{ "Event": { "published": true, "date": "2026-03-23", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-23", "timestamp": 1774310582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "e7e0386a-b9af-4529-97da-8c3f35a6cf12", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa7299a-26eb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774292663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292663, "uuid": "26282787-5900-4527-8fed-b018886327ef", "comment": "Malware payload (Mirai)", "value": "829e2da561afa84107a54fce34fbaeaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292663, "uuid": "910be8a5-aa09-4d09-9d40-a196a46252a1", "comment": "Malware payload (Mirai)", "value": "0065529122fb65933e157abc41e4c35de623d7de93ee120ba2d7dda941962972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292663, "uuid": "3f363294-f1a8-44d4-b190-b56a993a490e", "comment": "Malware payload (Mirai)", "value": "44d3b0833a1a04a48d3c7eb2ccb55c99a8a8ec42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292663, "uuid": "92f05e74-a661-4403-a353-e7c47be287ff", "comment": "Malware payload (Mirai)", "value": "0b38dd733de68361e60a1bf003e2440b709d3e050ca98f1689d57f8472aecbc2ecd289d763e4ab3f8e990dce60780d58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292663, "uuid": "e82b5f8a-9420-4bdd-b823-472ac526347c", "value": "T18B737DC7F743E5F0E9220171413AE7239671D67D1025D74BD7B8AE76A832A04EA173AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292663, "uuid": "97f425cc-b804-460c-8167-b13e3e01a137", "value": "1536:siS3rCQt4KoA9fjdrDQ+dOwXW1dIggK8rLAKWedzuPF:s+lKf9Ld3QiO9dL8wAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774292663, "uuid": "eff1e5cb-ea0f-487f-aab7-058f06db0cc0", "value": 80104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774292663, "uuid": "94dfdb15-b426-46a9-9eac-32729c046084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292663, "uuid": "4196b9c6-4d04-41e2-bc8c-2852e06da673", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bea2f1b-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282840, "uuid": "4276f40f-f1de-40f7-8132-17bff8972c9a", "comment": "Malware payload (Mirai)", "value": "8f3731093dc2dedbfb02b94caed44d33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282840, "uuid": "1fece8f8-409c-4a9a-96c7-78d16bf93bcf", "comment": "Malware payload (Mirai)", "value": "00a3ab4f88b8ed9bb5f986dbbaa0d5944e063524d7098ed72338770ab2bde8eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282840, "uuid": "d14f832c-9ee4-49e0-8227-87c232b81bbf", "comment": "Malware payload (Mirai)", "value": "aa2336a4e2431ec9b0f0f4f00afe3e499182fdb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282840, "uuid": "b80a8e1c-3272-4bd0-845a-670e353c3f73", "comment": "Malware payload (Mirai)", "value": "41417ee632c999317e562ef70456d5b0d4ced4207aeb69f4e40cee39fc5863fd48e4c9f69a8dc87027850828959ce812", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282840, "uuid": "bdf79df7-6e26-4423-adb5-9e48740743ab", "value": "T18B66F76EF9519A61C0D4117AF61EC5D8335363B8C2DA3217DE06C2343BEFA8B0D3A695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282840, "uuid": "52e81837-cf7a-46eb-af4a-893662c6ca8f", "value": "98304:T4JMAFQqgfPw+NTOaTyjEQywcMylduNJ7Q43zon948Oy:aQzQ+N6wQywcTSNJ8K+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282840, "uuid": "7f3a460d-afff-4b11-8a47-387592c10bd6", "value": 6852160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282840, "uuid": "93cff791-f782-42e8-9a70-01492a5e1ce5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282840, "uuid": "10f4b17c-6acc-4a09-90b7-2415bde5d765", "value": "libdalvik_runtime.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3268e2-26da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285550, "uuid": "0e8e1108-19de-4150-8e60-2b5f32097ecb", "comment": "Malware payload", "value": "43bab8b755631ac2ac06a2db3cba811c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285550, "uuid": "92441a19-2534-45f2-8fd5-a310e4e5d29e", "comment": "Malware payload", "value": "00d4b8df81ffa027b3e3fb3d807988538080495aea20969278407ec7ae58c547", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285550, "uuid": "9f9683fd-fbea-4c5d-871f-bcd9cec311bd", "comment": "Malware payload", "value": "ce11c75054d4c277a983c65037c9e3b78196eeb2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285550, "uuid": "515a31fe-688a-4a28-901c-95a685d3e78c", "comment": "Malware payload", "value": "9be6982f76f01ae3c5dd554a742571e68a5c0650cd56d768e20cc82afc639cd6c2685cdbbeb69f699aac8ed538aee620", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285550, "uuid": "2f6416f6-1df0-4c8e-a55c-05a32e2d1be2", "value": "T1C686339FE8032F59C625D57F5A8E8A70395A437F8D82EF0724A2B057AFC0AC9B435447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285550, "uuid": "bfa4c0bc-2f77-45fa-9b4a-24606e20fae4", "value": "196608:OV0860m+XpX4vGXzv+Lh5yz6MJclGItC4J:V0m+Zql42J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285550, "uuid": "c8e5fd8e-dedd-4f1b-8a1e-5e3c383f9f76", "value": 7849219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285550, "uuid": "0297dc42-0f81-40af-ba58-6420087e0a56", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285550, "uuid": "e7933872-c7f8-459c-9209-3b8a186d408d", "value": "dhctservices.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40525314-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774249776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249776, "uuid": "a5da6f64-a5dd-4d92-98a7-30a5ce150ea9", "comment": "Malware payload (Vidar)", "value": "370abb711f49a8990fcfd40c04fa263d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249776, "uuid": "7b019845-afaf-4036-bddb-e2f9bda881e0", "comment": "Malware payload (Vidar)", "value": "016a248f179820d28be2af94b4965f8c5655bc28a2d64c736771002d1970687b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249776, "uuid": "31130f85-752e-434e-8359-d22250456456", "comment": "Malware payload (Vidar)", "value": "11721446d5a6d06d6a2683ad25ae83e6b8d94786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249776, "uuid": "7a256096-aabb-4890-8a51-e6b7c277afc7", "comment": "Malware payload (Vidar)", "value": "9892f5d77909ae637dc9d59810f13fce19eb49246887caa9b9a294ac9901bfffbb6087c21021cd640122173390b79b7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249776, "uuid": "a0f395bd-7f54-4d7d-87fd-599e03a627ac", "value": "T185A58D0BBCA545F6D06A9736CDB661927B74B8090F3233D32E91AA782F727D06D38744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249776, "uuid": "26e2eba6-5247-4692-945c-824a523accf0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249776, "uuid": "85ba5d03-c52c-4601-86e2-91ecb4ab73a6", "value": "49152:5Mt1Good2ti6rNg5rrX7zCxwMzGPyb3ZnQcp:50iCwXvCoK3dQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249776, "uuid": "aa21bf3e-5965-4617-bd0b-76ec05d390a9", "value": 2249424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249776, "uuid": "6619030c-c1a0-4ee6-b1c4-bf21ea585e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249776, "uuid": "f6a004fb-5c24-4021-83e8-c3383e152b3f", "value": "016a248f179820d28be2af94b4965f8c5655bc28a2d64c736771002d1970687b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db5e00-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282805, "uuid": "eb8d4591-dbf3-40d3-93e2-b24896145590", "comment": "Malware payload (Mirai)", "value": "97e4b5dde4bd2346224a5e513deee7c8", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282805, "uuid": "7702929d-7243-498b-89b2-71c661ea3db3", "comment": "Malware payload (Mirai)", "value": "024a427fc94e9bd34d96a447631dff75ae43a1421e174f6081aa5ad97f24fdde", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282805, "uuid": "3dc48139-9718-4f49-be19-231961604fb1", "comment": "Malware payload (Mirai)", "value": "5feb03cd790b108f4ee86f2f7bde2e547c0ca966", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282805, "uuid": "c9c37ab3-d781-49c1-ba05-2b85dd22e6db", "comment": "Malware payload (Mirai)", "value": "40e6f82e695409cd5a7cb13fc7a341f3a94ddadb4e0d2f00c326bc9dc6a10f443446b917347545f6f3a07ecff0de0b52", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282805, "uuid": "d847e64b-e3a4-446f-93cd-5117b7678318", "value": "T1ABB53338F16447AEA516957520FB12C2F25FB82FA881815D133F6893A00FF6DD69BF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282805, "uuid": "bd2bc3b3-7518-4fac-b0a0-d89df5b812f9", "value": "49152:Tdov8n3HXo8G2DVHywbSU6orfR6vQeBY/Id6TylWPUqvaamba5WYtFONA:p+WxG2DVDjrfT+YQAyIMqvaama8YtF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282805, "uuid": "77e07dc7-a64b-4fee-a921-75e5df412d29", "value": 2286384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282805, "uuid": "0b29f99e-630d-463f-ad16-5e63c96bfc03", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282805, "uuid": "7bbf92d6-e026-4133-a1e6-1f6f71a38adb", "value": "libdalvik_runtime.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1269944-26fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774299787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299787, "uuid": "c693b028-ca62-4303-8b23-7775871be023", "comment": "Malware payload (Mirai)", "value": "e788fac1a4504ba47a02223ba13e5427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299787, "uuid": "825bebf6-9f35-4364-94f7-1b3464c55845", "comment": "Malware payload (Mirai)", "value": "024ef2204d1a46c1f2946561fcd02ea5fcbd0c14ed724f1c6a3722e4b0ba3780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299787, "uuid": "e65f5a01-4c3d-49d1-ac2f-70b81ba8c39f", "comment": "Malware payload (Mirai)", "value": "2f1d3826a65dd5004d9a93457fe92cb34d34d99f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299787, "uuid": "bde52a17-e7ce-403d-8e2a-107b4b506a67", "comment": "Malware payload (Mirai)", "value": "2e5c7d69b1783151daab0a4b197ae0ee2e87033c31901f2eab1538b210cd2d0dcb7300398dd332f14ed5a6feb3fd9f6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299787, "uuid": "ad84def0-2ae1-44f8-a6d8-99a470872ed9", "value": "T147A339D7FC00DD7AF80AD336845B450AB231E7A10A8317B673136A1BED392E55927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299787, "uuid": "5603fa81-7cf9-47a6-859a-f24b136fb88c", "value": "3072:GpKtb5WBNjQAwH5CV+pFBHA9HwHkFyCa8wD:Gp+b52z65CVAF8HwkFyCqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774299787, "uuid": "2e531b4f-8a4a-4afe-bb38-5d000999c350", "value": 103696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774299787, "uuid": "4e8926c5-3fb3-43cb-8923-61c5e606357e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299787, "uuid": "9af19fb9-f795-4059-8947-0d694b476b83", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be199c99-2689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250846, "uuid": "f388f5ce-0c71-4838-973c-814e5818c895", "comment": "Malware payload", "value": "6bbad86913af193dd94cdf9ad18c092d", "object_relation": "md5", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250846, "uuid": "25e62ca0-fc64-4af8-84f9-de8b117fa02e", "comment": "Malware payload", "value": "0257d72ef185a6d18770b520cff3b203e42fd380aa809bb914a44a2821787b8e", "object_relation": "sha256", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250846, "uuid": "fbde8fee-79ee-42e5-8cae-edffe589b491", "comment": "Malware payload", "value": "c64b3f44013b73c630d1023d262155f9928eb9b0", "object_relation": "sha1", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250846, "uuid": "eedc8cb4-27ba-4adf-aec7-2a4d4c2804e0", "comment": "Malware payload", "value": "ab20674a432ca178e1e4010f0b5c06e0dc0b0f4dac8e3af0d37fdc98e091347e7be39a0abd5e929444aba11686aeeda1", "object_relation": "sha3-384", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250846, "uuid": "11ee74e0-4470-42cf-b013-5c2ae7ac3561", "value": "T196A633E0F1846FC1E121C83153F490A5EADE1CA6B0D3ECB678131B9E6593AF3A79E445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250846, "uuid": "adbd353c-93f3-4d8b-876e-88375788eb92", "value": "196608:w9bD5+uWL63x+mb2ZYYL+IPVmzOcLqnDXBLmWUYQrpyhGpDHC0dzBGSc96PZ8ms:WML63Mmb21ChOnn7FUNyhGprLz0wh8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250846, "uuid": "7c39ed24-62ef-4dc5-99b2-c330bad55c35", "value": 9551342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250846, "uuid": "69b56f80-3a4a-4fef-8f1a-b5aebc142d3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250846, "uuid": "6e9adf23-ce00-4b0d-a53c-5f416427e5cd", "value": "antic.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9bbce9-268a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250981, "uuid": "1e60f8a2-ad81-40f7-a34e-92e066fb8edc", "comment": "Malware payload (Vidