a6d", "value": "T196C4AE19F75404F9D167D178C9624946FA727C4E47606ACF23A03AAB2F376E09E3EB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721407, "uuid": "50b7316d-84a9-4e3a-a343-9571143d4c37", "value": "86f1f56935451fab526b19f6de359407", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721407, "uuid": "853d3b21-07fa-4410-a5f8-db72829d61f3", "value": "6144:yL+n1/BbtB4ztYG4x3zu9lq/dPd/KyvzhbdKukf1/L1OfKZ4YETd9q:71pbtKe3zu81dPNgZmfc4nTd9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783721407, "uuid": "bc529f92-cf2b-4646-b9df-7bd5b6b858ea", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783721407, "uuid": "f7c0e838-c7f7-41fa-a8fd-b5b899cd0941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783721407, "uuid": "e9a775f5-53b5-43f5-8f52-9b02728d7b27", "value": "xbfcab5e114b87543cb400b328ba6555da34ddc0bcd05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21e2d8f-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783653020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653020, "uuid": "60e55b82-4246-4d67-b84e-4f6bc830482d", "comment": "Malware payload (RemcosRAT)", "value": "983cca37c0534eb53f981fb4eb89a7f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653020, "uuid": "07c2ccaa-c60b-432f-81d3-4ea0637614aa", "comment": "Malware payload (RemcosRAT)", "value": "c0762bd8b3b098c6d5300256f9e8bc67d45709dc244db37cc55c5e2b0312e907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653020, "uuid": "f1b91b67-7fd4-429d-98dd-4591de2b688a", "comment": "Malware payload (RemcosRAT)", "value": "b818f746e14dc148f6572c8ab264a62dbe6bc760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653020, "uuid": "5d38e063-c8f5-4301-8d4e-f623caf418c5", "comment": "Malware payload (RemcosRAT)", "value": "47bbcdb05850a83f8223722ba6472ee903607d5d5a487ca434fcd128ac0fcdf116f9f1443ea96e2c3f1aaf854181f62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653020, "uuid": "12e1f9df-ac7f-49e8-a79b-2c3ea7779790", "value": "T1BDA4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653020, "uuid": "07668a65-078a-4509-8d35-05dcf9d9806c", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653020, "uuid": "ae7abf5e-d00a-4e03-9baa-e49bb4390408", "value": "12288:/13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQCS:tak/mBXTV/R0nEF76gFZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653020, "uuid": "3db674b8-99a7-4832-8a3c-547bcb6add40", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653020, "uuid": "4f418586-7ac1-4207-b2dd-9d71b9b8e37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653020, "uuid": "ea28010a-a9e2-4d32-b2f4-004ffd654136", "value": "c0762bd8b3b098c6d5300256f9e8bc67d45709dc244db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2106796f-7c58-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783685337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685337, "uuid": "1f71a85c-9694-4add-9036-c78ba269fa17", "comment": "Malware payload", "value": "be1bc331e3173151e72c095a018b4262", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685337, "uuid": "abd66943-90c8-4172-ac84-e4f45591a94d", "comment": "Malware payload", "value": "c14b1373052bbc14adf5e2ac8f24b5cd97bc4794a18128a33e344db0b4e825f8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685337, "uuid": "5f66418b-2234-4b80-a48f-20edc78a5007", "comment": "Malware payload", "value": "729c82af1d958b58659f226882ef58583b5dd1e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783685337, "uuid": "250463bd-1640-461c-8271-6a4fc5a59c77", "comment": "Malware payload", "value": "0d10fb2074151d51162a5f0f85c59206c64d0a6a8113e666903c8477bfcf05ddc004be7a68853a5387f787db7d4d49bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685337, "uuid": "b05dca24-ad9d-4f91-b6a6-98953656c4c6", "value": "T1A04131171BE14CC1C1B173B7B8FD81C3D84A91AE23E5201BA8CFC7A2C94AB635352AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685337, "uuid": "014a29db-38c0-4f99-b73d-312076bb8b73", "value": "48:vIMf/2pyf1XoDeRMf/2pyf1XoDeLKMf/2pyf1XoDK5JW1RYW:gUupyf14DyUupyf14DLUupyf14DKoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783685337, "uuid": "a7207d32-70a7-4eac-8a87-d90ea0d6cf0b", "value": 2223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783685337, "uuid": "02e4783b-702e-4ff0-b62e-8467f71d1c7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783685337, "uuid": "1b66c27c-becc-4987-823e-b3ab3b4647b0", "value": "Cty TNHH Truong Minh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aa4ac7-7c0b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783652249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652249, "uuid": "7fa0341b-df5d-4cb6-8d32-c61217915f63", "comment": "Malware payload (ConnectWise)", "value": "1ef0113bc0e9e2d0efe9021c0b3421e8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652249, "uuid": "6876ea8a-5270-4576-a742-6d4c3749c92e", "comment": "Malware payload (ConnectWise)", "value": "c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652249, "uuid": "80615e10-324e-438b-94cd-895628a26926", "comment": "Malware payload (ConnectWise)", "value": "bbf57300b43c53857d6fb25f46b9f15b76fbf382", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652249, "uuid": "5fe03443-58a3-4060-83f9-62e4f830134f", "comment": "Malware payload (ConnectWise)", "value": "f06570bb5e6d1c4e2da7ae6efebe8896517bdd86896f901993fc064b99f7245ae5eb4ac4ac89bb7fe7e3aac2ef11b642", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652249, "uuid": "eba6a940-0929-478f-b24f-5d121cb0399e", "value": "T12A083312B2C8E53EE0B71A35687FE211593B7A147A22CD0F27A0095C5FF7A406E29F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652249, "uuid": "d7bec764-b949-490a-ad74-da4a2da6b044", "value": "f1783104dc04202edb1280448f79953f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652249, "uuid": "0b8d0d4f-8835-4252-86e7-d7ac7af855e1", "value": "1572864:s/2rwnAPGuRuAKEFx3hWt+dVGsmFi9lL8YycbwcnzCm2fSngYfian7MiefV3Qd6O:saKA+AnFx3hWt+ndZ8Yycbjnun2vxPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783652249, "uuid": "7d14b969-85be-4151-8bc6-93e9188f667b", "value": 83886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783652249, "uuid": "55b4c33d-85cf-4e5c-b127-a55201b814e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652249, "uuid": "30895f98-78c2-4c48-b3bd-ca634dd60084", "value": "dsetup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e472e596-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1783653023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653023, "uuid": "42cad770-de70-453a-9995-502572293be3", "comment": "Malware payload (Cobalt Strike)", "value": "fd9284cedf382def729cf6450aec8e54", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653023, "uuid": "988d8553-bfc3-4c95-b89c-a9543b9ad9da", "comment": "Malware payload (Cobalt Strike)", "value": "c35055499d7bf39198746a21bac07fb902e6307818898d6f961f3fdddaff5bde", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653023, "uuid": "7b663680-7d1d-4b1b-8edc-4a6723803360", "comment": "Malware payload (Cobalt Strike)", "value": "9ad4cd770ff008c6368b50661c59a2e436877b52", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653023, "uuid": "e2099d46-ff9d-4b22-8c7a-ca570ddccbe6", "comment": "Malware payload (Cobalt Strike)", "value": "8a9eb8b41f66a3210627abfa8a14f9c4f74ba1a223abf1c3f84cfc8c17b9b3a6e670d7ced589a8d14af9672e1329bc60", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653023, "uuid": "b7793bd6-aa94-4035-81ec-cac66fc551f2", "value": "T1BFD33BC7AFA5DD97DD15473844E78319133AF3904B864B132D20AA351E23BE0BF9768A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653023, "uuid": "36a0b78e-b273-418f-a1ba-4ccb6ae6e6e1", "value": "ca85b6618b1e1cad2f59872f180b38c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653023, "uuid": "1f5efacb-1481-4e81-8842-fa79ccf5b22b", "value": "1536:DFKkSAps4rasU4yamaCXRvW4eW3LNFNvtO1WUvMFMQiNsR8QHKH4RQ27:xK12PLivVLNFNvtOwdRPHKH0D7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653023, "uuid": "5a4864cd-b7ee-4550-9fea-e5394f165fbd", "value": 132045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653023, "uuid": "905d7407-0176-4fa3-b9ed-7e085e8311f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653023, "uuid": "103ec053-f417-4225-a4aa-4faf7f58773e", "value": "c35055499d7bf39198746a21bac07fb902e6307818898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e39800-7c4d-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783680592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680592, "uuid": "d5226ad5-4709-4fe9-97ee-d74d7ad0accc", "comment": "Malware payload (SalatStealer)", "value": "5d7abaa64f6ee8117b900cb20ea8d893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680592, "uuid": "0aecd683-f58f-4321-a13a-61ca5ff3d6d0", "comment": "Malware payload (SalatStealer)", "value": "c3742e8050b8664520fc1a00b7c84c2aac7eac7cec6249b7be5468504ce22d7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680592, "uuid": "0e2f1c8e-2012-430b-8eba-ac4c93e19d6a", "comment": "Malware payload (SalatStealer)", "value": "4503d6b9653b4ed66da01b3f3c1c8b688841c9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783680592, "uuid": "3746bf19-8f3e-45de-a86d-73e4f50ddd49", "comment": "Malware payload (SalatStealer)", "value": "59c4e70987767a45f106bfb7530a5102a98eab84ab642bf4d3e6db9c8a995b6850b2e704a5a00a3cbafef88bc6a5cca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680592, "uuid": "6bc208b4-ab23-42e0-b22d-2df1b5c7e1ef", "value": "T134C65C11FACB54F1F903583140ABB27F23315D048B28CBDBEB547B6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680592, "uuid": "cdd40572-7278-478a-af3b-c9547dc52ba4", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680592, "uuid": "11700e1f-43ab-4093-ab6a-c59d2350e455", "value": "98304:3o/UkrAlUr2piSTwis2Yt4l7hA4fG2IflEk:wAJxTF44lFAxOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783680592, "uuid": "edd98361-a24a-42a7-9498-30889a6730e9", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783680592, "uuid": "94b8fe8b-7cb2-46c0-a966-a8a8a3bf0ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783680592, "uuid": "3c4a3b4b-35aa-4566-b339-4ff642e6cabb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1cb205-7c71-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783696340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696340, "uuid": "e69b1940-9f56-4408-9ffc-d9c38a12e2b6", "comment": "Malware payload", "value": "0190cbb61f333a6f881c97d0901a041c", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696340, "uuid": "179a2fd4-2c3f-476b-be58-e90f2fd1f7dd", "comment": "Malware payload", "value": "c3ae0e4beedf236835a3ae14298f43f41485502275f53d35be5a5e5c663ac054", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696340, "uuid": "b50b70bc-7709-4dc7-a501-9766fed6f5b7", "comment": "Malware payload", "value": "920028f890dcf59100e4e88eacfbde7ff5e51726", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783696340, "uuid": "0bea6c5d-47b8-4995-9ac8-a54d3062eab0", "comment": "Malware payload", "value": "b8cb655b7ae8192ba31cf5b368e55eae342ffc3d9da07ad4e8701a7675d78e416082afa9b6b82b778d059edfd4276dd5", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696340, "uuid": "892d112c-a46d-4e72-beb4-45a0d79ce866", "value": "T14D768C0BFDF954CDC55EB2388063B611FD357C008252676329D8B3381E775A8AA9EB39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696340, "uuid": "a316c2e1-8cf0-492a-994f-3e1894f7a93a", "value": "4d4fc581fa558ff2e34dd9c7e03574ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696340, "uuid": "e314f739-6280-493b-965a-e49913ce40d1", "value": "49152:1VRG82E1xfDWblsebSDIQZO8rUT7MG4GfiBKUXl2x9GdCQJgubFuQ4TWiGHC+BNS:amDI7QQu9k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783696340, "uuid": "e0fde6d0-0270-4217-8fee-5aa16942fdd2", "value": 7362992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783696340, "uuid": "64cc3bc0-73a2-47cb-ac64-c18a98717f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783696340, "uuid": "a85531a6-f0e5-417d-bfd5-2c6cd91ef1ea", "value": "api.rkey", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce67f4b3-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783652127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652127, "uuid": "c64899f0-cc08-45b8-a2a3-ad29f31a7e71", "comment": "Malware payload (ConnectWise)", "value": "191618ab8994285c12d07a34e5a8de93", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652127, "uuid": "58a374c5-e523-4cdd-876e-62bd0d6f443b", "comment": "Malware payload (ConnectWise)", "value": "c6a712524646dd2775b996884b15277439de1962b27a450530fdbd0de460cffa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652127, "uuid": "144c681c-4224-4c0c-9d1f-bb40765a9207", "comment": "Malware payload (ConnectWise)", "value": "91c4fc43e22a2478b3170c576fc016141183bc8c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652127, "uuid": "798b5b05-0e5a-4c3a-ac81-e9897ed68ba3", "comment": "Malware payload (ConnectWise)", "value": "b2cb46ef67be20ba086702d54a43e45e5584b931b0e51f930451633e81cc9f0c8960975358ec7d915909cf0f31231e2b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652127, "uuid": "3c3d7710-8492-4e97-9310-a2383bde2470", "value": "T19F08332176E1C472E2B32630257AE675857A7E609B3482DF73443A1D5AF36C0A938F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652127, "uuid": "7c43f088-54e9-4531-8f4e-0fb20f5f3de1", "value": "f1783104dc04202edb1280448f79953f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652127, "uuid": "d55b800f-7733-476f-bbee-e4ce103a067f", "value": "1572864:pVH+LN90Idp9z8UC/lImB3m2wo2DT27bFd6j905UDLIAnJy:zH+LXVfz8UCNZB3xwF22j9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783652127, "uuid": "c683f600-aa35-4588-8675-9d0a29abc68d", "value": 83886080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783652127, "uuid": "4fbf568a-7361-4c9d-a8ea-c404368a2041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652127, "uuid": "c03f45b8-21b8-4579-b96b-490af6068613", "value": "dsetup.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "095737cf-7ca1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783716651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716651, "uuid": "0f03a120-ec1c-4a00-9f55-372055baf3d6", "comment": "Malware payload", "value": "0c83f838d309b887b9b33132838b28b1", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716651, "uuid": "e785e088-20eb-4f31-b882-3434eaf3a375", "comment": "Malware payload", "value": "c7ca320e009e41f13cb676d63a6b84d8d6810e9dc2ad4e6cbd44aa7f90ffcdf3", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716651, "uuid": "6e0527c2-845c-47b2-9a35-322bd43ae91c", "comment": "Malware payload", "value": "cf42e9b409cf675768e5553ea29dc60d80de95d9", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716651, "uuid": "ea92df64-a337-4cd4-b161-27617ebd295e", "comment": "Malware payload", "value": "bf4cdc14a55d454bb4a411c215196ca93abdbc3bcf300cfa862f470929c56fa9f09b186e4ca355220ce5d8529e4614ef", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716651, "uuid": "1bcacc40-77d5-4a10-a32b-880d72e238d7", "value": "T16C0723236EDECE29DF6755B395C28246247F65B4AC0B807E03985DC6CA20C4B1752FFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716651, "uuid": "e18ddcda-13df-426a-bb62-4a75b1378943", "value": "393216:mYHqYSyfCS8/EJ6pGBw1i8nJ0Hp+tR/qPyHJf3CADsob:mYJSyfyEopGa1nJgeR5HJvjjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783716651, "uuid": "fe51bebe-91eb-4084-9386-eceebd5108dc", "value": 16935547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783716651, "uuid": "350dca6f-131f-412e-bad8-a9335b817f2e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716651, "uuid": "daaac5bf-2718-4066-a83e-947fb8cb017d", "value": "data_01.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa4273d-7c77-11f1-ac3b-42010a9c0009", "comment": "Malware payload (N-W0rm)", "timestamp": 1783698909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783698909, "uuid": "96099cb3-dfae-4b94-bc1e-5eb5939bc5ff", "comment": "Malware payload (N-W0rm)", "value": "1259d26da885e746c7287a9b6af34ba2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783698909, "uuid": "e5cb16c7-baec-4664-805b-91f05c2e80e6", "comment": "Malware payload (N-W0rm)", "value": "c80fc0ffdd56020a481dd2b4fdd94d44399616da08575546e770fa61bbd14e9c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783698909, "uuid": "ccb54982-6284-46e8-a093-d6c2e15fcbcc", "comment": "Malware payload (N-W0rm)", "value": "d76f64d7f7012be058de050e51742db01ea1feb8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783698909, "uuid": "fa3ce07f-9857-4323-a517-ff6394cf519b", "comment": "Malware payload (N-W0rm)", "value": "f235e756cb978f60a20d6f55d10645591f487ba0c8d02bc820c8e5df1c17050dc1f6acacd9e19a8032c3657af744138c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783698909, "uuid": "c6027e9c-6b21-429a-b7af-33f7f099981d", "value": "T168059EA2E6C3C0F2F8862874927FB77B49385B26031595DBE3846DD79D305D2A938387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783698909, "uuid": "de6aafd9-b832-426f-8ca2-6f7e566d5268", "value": "22b71eafe851b23553c49cc2b572d2ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783698909, "uuid": "1d2bf24a-cf37-4f87-8ca7-6ffef5936178", "value": "24576:30M2KO0wUhdSQ0kcEGYyPvFHoLpgUysDAIcSGYk+pxShY9g:DSQPsIcSGYk+DSeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783698909, "uuid": "e7b8d972-286a-4184-8de3-cea955b7ed4f", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783698909, "uuid": "12786269-4f34-4fe6-a020-22440860f9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783698909, "uuid": "d1e40d79-a581-4d84-99ee-8cc804ad3489", "value": "1259D26DA885E746C7287A9B6AF34BA2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f66f4bc-7cba-11f1-ac3b-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783727425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727425, "uuid": "dd5f9b6e-1000-46ac-930c-64b70700471d", "comment": "Malware payload (QuasarRAT)", "value": "433d134b90303d5d690d76e47a70a427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727425, "uuid": "a5e4bce5-6af5-4c58-9e9f-cea8baf79d51", "comment": "Malware payload (QuasarRAT)", "value": "c97f1f67e5730c1cb688c7759f5189917c70566480eefa69e873c24cdaa65219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727425, "uuid": "7382755b-f7de-45d0-9602-2911338f2f6c", "comment": "Malware payload (QuasarRAT)", "value": "e9866eb5c5630df8783b96292a2e23fc25388428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783727425, "uuid": "b1026389-42b1-4efa-b9b6-d5a3d3033b88", "comment": "Malware payload (QuasarRAT)", "value": "d38f4761bd35b91fe668f92ed15903514d669afe5bb8ccca0862b0f8d2b0248cc6c00055b05acde230ebece134472d87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727425, "uuid": "5ad7ab6a-a5f4-4818-b92c-513423121edf", "value": "T1C4752323BBD139EDC2768235E0A78A1A9B71BCB84464DB1F47D0C1F21F677504E1BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727425, "uuid": "41a9100f-5526-46d2-92b6-b9b4376c9df4", "value": "91c15b4b4bd0b0e28e33db730aa2d50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727425, "uuid": "580b3573-c97d-48c3-80ac-4592ceefbcdf", "value": "24576:m55L+lL2r60FZ3NI561UMk4sSmAHgpIBBXXEJ32cQHtAB4rrHRT4HvOTD1eKs75J:aClUpAZG4WrGPm6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783727425, "uuid": "ea82bc20-8cef-4b40-adaa-c62cce1e53bd", "value": 1586176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783727425, "uuid": "0b6d9130-3305-48b2-a518-719ece36ab71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783727425, "uuid": "8060fb6e-033e-42ed-bedc-e947e0c57c94", "value": "SecuriteInfo.com.Win32.Dh-A.52397922", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e04e9f-7cb6-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783725951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783725951, "uuid": "ee3d5402-ffc6-42e5-962b-b9ba4b19a3d5", "comment": "Malware payload", "value": "6858b951c569fed45dbe5fbb9137a53b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783725951, "uuid": "5750e485-ae3d-4a97-bd72-2d8b555064dc", "comment": "Malware payload", "value": "cc4b2f37dfdd748e224622cf88dde7d0bfc016cb81f5b67fc9573b1431b866e8", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783725951, "uuid": "18c25797-e5a4-418a-ab57-57dab0753e00", "comment": "Malware payload", "value": "675641ec81bbbd70c8128018dcdbbb06d1f48ac4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783725951, "uuid": "ca1a994f-3e86-43e5-834d-cff5f7249946", "comment": "Malware payload", "value": "b4c48c41289cfc8db2e2c74a8f6d984c6e6c4cfeeaed3a2ae757fc55d9d4632d33e84c0335f066d22b136658ed3e7d47", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783725951, "uuid": "2659ea3b-b8d2-41e5-a329-af14258e804e", "value": "T1192733A628222D83CA6266FB2353134EAF310DB13B1287552D75F90D1CBD1FA4B5D78B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783725951, "uuid": "8f454d17-0c13-48c7-8b9d-d94e4b82b18b", "value": "393216:pnchrExS3glvWv87upe4GCAKUdSCu3et11G0bpqTiY:pCgxpe06lA7dNIeKmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783725951, "uuid": "3e188665-9e6a-4540-920b-3b4ed4f53a61", "value": 20320256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783725951, "uuid": "75e1ba5f-56f2-48e8-8d9d-ea86fee04026", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783725951, "uuid": "375459c0-8a6c-4b05-bbf5-6b224694d542", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beddef7-7ca1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783716682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716682, "uuid": "95d3fd84-17d9-4c7c-a7ea-968c585928be", "comment": "Malware payload", "value": "4647a28f31bf02a62f32bab629e3758e", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716682, "uuid": "40b08e30-451e-44bc-a5c4-3f252608517c", "comment": "Malware payload", "value": "d0c75fc6832d501cafa08ee2b0e7af722542da38116be5c9d1f86f28c54b1f6e", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716682, "uuid": "8030f14d-010b-4433-9027-225cc4b13e36", "comment": "Malware payload", "value": "186e1099f525a4129d0e833b17f1845a26e62738", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716682, "uuid": "b2128969-14df-4a5a-b45c-f0dece07db96", "comment": "Malware payload", "value": "77f77a88993bfea9feffd9cd7deea97594b93ec7429cc94b94a1f6212e5a28cec05160e33be29a84cd43946e2fa5b26a", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TwizGrabber", "colour": "#535C45", "exportable": true, "hide_tag": false }, { "name": "TwizStealer", "colour": "#C971AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716682, "uuid": "417fc72c-dca2-488a-b664-56333661e3c9", "value": "T15F1833D8B2C480EFD891A2F1F2591E3BE766F1A0460692FF4E149725F0279CC6F1562B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716682, "uuid": "ecb20482-4953-46e4-8ac4-b0b8aa935644", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716682, "uuid": "e3991830-afb1-4a92-9538-1e372e7d4abb", "value": "1572864:NejOYfXbs+CngyA/0q4aVHKffSQTIfr/DkspncMA9F1BrPw7:N4fbonKMq94fqLfn1pKF11Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783716682, "uuid": "49ec48c5-22a9-4a16-8a78-fb319832d2d2", "value": 85821192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783716682, "uuid": "488b1271-bd3d-44b9-ab66-14a579606ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716682, "uuid": "2786f595-5052-4c8a-912c-f8e038fc3147", "value": "YuboAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386fb6c0-7ca1-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783716730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716730, "uuid": "d5fd5610-7be4-433b-86e7-ea5a081a84e2", "comment": "Malware payload", "value": "e95f345ef9235bf0698f9a91efb3cf2a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716730, "uuid": "52c96571-2b89-4101-885f-24deaa663c90", "comment": "Malware payload", "value": "d1e0a027f32603f16a20f9f380b6770a9533ea9d5e02bc62b6a59a47a2200f02", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716730, "uuid": "9b792b70-ffc6-4c95-b681-a0e2217c2c18", "comment": "Malware payload", "value": "648f9c5c117053f69f94095c15ca251fe4ebcbac", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783716730, "uuid": "e50def74-c5d4-448a-aa76-0dec9a395e5f", "comment": "Malware payload", "value": "3d3426358672f62ca6dd27bf2ce8034d3dcd285b782929a12383bcff08874159f6375811a9e8cf964e76011d6582d5df", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716730, "uuid": "4b07ce20-7ace-4a26-91e0-19e1927db363", "value": "T192E63354EAC002FFF663023EDEE25999D96CF0364732CBCB135C4BA52E5B1E1883A556", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716730, "uuid": "565f961a-a6db-4426-99bd-a51ff846bd7c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716730, "uuid": "4f738eea-9f44-43ad-872d-4c57e5de1f79", "value": "393216:ldbIy0D0w2p6exHrpH8XXMCHWUjXgcuI3/PGTAI:lRw2phlVH8XXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783716730, "uuid": "33f3044a-c490-44d2-a04b-a2cf3414673f", "value": 14285932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783716730, "uuid": "e47269ce-8cd6-49b3-badf-0cb86cdeb8f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783716730, "uuid": "76d42ed1-af2f-40a5-8093-14d3ea4afb9a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f529b47-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678194, "uuid": "a1a1e01b-eec6-4fae-9853-78d64348471c", "comment": "Malware payload (SilentNet)", "value": "a0823dfc3073cb32be7c4ede5f17ed10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678194, "uuid": "444ceb66-de9b-4762-b497-6ebf1ef09597", "comment": "Malware payload (SilentNet)", "value": "d4d16e820f6ca79bf362d7bf90656c9a063658bfca57713658cd6253cc34e5d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678194, "uuid": "7492cbdc-e9fb-4419-ab19-266d85b01b9f", "comment": "Malware payload (SilentNet)", "value": "226d89e2a300032ca5b72b622a71579040e0af9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678194, "uuid": "4e10ce7c-80f6-42e4-9fd4-149cbc69b75d", "comment": "Malware payload (SilentNet)", "value": "c3ab854bfbdbab9033950d25ac44e7de56277402d0234375bf1676603bdeea29eb03163b67904b67965ece706b3d770f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678194, "uuid": "6412ccd2-d46e-4e3f-bcaa-4705c5840536", "value": "T1B8357C83EBA3C5D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678194, "uuid": "7d883fa3-8677-4d8e-82b5-63f83d9b0b68", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678194, "uuid": "8ef4d824-90b2-4c99-8f34-3ede993a28b1", "value": "12288:TZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwG7TvPqItNquB:Tcb4M06WpoPrwmTvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678194, "uuid": "44222fb3-2f65-4f7c-b88c-6942f8ff7363", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678194, "uuid": "8a3d7733-1791-4bc8-81c0-2635feabb9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678194, "uuid": "f87a1d56-9004-4e02-ad7e-7917063a3a76", "value": "RUNFIRST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6fae75-7c3c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783673520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783673520, "uuid": "342e80fa-4ba0-47bb-a428-5169958c7045", "comment": "Malware payload (Efimer)", "value": "65db1ec512c7e7f7dd0c6a3718efcedb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783673520, "uuid": "949215b3-53ca-45e9-bc36-734f8ea44c0e", "comment": "Malware payload (Efimer)", "value": "d519cb7c67d7b9c0b6a3986c68082a9e57da057fda50cdcc9a14260f934a0ee1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783673520, "uuid": "0a5829d4-121a-42a7-9549-6cbd011cbaf7", "comment": "Malware payload (Efimer)", "value": "b0db754088392116bc03aaa867860478bd9a9db4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783673520, "uuid": "646f6076-765f-4706-9995-57fc779c6fe7", "comment": "Malware payload (Efimer)", "value": "304effb9fe7544e1bda3afbb9cb7b28200f05b30d76bf8de6ea9aa9f916cc1188e21ec7792892f04007cc13d135a0a73", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783673520, "uuid": "d0968ee9-410b-420e-a3c2-61c84660c0ba", "value": "T128E6330CA4E015FFE9B3503CEEA2A2D6D9A874750776C5DF43989B226E132E10D3D64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783673520, "uuid": "7d189ffd-d2b2-4aec-b5b9-dbdc4cd38d4b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783673520, "uuid": "472b0c2c-2797-41b2-8728-d97d16201e8f", "value": "393216:V5BuwF/tHQJFE2+OaNXMCHWUjXEcuI3/PGTAI:VBLwA2+lNXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783673520, "uuid": "470540dc-c8e4-4835-b61b-d88801659417", "value": 14323234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783673520, "uuid": "a847b4f2-49d9-41aa-a4f7-595616daec76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783673520, "uuid": "1ad62a20-ccbc-4262-96c3-a7cb84d0c104", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c7450b-7c88-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783706248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706248, "uuid": "f0078db7-8325-4d15-9c79-28f650a1a5ce", "comment": "Malware payload (Mirai)", "value": "516031a72d5fab13389bf92c6568cb23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706248, "uuid": "16bfe996-3cdd-47de-9945-cedcf23c0f0c", "comment": "Malware payload (Mirai)", "value": "d623e58c95bfcedd6ad8d02bd4ad7adf98150e8781f37ab9bcd2547b59d5f901", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706248, "uuid": "edb214d0-83be-4e36-83b4-90611623c88f", "comment": "Malware payload (Mirai)", "value": "2309915dd006b8af62a47e27e9231ed987e8e9d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783706248, "uuid": "15373b15-3dbc-484c-9c18-76b6cbf543e7", "comment": "Malware payload (Mirai)", "value": "de21a94b4cfaa45f17e47659ac3ae392cf70214333cfe7c0cecfb879dc41d7d1e03f9626e065a2629012ccd9e626cfea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706248, "uuid": "5e47f858-a95b-4d7b-8c65-17883ffc9eed", "value": "T1F4631955BD82A906C6C943B7FB1E028D332623D8E2ED3217DD156F1177CB62B0D6B162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706248, "uuid": "c43bf36d-d0bd-4eb4-9421-1c83038f8341", "value": "1536:2SFzSvpQwD6MjU5c9xE03m/Ng2nlbTrAq+Yr9l2QpXvxdzhvv3FkwbZnU:xzSvp36z5uE0MWCA5YzrJ7v1kwbZnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783706248, "uuid": "d9c09201-1d87-4103-ad9b-f3aef0717403", "value": 72512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783706248, "uuid": "18ef7624-189f-4143-b5be-37007e23b830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783706248, "uuid": "3ac49064-b35f-4f3d-859c-295a862d4dab", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bc4a5a-7c07-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783650695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650695, "uuid": "6d64afe9-4e60-46f4-bc5e-df0f7a6fc921", "comment": "Malware payload (SalatStealer)", "value": "d653ada71dcf3f24d2d6dd5ef22a169b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650695, "uuid": "cbcdc425-d601-4e05-b1d3-d89364c21c00", "comment": "Malware payload (SalatStealer)", "value": "d632a7428a5a8a6c4642ba4ddecfbbe96e28ed030a204156c5018527ba4a6b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650695, "uuid": "b9a5a232-883d-4178-bebc-95e06ed8f33d", "comment": "Malware payload (SalatStealer)", "value": "ec84b042161c8037b5e6d556dc7795c10788f24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783650695, "uuid": "d14c6bd5-988c-4821-9e6e-a9a8cc210234", "comment": "Malware payload (SalatStealer)", "value": "b5ff3dcfad92c3a6d7b6dafda5149555c8a2557a1cdbca7f93d22d275a84036ee59441d59d1d42a0697b6572bb9dc80f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650695, "uuid": "32da03e7-a682-41bc-9257-ae97d53dc39e", "value": "T16DF53326F7A073C2C8E5137581D3DC0FA259B766FD26931610BCEDBA21A355BCD82872", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650695, "uuid": "90ac616d-bfcc-44d1-a870-03f4856db22f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650695, "uuid": "31166beb-dd2c-42c6-848a-e04115ab3ace", "value": "98304:XYNbHVjVmxjak/4JqxdLQJHLiyPRHlP5cJlD:oNbHJVd2dLkf7RYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783650695, "uuid": "4218ec85-9302-4a40-9264-6b634a6f1014", "value": 3595776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783650695, "uuid": "90dab53f-bf4f-4444-bff7-05ac08c9779f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783650695, "uuid": "d68af964-a3cb-46dc-b08c-148ca9de433f", "value": "setup-Happ.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ae6b3c-7c98-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783713130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783713130, "uuid": "1a08365b-14dd-4cf6-b5f7-c88977f0b73c", "comment": "Malware payload", "value": "c6a22bc6d1025589aed446466980d1ad", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783713130, "uuid": "f3c5923f-6949-4bd2-918d-86ae138c14d0", "comment": "Malware payload", "value": "d804d93cd08b0b38db03156e20382ca34980c5b9ec604f450c5563cc588a01de", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783713130, "uuid": "2aafeb8d-d233-450b-b3e4-3bda7caeded0", "comment": "Malware payload", "value": "85a6bb9ba170d55b36a3cf476343ec0dfed06269", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783713130, "uuid": "031bd0e8-13fe-4eeb-92a5-a80eafe2749e", "comment": "Malware payload", "value": "30f6b6947c9e2d17de13b66da198db3e16ec53196510b4ba5f8c7820610c8b4577b3bc10eca41193c00e568eaa80d930", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783713130, "uuid": "b602a635-53ee-4cd6-b05e-43b90f1b6fc8", "value": "T12DE6330863F041FFFA67403C9EA16966D7A978274B31C68F5BE41269BC072E09C3DB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783713130, "uuid": "9d8d9a2b-2a0a-4994-b8b4-8b9a4a48afae", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783713130, "uuid": "1eccc1f9-3c72-490a-811a-0006917dd345", "value": "393216:XUXl1D0+WYh39h/rhUy3/u+XMCHWUjX/cuI3/PGTAI:Xa5WYJ/rCy32+XMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783713130, "uuid": "17a4a0d8-917c-44e5-a916-f2eed47937f7", "value": 14306256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783713130, "uuid": "dcfb22b6-9267-4c86-8b10-bfb665e672bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783713130, "uuid": "5347b21a-9dfc-4219-b7ca-2e13ea128c51", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a830386-7c7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783700842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700842, "uuid": "343d7a41-a708-4f95-8aff-d007d7b9fe0b", "comment": "Malware payload", "value": "4bf6db92c8daaf9125b79d207cf51893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700842, "uuid": "76f116a0-d186-4687-bc08-5effcb1b611f", "comment": "Malware payload", "value": "d95b179001682c28bdadf09f6e344285562d68f15a2194b0234117de3c5e8408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700842, "uuid": "2f6dfc41-ba44-4764-aec3-f6e7442be3b7", "comment": "Malware payload", "value": "ed5d3fdfa520b24147e5afe2de6748098af26c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700842, "uuid": "fa27dce2-8800-46e4-b61e-01a06be87037", "comment": "Malware payload", "value": "c52a520ca169f9c7e3b94a348e74e5ee6228ebf37b91ebcf2296dfe6519d9e061bd85f69e2a0412d385e4110a34842f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700842, "uuid": "cdeceae6-8742-47db-8023-c5112f7091a0", "value": "T16D74F197A477AA2BE14D24F14FA8452031B5B6DFEB9442C2B089F31E4BC8E5C4917B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700842, "uuid": "2bfec841-2725-4b46-9fa5-6a9d4084b16f", "value": "6d97d5004bf284a38f3ea8331d741a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700842, "uuid": "de55be4f-e201-4c32-9cc6-9a769c10f0f5", "value": "6144:fBK23YctT/hE2PL/gggP9d7+3H9t+uv8OIzXgUDvWzDZQNdQ:foWYMLm2PDg3P9d7+3d2zXgUKCNdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783700842, "uuid": "5b30b465-8365-4b93-baee-242a17f1a39e", "value": 357745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783700842, "uuid": "a4161a9c-5c6f-47b4-8ad4-ddc12d770120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700842, "uuid": "0bf181fc-fbc1-461b-812e-dbd8e8071268", "value": "2hao.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7338253b-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783648539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648539, "uuid": "0b7ba20a-8c34-4169-9040-6c8ad000ef5e", "comment": "Malware payload (SalatStealer)", "value": "a3c1ef1092965bc58c12d579a889f296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648539, "uuid": "e4f65eb7-1987-474e-a8a8-d8e2b3351cb3", "comment": "Malware payload (SalatStealer)", "value": "d9e8f073c050b9f75f78003c05cc77bc0b60fb5bbdfb980fe6216fa0fd8ace6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648539, "uuid": "a1096eb8-0936-4af6-bdda-0dca2672156e", "comment": "Malware payload (SalatStealer)", "value": "3e5560670aeaf9ae87844f896264751efc1446cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648539, "uuid": "6c0bdba8-eceb-4851-87be-16c118ef03a2", "comment": "Malware payload (SalatStealer)", "value": "3415ed10f2a8cec1399bf1c2ac641ab9c0c4309b358706c7c6f7cc718698414ba710e9efb86f958e3eeaa13bc8be6492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648539, "uuid": "d855ed8f-8083-45df-b08e-5d57a829796f", "value": "T127E533F137B7A422F77F58F17A9823DC30C8AE294F099E85785CB83C94B67255A12B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648539, "uuid": "bd23578b-7183-41f9-8e42-13df551cb23f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648539, "uuid": "caa764c3-b3ee-40ed-a118-11fa5df4a32e", "value": "98304:nAFSrC6fBiLdno8fH8V8A7a1tm4tKEGTG+:2SrC6fBiLdno8kyA+tm4tKEkG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648539, "uuid": "ad4ddd9c-5fb6-4b91-830e-42ed64eed9e5", "value": 3290112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648539, "uuid": "75936d37-0894-4f46-98b4-8f642f94d4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648539, "uuid": "915d2b49-955d-4f9a-a0dc-9376dce866f4", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9db2c86-7c00-11f1-ac3b-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783647905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647905, "uuid": "63bd1387-d472-4021-a143-f721316cd207", "comment": "Malware payload (NanoCore)", "value": "f85edfbd3b5d8c22774f4239c920727e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647905, "uuid": "6e924f60-3970-4ed5-bf5d-a61cd71ffc85", "comment": "Malware payload (NanoCore)", "value": "dacc3d21d8d1e49fd7728f3500943b9eddd80589264d939fbe1fd880fe03938d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647905, "uuid": "fb5ac3dc-e103-4d5a-9a7e-58091f3ea1ca", "comment": "Malware payload (NanoCore)", "value": "fb85963c2e68338d4f33bdef2ee4020d7f698317", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783647905, "uuid": "da084441-b10c-4ff9-8c91-4831b57472ca", "comment": "Malware payload (NanoCore)", "value": "07203240a5265bfa8554cee76ef9fb10d8f490a2c8ef592beec1f8af92fa67a086e1afe44a33c099edd17266331f52fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647905, "uuid": "320aef3f-9abb-4807-9650-fdd09ee5eeeb", "value": "T13514CF657BA88A3FE2CE8679601201538378C2E3D9C3F3DE58D854B68B663E54B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647905, "uuid": "dcc80a29-a779-4411-a1ad-f2de474dd965", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647905, "uuid": "ba6597c6-614d-430b-a4e0-c62bd0d6b09d", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI0DE9teJPqnXjTA9LWTbg9/K:sLV6Bta6dtJmakIM59ETe5qnXjct2EQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783647905, "uuid": "e279140d-81c7-4e8d-b29a-a956c1a9e1a0", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783647905, "uuid": "ff1e62d8-2305-45ed-8d48-390aaa50fc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783647905, "uuid": "9e0c1936-3c69-46ab-9cfd-3869bf9bcda3", "value": "xoilacbongda-wc2026a.tv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2245c138-7c74-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697365, "uuid": "bdd029ed-edc8-4c30-9cbe-4ba6e7ab9a4d", "comment": "Malware payload (Mirai)", "value": "a094397afd9ce4cd35c96c11dd75626d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697365, "uuid": "71c6ffdb-24ee-42b1-99ba-ef933facdf66", "comment": "Malware payload (Mirai)", "value": "db19786c2dc80edea728fc17f8ae309fcdd6a54a7c1802334f655a83626223cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697365, "uuid": "ee0aec72-852b-4ce7-924c-2020294293c9", "comment": "Malware payload (Mirai)", "value": "91a0b5466118d1bac2a5c115d8985ec8f911b3f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697365, "uuid": "ce5fe4c1-04ee-450c-91e0-c7b11438d08b", "comment": "Malware payload (Mirai)", "value": "7ae19fab45f60fc466bec3c07ccd62abf93a2186a96333c0beb213f49d2665c8051a9f08c9056f723ebf263167ac641c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697365, "uuid": "319f11bd-d3a2-463f-9129-c45e38f58589", "value": "T15AA2D0BC6665DC31C3B8583FEB145DC2791B1BF4D1F479B64B90AA6048C622B92F038B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697365, "uuid": "9196621e-bb85-4135-acb1-a9b231d3a8a3", "value": "384:wPzRL5/AbWpWJ/hxL3JksgSRTmibYyC9uj9OS8vDShymdGUop5h2:SzRL5CTJUSRTmEouYnus3Uozw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697365, "uuid": "94bdbf40-f8f6-43a8-bd73-8ee7f8c9fbb2", "value": 22128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697365, "uuid": "45e21601-d5fe-48b0-9aac-cdb7782bb267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697365, "uuid": "187551c3-008a-4636-bf31-81d85146c91d", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c26edf8-7c51-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783682403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783682403, "uuid": "efeba252-15da-4177-9983-5b50ff8b9017", "comment": "Malware payload", "value": "0ab6f60914969e057a812ae7997faad2", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783682403, "uuid": "6ea4ef89-6916-4f54-b8f4-1c860daf1ca2", "comment": "Malware payload", "value": "db6b320a2d734a81d7b5c5ffeb47d01629ebc4db7023c89ff19eeffbbaa2fbe4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783682403, "uuid": "78c075e0-2c55-4726-b39a-710b1a66695a", "comment": "Malware payload", "value": "169f94f86e1fb1e9dff68373e5dbc9e77ca6a2e5", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783682403, "uuid": "a0af4944-10e8-4d82-9e48-ae9cb4b494ff", "comment": "Malware payload", "value": "9e88f73459679dfcf88942ce2150a6a27216021d6244cb7a9119924b78dae0b82129981cc64efe8b12868fb9982165bf", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783682403, "uuid": "2daaa082-9084-4976-8ca5-0c3888c8b503", "value": "T156E6F11BBE83447AC69124B4C6DC72A56F79B488071366839E0BF32C5E762D478BE3D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783682403, "uuid": "7e679da4-d99b-4b47-964b-87fb39874d4c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783682403, "uuid": "d9225040-20f2-4002-a641-5b477c66a565", "value": "196608:1hlSJalL9Sr94a++C6Q4Cb70lng+bMvqKMP7BXM7j+3daOTTok03By:1hf9SZaL70oSKMz1XMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783682403, "uuid": "be89c737-2c38-4178-956c-20f31b380ccb", "value": 15146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783682403, "uuid": "e0a16f4d-96cb-4732-98af-6467ec7bd4b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783682403, "uuid": "99bcbcaa-5161-4c9c-8690-b0d083250b94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5643aa45-7ca2-11f1-ac3b-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1783717209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717209, "uuid": "a9b1e161-2d3e-4c29-ae40-e84a0e61bf93", "comment": "Malware payload (DCRat)", "value": "8a2be6a44b16de6ec59a8ad599eff2b1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717209, "uuid": "d2b30b23-ca6f-4faf-b71f-1a40c95d7148", "comment": "Malware payload (DCRat)", "value": "dc2a074cd511f6a130c72a365c0139399610eee9e50368b9f3be20016ede4a4e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717209, "uuid": "7d76db07-5d59-4ec4-8e65-d9bc7f27d850", "comment": "Malware payload (DCRat)", "value": "15aeb7fa04098f60e937e0b8e2a6431d2ef30ffe", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783717209, "uuid": "a8cb3645-3ea4-431b-a515-4017cff48b8d", "comment": "Malware payload (DCRat)", "value": "6fdca7ac53b71cf6217c5eb2b9f0b113613eccea6ba19f540e371a3ad2fbd242d11163a89e93757f40b85b8e3d1ec32e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717209, "uuid": "8566a109-6439-4fab-aeec-5c8bdb9a5d22", "value": "T17D557C01BE44CE21F0181633C2EF450447B4BC516AAAEB2B7EBA376D59123977D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717209, "uuid": "9927b192-8053-4f8a-a4a1-97fc0af68a59", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717209, "uuid": "02809989-6ef0-444f-b1a3-412bfe66ffdd", "value": "24576:u2G/nvxW3WieCWl3xoQXp1UqKd8wwHcxhIDS5+u9sgzDk7on2kC:ubA3jQ3n1GuUuO9sgzd2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783717209, "uuid": "b1ef97a9-4cd8-40dd-ae6f-60a0ad42d9bb", "value": 1371306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783717209, "uuid": "a50eaca8-5b88-4e53-b3dc-a2fc1512b403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783717209, "uuid": "fcceab8f-38e9-49c0-badc-0177c38d8f36", "value": "RAYCl0udExecutor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbedbc44-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1783653009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653009, "uuid": "860ad547-de2a-4ba0-98df-30b135673169", "comment": "Malware payload (njrat)", "value": "1b622c451fcc9d83aad8bf45b1c42b5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653009, "uuid": "524eead7-b4b4-494c-9722-a06ffd0e1bd0", "comment": "Malware payload (njrat)", "value": "df4e36252bf8a2b1dee291bcaf9e0505246cacc1d1ea9db3494f30c8506ba0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653009, "uuid": "3fa90cce-5f5d-4edf-8331-9d1d155f2920", "comment": "Malware payload (njrat)", "value": "2e70ac7f1bdfc2f9912448ee2b6c2c478bef3aab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653009, "uuid": "1186b736-d45e-4c3e-9b03-6165a14d4db1", "comment": "Malware payload (njrat)", "value": "c29bf1f74db5618fd90a43d88b7b4c3db1797476cc16eac97b4aa7bbc005226e61e6f292d4516c056f15e59e6de72fc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653009, "uuid": "e1d885df-1f33-451a-bc78-357ba519d3ec", "value": "T19993E94977E52524E0BF56F75471F2014E34B48B1612E39D98F219AA0B33AC44F8AFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653009, "uuid": "21319f42-7bff-4f89-80d8-538e4eeb0462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653009, "uuid": "ebbbf29c-04f6-4adb-b1ad-261ed81ea56a", "value": "1536:UUNJD/HBZbszKu9AZp77r1jEwzGi1dD8DlgS:UUUzK4AZtHCi1dyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653009, "uuid": "6f5fdbbe-47d4-485e-a999-5e4d0f9db2a9", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653009, "uuid": "544a3932-bed1-4de7-a5a8-29f9f6772227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653009, "uuid": "25977db9-7c11-49e4-987d-84c02b45e9b3", "value": "1b622c451fcc9d83aad8bf45b1c42b5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf71111-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783648555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648555, "uuid": "f1353789-64fa-4a19-b000-bdddd1d2c377", "comment": "Malware payload (SalatStealer)", "value": "968b49795eddd02848759e0f1cf7c838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648555, "uuid": "9468bfd8-6952-4467-84e5-659e26382ac1", "comment": "Malware payload (SalatStealer)", "value": "e08ba6b6bd164546cc8f8819ab67d22f7a410d6fe9bbb2e350dbe24786e93d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648555, "uuid": "f8ee3c3e-596f-45b1-a07e-6e3a1abe6eed", "comment": "Malware payload (SalatStealer)", "value": "0cb3f9f77acf2075a6074b05b56ab1b54125226d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648555, "uuid": "cea42fae-df65-4e78-9107-22f8f19ec8cf", "comment": "Malware payload (SalatStealer)", "value": "ce8fce626d8e6bce5e7879a0d3cd960b24b0392204c9880a6cb632967dddc59a0ee9927dc7a58ab5564de32d60a11ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648555, "uuid": "89f60c9e-fdf4-4c22-906d-065408213dce", "value": "T1FFC65B51FA8B54F6E9071831405BB23F63305E048B28DBDBFB547B6EFC7B681186A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648555, "uuid": "c57cb9a1-0acb-4609-be09-7bcd401a9267", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648555, "uuid": "e44f03d2-8472-4989-a49c-b9588fcfa470", "value": "49152:DwlReXmtDIXDYPXrgMTGy+1xE2EEYaujUSoWUi/XUNJN/DBd2v2KDrBnafZVO0RE:UqXus8r7wtxrZpupDgvNueHE61U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648555, "uuid": "7e39bb9d-c86c-40e2-bac2-305a1fd1a0c7", "value": 11656704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648555, "uuid": "f5f45fb5-66a9-4b4e-816b-f1120bf7cb13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648555, "uuid": "ad9dd3c1-632b-405b-93b5-ac9ee7c157c2", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0734fd-7c63-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783690399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783690399, "uuid": "8f3b6e69-7576-477f-b433-deb186d5fdfa", "comment": "Malware payload", "value": "916d46726f95a3036201ec83f9868e5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783690399, "uuid": "b901e3db-cfb1-43a8-9108-5b6e38771c5f", "comment": "Malware payload", "value": "e1a7aead734c79d37f42cbc8fac0f9fddfe6154ad8a892bb679fd9eb0fa49ee7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783690399, "uuid": "e64424cf-8da3-4c83-b0bd-36e2a60a379b", "comment": "Malware payload", "value": "66634f5ea96d79ac686db29a9c575eeba264e8ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783690399, "uuid": "cb55eab2-a3a0-40ed-bd8c-aae37d0f1bf4", "comment": "Malware payload", "value": "9904464bd3f75e9480b0641b0eed2f8e7a689d39ad46764608e659419c82660e71c696125d09c0d4ff0ff0b16dc17708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783690399, "uuid": "3324f983-a9b5-4e1f-bc2b-5d308774be65", "value": "T12255E657E89580F4C1EFE174C726A213B9A13489473437E76FA18AF11B26FE866BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783690399, "uuid": "960f3819-0de1-4033-81cf-1c289846967f", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPli9+clei:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783690399, "uuid": "df5b522e-c828-44be-a9fa-af7e09ce4f3c", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783690399, "uuid": "13c445bc-7eab-4cf2-92a2-20df8aa52ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783690399, "uuid": "0f00588a-13af-46f7-ba34-086c84227758", "value": "e1a7aead734c79d37f42cbc8fac0f9fddfe6154ad8a892bb679fd9eb0fa49ee7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159e2634-7c1b-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783659119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783659119, "uuid": "ceb35587-897c-4c3f-bdee-c3a728c857f2", "comment": "Malware payload (Efimer)", "value": "e3ee9a97d742f50631e085a1ede54613", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783659119, "uuid": "4d85f0a3-93c7-4046-9684-0ee5cdcfba7a", "comment": "Malware payload (Efimer)", "value": "e32a3cc8a2a999af697bbfca1ab41f7605a593484d241da10d3fa6819c8c598b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783659119, "uuid": "d1bfd7d1-5deb-4357-865a-601d61bb1a82", "comment": "Malware payload (Efimer)", "value": "3100edb0f59e934d64fc4f173ebe6b860ed0d0ab", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783659119, "uuid": "49208b4b-cb87-4e4c-a7d0-9c393c006027", "comment": "Malware payload (Efimer)", "value": "9557dc0b2cf5afe9e188f0512f9b1dc856379a9f9616730c7f9e3dab172faedf454d3d16aa1f1c266ab713f14e2479b1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783659119, "uuid": "f9c9c3f6-bd06-40df-a4a4-6609dcd8a203", "value": "T101E633086AC810EAD6B3503EBDE14B46E561B0661771C6DF63E0DB61BE2B1D1493EB33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783659119, "uuid": "aae71dc0-0afa-4572-bfb4-05144011c2fd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783659119, "uuid": "b699cf9a-71de-42a4-b525-b01c95d57cb9", "value": "393216:x+vjbaoQOzrwJWEfFfpO/jXMCHWUjXccuI3/PGTAI:x+fQO+m7XMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783659119, "uuid": "cd8e4b7e-89f3-4135-b1e1-af97b95ff6ba", "value": 14307433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783659119, "uuid": "e291ad86-6965-4e19-b068-a370f04ec8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783659119, "uuid": "b1e4856a-5926-4afa-a98d-a50aaff46234", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299abdd9-7c2f-11f1-ac3b-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783667742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783667742, "uuid": "62234510-2456-435b-8a96-52fc550d842e", "comment": "Malware payload (WannaCry)", "value": "dc614bc8781cb85e4ddf2bbb7860cb84", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783667742, "uuid": "905fe468-9452-4283-b45f-27c7ff04bb50", "comment": "Malware payload (WannaCry)", "value": "e4846ec6171f65e96c2909ad93359451551e3ac95aa89ab349d5ab773cbaa0d6", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783667742, "uuid": "74c336a6-5d33-410d-baff-19e19ddf10cb", "comment": "Malware payload (WannaCry)", "value": "57ccec59ebeb2aecbc045d01853412ca2b1c3e0e", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783667742, "uuid": "d16f08b0-99e8-47d9-917a-d0aafe7cdc56", "comment": "Malware payload (WannaCry)", "value": "6c5d7010c80a999da473e88d292724952a44e393872945e8fa6957c66d9072635403f4a2b8ad65606fd8a553d4c0560c", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783667742, "uuid": "a1cba8a5-144d-4f8e-925c-ea137134044c", "value": "T1D2E5129631EC40F4C1066274E8B74E15F7B77C6A3279960FEB908B252E13792F628763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783667742, "uuid": "25f6d745-1da1-4f52-b164-98bc82bf6f6a", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783667742, "uuid": "10eba543-7a88-4e74-853d-ceb6b36eda22", "value": "24576:jbLgBbLguripdmMSirYbcMNgef0QeQjG:jnsnvMSPbcBVQej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783667742, "uuid": "975056a6-11ce-4fab-ae89-f21effcc1e92", "value": 3061760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783667742, "uuid": "79f90231-5bfe-4478-8ff5-42ed3a2b9007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783667742, "uuid": "a5cb9b61-51ba-4b9f-8bcf-69d9400b515d", "value": "e4846ec6171f65e96c2909ad93359451551e3ac95aa89ab349d5ab773cbaa0d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8316ecc-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1783653030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653030, "uuid": "4c21303a-c57f-4dff-be48-1b3bc38e5da1", "comment": "Malware payload (RatonRAT)", "value": "9a1983ef9feea7bdb06c17d5957db7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653030, "uuid": "bd656fe9-2c88-48f6-80af-98df0c6bba8d", "comment": "Malware payload (RatonRAT)", "value": "e8573e97c75bec4b9645f40c94a1f961971aa28444e3726564f4dda1312aac25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653030, "uuid": "5038277a-92ab-4d9b-a3d3-bde8eb289470", "comment": "Malware payload (RatonRAT)", "value": "3ef07367be035c6524b96fd552a57f309710b34b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653030, "uuid": "3dd97870-4141-4d6a-b633-e29486c13870", "comment": "Malware payload (RatonRAT)", "value": "b47c326d7da7ba563f1367ce09466746ef5c4d90599e7ddfccf46c8eecd37c68a37dfe46428bbc9c4b20801a43347579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653030, "uuid": "c058a238-430a-4735-83f2-28b743d78ccf", "value": "T18906CF407BD4CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653030, "uuid": "9e7ca806-d8a6-476d-8a23-29f47938d6fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653030, "uuid": "7ef66ff2-f61b-44bc-a710-c4417635c0e2", "value": "49152:5mu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sk:Cq0WgVUuHjkDGjYQeqpgmltk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653030, "uuid": "230a12a0-84cb-447e-b834-58efc5fa5591", "value": 3695616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653030, "uuid": "13e36db1-65be-419d-8f35-409559e76d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653030, "uuid": "cc9a4abb-b559-47b6-8ca6-bec1c89c93f2", "value": "ratonClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938f9786-7c7c-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783700991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700991, "uuid": "0305ac33-e293-4310-be22-d85bb81935e5", "comment": "Malware payload", "value": "75271cf0161e8511b7be50b0e838c4da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700991, "uuid": "947e16d8-755e-4bba-bbce-0db7f59f9667", "comment": "Malware payload", "value": "edb371be39673ca248b4dcb168de0efd90e9d7a39d7cc096c83c435bd6fe260b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700991, "uuid": "2085cf96-bc3a-4d90-9fbd-d09c473d2eb4", "comment": "Malware payload", "value": "a312052ffe4b7ba74aa2dbba29ae35904abc09f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783700991, "uuid": "7936f37a-44b2-4a5a-a132-5b7ff4c4b925", "comment": "Malware payload", "value": "0d74474a8789b496d93eb05704e73a693e15353c3a91662103c16cb7daad086a46af979695ba39f8b12e51e16f27a699", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700991, "uuid": "25bd97de-64a7-4def-8ac5-f76383f553c4", "value": "T15E272316A3FD579AF1F7D6709FB4C919F82ABC3AE932E79D0581211D2A21A104C61F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700991, "uuid": "9ec75449-bea5-4820-bd20-1d24f4d78a0b", "value": "928fb3a3e14a2213f2685176d1af18ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700991, "uuid": "55f17068-8966-4582-8f1d-c69f6dfb311d", "value": "393216:nYzGVwNvb/3F1CedyoXbs9GEike+84hEYzZk0SEeE:svb/3FUedVXAAEie84h5VLSEeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783700991, "uuid": "dc292983-8590-431e-adea-bb051e2b783d", "value": 21384288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783700991, "uuid": "c75ed053-0b69-4f08-8318-e158c349a4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783700991, "uuid": "ae818b57-1051-4366-ba8a-bfa951feac1b", "value": "Soda_Music_12.8.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57436623-7c69-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783692730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692730, "uuid": "f9734e62-aae2-4105-8faf-1ecc92be3d86", "comment": "Malware payload", "value": "9791ad718e91c69e6802f529bfd1b110", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692730, "uuid": "d5d173b7-b839-43bf-a8ae-222c1ae7cc99", "comment": "Malware payload", "value": "ee4169ae62236462925b7ef0934d2fd4e10d8d64f97ce4555d625aa390c73041", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692730, "uuid": "e43a6e7f-3cdf-47a1-8ba6-467194c879ae", "comment": "Malware payload", "value": "5e353a4eaad8d448cd288b92e69f561af57a126a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783692730, "uuid": "05559f73-8e27-49fa-9e18-72b08626c08f", "comment": "Malware payload", "value": "18241df8dde17557b3ffdee0dab424755f1d3dca3702221a53e4c910b3ca785bc937c5078da4ec525bd3bd63ad07622c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692730, "uuid": "a7b88c15-4436-40b9-bddd-f70ab633884d", "value": "T12C1633163799E23DC876513A6C6FA2B27B61BC638D4282577441332F7EB32E04F11DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692730, "uuid": "cbd9cd3f-6b67-4b44-a59f-7dda505bbb13", "value": "98304:xnkJz8YZAq7bdol+UiUJs/+SI2MadhTHVgQwVElPx:iJz8VO89RjSDHMfElJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783692730, "uuid": "7bcaf631-1690-4f49-9b28-f7cd13429a26", "value": 4326109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783692730, "uuid": "e7738885-9e5c-4654-bb36-52d3f5b2d9cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783692730, "uuid": "96570295-a866-4c42-80ed-863ae9719310", "value": "mparivahan.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3440cf01-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648433, "uuid": "028df10f-795a-4427-b3df-e4145847b60a", "comment": "Malware payload", "value": "3dd013aee8409b61b871907628ef0e59", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648433, "uuid": "451cfe21-3c78-44f9-a546-2de203c5f97d", "comment": "Malware payload", "value": "f0d032c835744156d134ff521c8bc2996f0d7922c7c0c8c31f12fb27d7dddc99", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648433, "uuid": "186c5903-3cdf-4b3c-9e32-0b700a26e745", "comment": "Malware payload", "value": "aaa4c7aa620920ca00f598e207ac70f7f0d8064f", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648433, "uuid": "4541edbd-0144-4aa4-b8e4-c0eddfa4991c", "comment": "Malware payload", "value": "5ddfad1c5996d5485b786c5f8769139cd04f961beb818d715dff018f9d9bf9c29a5e3abccf369b8d78a35459979b1862", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648433, "uuid": "2d142fdf-85cf-47a9-a139-e4a63e35dbfd", "value": "T1536164A7F02629B71379C9A5688B31C4329711574ED83924F8BEBE0D7734692B73C60A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648433, "uuid": "cd942381-6fea-46e6-bcb9-0600da255536", "value": "96:eUsMHCLJ/JBGzhbznugzlgQp9wyYK3RZy7C0CF:e3Yc231pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648433, "uuid": "91542da4-c53e-453a-bc5e-9d685d0348bf", "value": 3408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648433, "uuid": "429c48c8-89ac-474b-b33d-8eeee4a6512f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648433, "uuid": "8d488275-dad9-4ac3-84e4-cf9b58fc1317", "value": "macos.body", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7b47c6-7c0a-11f1-ac3b-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783652201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652201, "uuid": "861168b6-d84b-47de-bac1-e7f03bb761fb", "comment": "Malware payload (ConnectWise)", "value": "11724fce9f766a838d7dc18e4b2132d6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652201, "uuid": "3069f3a3-37c7-488e-9e39-eaab6936488f", "comment": "Malware payload (ConnectWise)", "value": "f101a45d8085c6fc1fa111aa9219abe2adcc16705f3ebeb91626fbd085ba9d13", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652201, "uuid": "b944eaec-aea0-4281-b0bc-42b0f07c6387", "comment": "Malware payload (ConnectWise)", "value": "4b54fdc4845245edb8b64a8adf5156a43f3a1827", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783652201, "uuid": "3bafbd6d-4860-498a-8461-bc4bfc33c29a", "comment": "Malware payload (ConnectWise)", "value": "3694721d9f93e76339910f1e8d9297adc5a6bd7b0814ff6e12606f849730c753f9f2a675d6a52a9e7890cd7f5ffded2c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "micro-vpn-expres-top", "colour": "#3F3967", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652201, "uuid": "24fa932c-65b8-465e-ae0e-67fec9ea2be4", "value": "T17C0833406C98FE7D3D0668B624EDA11F25263A0443B10777FBF9227E628B751DEA4B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652201, "uuid": "382069a3-fdf0-4964-8938-adf7ccc5d58f", "value": "1572864:L92refS7gojGaqKR3Nporg118m0Fml3ldyUyIWgQcmx9HjfjO2EjP7ueL9YJYu+v:LsISuaxR3Nporgff1pdWgQrxViPr9K+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783652201, "uuid": "7c2eda62-d068-4b97-a8e4-78e9935cc0eb", "value": 81508113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783652201, "uuid": "d92600c5-1089-41ae-8327-23286de30d91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783652201, "uuid": "bbd39e68-30f2-4751-a696-eca3cce8b692", "value": "ryujinx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35cee577-7c02-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783648435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648435, "uuid": "11cc93fc-a49a-4d78-9a96-54be0648b326", "comment": "Malware payload", "value": "6d912cb3f95aaba276186445c4702d85", "object_relation": "md5", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648435, "uuid": "58b7a581-0308-4504-ab5d-979ac0ba2a9b", "comment": "Malware payload", "value": "f101fda6093f12758efae630bc265d6bad71479249685b7503c05e707424a276", "object_relation": "sha256", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648435, "uuid": "af08167f-0ca3-4378-b337-274afe095b4c", "comment": "Malware payload", "value": "6e5581f48582385574d18852a6cd065380976f67", "object_relation": "sha1", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783648435, "uuid": "20566cf3-2f9b-4713-a7b1-d4bd3f9e83c7", "comment": "Malware payload", "value": "3a4ef0b61246f20726a6b3a5123e2befdf2007ff380d400bcf7a590b2ec77ad14c4673b860c004ac994f68a28e8c4780", "object_relation": "sha3-384", "Tag": [ { "name": "BeaverTail", "colour": "#3B1A5E", "exportable": true, "hide_tag": false }, { "name": "ContagiousInterview", "colour": "#6447A2", "exportable": true, "hide_tag": false }, { "name": "FamousChollima", "colour": "#534F1F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648435, "uuid": "33c52e5b-5577-44b0-a3c8-b8ab1a27e601", "value": "T13D8185051C4821727A9FC979ED5501C2F3CBC9EB0B481DE6B46EA48E1F1C8E64AFC1C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648435, "uuid": "84d20585-5a9b-43d5-b3e1-038bcff0a8a6", "value": "96:acD3aBqy/pfBLcOBO0O9CESBy+ZCObAjvchYTuo:acWzzHCCE9JP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783648435, "uuid": "3e556eca-7d06-4ecd-a8d9-fbd587470e30", "value": 4037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783648435, "uuid": "8b7418e2-5440-496a-a796-2136d2493233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783648435, "uuid": "09dacac3-b79a-4d57-9ce5-c04625dfb237", "value": "windows.body", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02a6ce6-7c0c-11f1-ac3b-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783653016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653016, "uuid": "5a444f47-bb33-4277-9b88-189eff0148f8", "comment": "Malware payload (RemcosRAT)", "value": "654607f31a256d943a2de9b63b30929c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653016, "uuid": "ca7829ae-f77c-44a3-b1c4-3fc105dfac2c", "comment": "Malware payload (RemcosRAT)", "value": "f35b6cb6af991bfa735e039f6bc0e49c69759c015a2074b87eed8f20e4200135", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653016, "uuid": "85e3c62d-15e8-4dad-8d84-9024bbfb9f67", "comment": "Malware payload (RemcosRAT)", "value": "679fb2dbfe81808a883729d15cd03b99eda8d1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653016, "uuid": "ef5bc7fd-04ce-410a-aec6-6fb460a7d3a3", "comment": "Malware payload (RemcosRAT)", "value": "2497caed94e21301f97044afeae2bde78c418c683c38105d98dee68f8108d6775c0c3856094ed0e2ab103b7a361ede99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653016, "uuid": "25494b8a-67b1-4e1d-98d4-453f78af2ab9", "value": "T194A4BF01BAD2C072D57654300C3AE775DEBDBD212839897BB3D61D97FD30190A63AAB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653016, "uuid": "7e7a5d38-fdf0-4426-95e8-9cf5a2146b41", "value": "e77512f955eaf60ccff45e02d69234de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653016, "uuid": "8e3fdf90-c889-46f0-96a2-12d62420fca2", "value": "12288:/13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQmS:tak/mBXTV/R0nEF76gFZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653016, "uuid": "b2bad25f-f5fc-479c-b197-ac8c7e7604a8", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653016, "uuid": "8866b6d5-25dd-4011-a376-32b292071f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653016, "uuid": "d006b1bf-3517-4826-b466-85180f1274aa", "value": "f35b6cb6af991bfa735e039f6bc0e49c69759c015a207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d48576f-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678056, "uuid": "ae29d4f1-d255-4c3e-a9b0-aed2eb43cca7", "comment": "Malware payload (SilentNet)", "value": "619ecac4ac487ce74331cae8258c4227", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678056, "uuid": "9b41b033-c5d1-4673-8150-aa46022d57a9", "comment": "Malware payload (SilentNet)", "value": "f38c4ec565e4b4d2ef603e26ee5d226a43d3b8f4bcd84f77cb857f730ec13847", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678056, "uuid": "dfeca82c-4063-4792-becd-7ec015fa7670", "comment": "Malware payload (SilentNet)", "value": "4c14bec1f13ed925955e364ccbabe14792644666", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678056, "uuid": "4b88d2d7-9143-4ddf-9292-10275bfc4e6c", "comment": "Malware payload (SilentNet)", "value": "5e7ee9bcef7bab3b2c0dc5e1267d12fbfe98bd03504ce0396ee549ea750ffed4ef74c599187b0caf42e752852391ca37", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678056, "uuid": "eb9d3bcb-981d-439e-89c3-b3c30c7a9012", "value": "T13B14127A915FA12AECB7A73E8790DD92B97693D47206366F03E058414CC0CAF1B44FAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678056, "uuid": "ab10e217-b25a-4606-add7-3eb406b7a6de", "value": "6144:MLODuw3yvA1tDkE70+6xJUqHj6m17980Grnfwa:XjCvARkEoRJVHj6u9lGrfwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678056, "uuid": "9bf7c101-b7ef-46af-94e0-4f9fe17be05c", "value": 199729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678056, "uuid": "23416bf8-8505-4817-a216-ae0fc1457e86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678056, "uuid": "499549ee-c366-46e7-97f8-4d1e13c1a77e", "value": "FastCrystals-1.21.1-fabric-1.5.3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9106c9e5-7c6d-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783694545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783694545, "uuid": "bc4886ed-9c71-47ca-abb2-94d3192e96c5", "comment": "Malware payload", "value": "b3f27683415acb46724aba86b949acc4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GiftVault", "colour": "#24B043", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783694545, "uuid": "552d60a6-8626-4d08-8ab1-1ab44caccadd", "comment": "Malware payload", "value": "f651876e9185c206d770229b0cb312b7ae620225e0e6768709b93d4258bbbced", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GiftVault", "colour": "#24B043", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783694545, "uuid": "f771ad60-aedf-4fd0-85b4-03be0bc0c7f0", "comment": "Malware payload", "value": "9cb266426261bb8e2c4488d1ac316fc0b98454b5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GiftVault", "colour": "#24B043", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783694545, "uuid": "a207a6bd-9b77-46e0-a871-c7f3015b06f2", "comment": "Malware payload", "value": "f6975c24ba98071a23fd9862ab3825c994a9dc31d38c47d0d5e2709ab03d7065b47cf7fe1c19251a7c4f94471a9eccd9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "GiftVault", "colour": "#24B043", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783694545, "uuid": "e80434be-1583-47c0-aaa5-56874ae822f5", "value": "T1C317239BEBC45D5AC8F31732843A5AA244478C268B839BC79F44367C58B76D40F4EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783694545, "uuid": "5d63a51c-58ab-4f8b-a99b-896e38422268", "value": "393216:0m1Bl750UVXv+kV0kloCLCE5UDjFz3icErnex3Sjvw99H/6:h3J50UVXv+w0BCL8YcEb83SC9H/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783694545, "uuid": "a3f16917-9844-459a-ac85-cbf8324ea5db", "value": 18601130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783694545, "uuid": "67b310d7-ddde-4c11-9b94-d46e89931fb7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783694545, "uuid": "27e3be48-01af-4594-b412-b99eafcc3536", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9fadce0-7c73-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783697244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697244, "uuid": "87da678c-0146-4b6c-8b93-461353d9d366", "comment": "Malware payload (Mirai)", "value": "a6615c5d0010b68510f555684227af9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697244, "uuid": "53551612-34ca-4652-ba41-27742ba67c3c", "comment": "Malware payload (Mirai)", "value": "f6fabebcbfe563fd6757c5cdf528d97ddd14ffcad1a90c4149ba9993f8da9ae0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697244, "uuid": "def72333-fa4b-47e0-b8f3-71e69295a48b", "comment": "Malware payload (Mirai)", "value": "ae185a0986ef918aa7f9da00d2b2ed2a489f57eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783697244, "uuid": "e2484b4c-3035-46e6-a09d-bd0d36d5b629", "comment": "Malware payload (Mirai)", "value": "63c441d0ba49bc5e9ea15503a4c300a06de6a3e0f69d77fc410c162ce72e7eebf65412783a851778d2150e5144e4e8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697244, "uuid": "91b1db96-13c6-4361-a9fd-d02c908e375d", "value": "T1C2432925B57A1F23D0D0A4BD11FB8B59B2A15ADE26A4C64E7D720F8FFF216406803DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697244, "uuid": "0aadcb5d-be9d-43af-a1e9-221dc5928b4b", "value": "1536:fOeCbzFJjlxC0SnNoudzHOGuLNrBNLfiO:GLYEGuNBN7iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783697244, "uuid": "257c2f4d-5628-411e-92e0-a7c9aeafc293", "value": 56952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783697244, "uuid": "55b29f3d-7639-405d-a5c6-6d72d0dabf54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783697244, "uuid": "37f1d754-89a1-408d-8ea3-2000c08ea071", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320194dc-7c47-11f1-ac3b-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783678064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678064, "uuid": "b784027a-408a-465e-a840-ff227d1c02ac", "comment": "Malware payload (SilentNet)", "value": "dea4721c6d2694770c60297ed38f24b1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678064, "uuid": "5e6a7fa7-db94-43fc-9ac6-b933f2315d74", "comment": "Malware payload (SilentNet)", "value": "f843b48137d1137d96e9a9da1fb4b2fdcee3a502925009382ef118abd79fc7fa", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678064, "uuid": "cd9f19f1-3bb6-4f0a-9a03-f68d3293fb59", "comment": "Malware payload (SilentNet)", "value": "4fd52653cbb86b5c098261344d88aca1d2ee6add", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678064, "uuid": "5409bdc6-1b3a-4b2f-89dd-343b7c60e565", "comment": "Malware payload (SilentNet)", "value": "5e019e24cadb6fb719896d6c606c46d448d7cebbbc33513e981364a5cc329fc738aa62270e1f23debd2ded8d90a95d15", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678064, "uuid": "b7fc3349-62f9-4ce0-90b5-da3729ff83c3", "value": "T1F244235E7E49005AF413E17FDFB42C9AED0393E05009582BD83CBE5CA12EEBEA15D661", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678064, "uuid": "877c4943-df69-4adf-b8ac-4cc3423e2867", "value": "6144:IoSJZ0QONIPA8mp2edLfDb2BEPZN4/giGdGa2RMxDoV/uK9mcEqv0bi01:IoSr0Qo0A1VDb2BEM/gMFR0Dzopmik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678064, "uuid": "39c7f2ad-39f6-47e6-a8f2-c4af8022789f", "value": 271642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678064, "uuid": "881f0782-0ff9-47da-b7ed-03cc77bb78cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678064, "uuid": "6fcf3d47-9f10-4f24-bc0d-ebe956c6bc35", "value": "Pulse_client-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0409ad45-7c48-11f1-ac3b-42010a9c0009", "comment": "Malware payload (OverlordRAT)", "timestamp": 1783678417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678417, "uuid": "9c9a0051-3ea8-4f4f-8e84-ee4e7422b512", "comment": "Malware payload (OverlordRAT)", "value": "9ac739f69647379eb083546f9c126bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678417, "uuid": "315d98ad-b109-42a5-a98f-f005b6da230f", "comment": "Malware payload (OverlordRAT)", "value": "f99db7a12ab80b11c3fdec7bf6688e3f6a8d028fe07de01d5fd8fc5d5ac8a577", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678417, "uuid": "451509e6-4f8a-49d0-a51d-b3499fd8ffd6", "comment": "Malware payload (OverlordRAT)", "value": "c779ca8d539832e84941e51c4e557a454680b984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783678417, "uuid": "b8f688b0-129f-48dc-aeca-c84f47b57131", "comment": "Malware payload (OverlordRAT)", "value": "85752ccc8ffd5fd6c9136a5aed095a4030d8d1f7b9babdbb8a9fb7b2b314b02282a8f35b81893395c5c0a081b353582e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OverlordRAT", "colour": "#A7EB4E", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678417, "uuid": "9e66a81f-3af1-41e5-8e25-cafd53f42c9e", "value": "T1D0B74B53F8E22A85D4EAC570C772817BBB613C19077823D70691F7206F3ABD0AAB6745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678417, "uuid": "ed0e6849-c45d-408b-ae76-c597557f7375", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678417, "uuid": "5c57ffc4-8c7e-495b-9043-4c26dd0d45d1", "value": "393216:wu2mri78R33vqe6cA2z1m21UYxYGLeo2GBwsg2duWbq6YioaUrRKBA9Nrm2XE:wu2nG3fFAP2GtquWbLEKBCNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783678417, "uuid": "4c3a6973-797d-4910-bf19-f59e6bf770b1", "value": 51343872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783678417, "uuid": "2d532593-cb0b-462a-871b-ccc8dfdd5a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783678417, "uuid": "22aaa54e-195b-4a18-a3c9-bdaae2dfdd4e", "value": "VMAX_spoof_cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a39fdcf-7ca9-11f1-ac3b-42010a9c0009", "comment": "Malware payload", "timestamp": 1783720330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783720330, "uuid": "050a905b-7438-4de0-aa3d-d31b66a3fcb7", "comment": "Malware payload", "value": "70590faba1ddaeb364cbc168363f6348", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783720330, "uuid": "57637f05-bcd8-41f8-914a-1adcc5f75c5d", "comment": "Malware payload", "value": "fd6de1ced67109859d1bf654a54819598cbbd7eca0bd380168e1360da13abec6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783720330, "uuid": "381ba552-f1ff-42f6-a384-5aa5249fb79d", "comment": "Malware payload", "value": "d7f5ef2e007d1d29b8a889e830af7ae8bd148925", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783720330, "uuid": "bb215499-998c-446b-8804-fe1e00dd263f", "comment": "Malware payload", "value": "7f3d484c5af29e287eecbda8e8ea25c4f7381c5ed1db43b9236a57ec1b8451ba03d1d615069ed18a409169a3d417a76c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783720330, "uuid": "525e38ac-145b-4e6f-8629-5d2e42b42134", "value": "T1B0E6330879D212FDE667423CEEF2A584D4A878A72371C9CF47D842E27E172D04D3D9A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783720330, "uuid": "bf859096-d60a-482f-87ab-d6f8313efe44", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783720330, "uuid": "c1288d3b-3486-4e39-8ae8-97b396fa94b8", "value": "393216:YB842xw6qZwu3ALqfIiPAXMCHWUjXccuI3/PGTAI:YsOvwLwYXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783720330, "uuid": "6742202f-eaf2-47bd-8163-013375a19249", "value": 14301945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783720330, "uuid": "f2f5db3e-e6ac-43df-9ace-bae6df48ff1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783720330, "uuid": "73de3738-73a6-40b6-8163-713da9cab4f8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c331fb-7c0e-11f1-ac3b-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783653730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653730, "uuid": "f3050e0d-d4d4-46d3-8bae-bd6024b1c090", "comment": "Malware payload (Prometei)", "value": "31736557521a8f943747472dafa86020", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653730, "uuid": "2df140f7-a311-4720-a14c-f366886f9d14", "comment": "Malware payload (Prometei)", "value": "ff2fb9db58c022b54bc0a49ec5b8c22c96bd6f8010ff28e8ef9988f68d298dbc", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653730, "uuid": "05e6b925-e705-4773-a6f2-a6482187430a", "comment": "Malware payload (Prometei)", "value": "0a8e31ca19a5fd304d9b9a298a9ca1adadf86793", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783653730, "uuid": "c84b06c4-8a5d-4a01-b51f-2891b94f2c8f", "comment": "Malware payload (Prometei)", "value": "738b96b4e008963a24af334550370679538a8ae82dbaca4d656f61916c4e5282d0bee50878c3ec232c439c3f893ae777", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653730, "uuid": "1b518477-4190-478a-bcf2-cdbc759f3775", "value": "T18A9131C6F8E491323302407DBDCAA0602797255B895BEC68B4AEEA113F1931C63E5F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653730, "uuid": "6d1a5adc-ecba-4c00-8ea2-28b0835d51bd", "value": "96:HL7lYLbH87wIbzrxBFIoenuMDJh34wpQKlzGnbMZhb8T:HVYfH8E+zXeohKlCnb+1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783653730, "uuid": "46648a29-fe6a-4056-b3df-366128caa793", "value": 4232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783653730, "uuid": "ab4f7d8f-5256-4d9d-ac45-2f870a2083d4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783653730, "uuid": "9cb4d132-f42d-45e4-9707-2196cdd44843", "value": "ff2fb9db58c022b54bc0a49ec5b8c22c96bd6f8010ff28e8ef9988f68d298dbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }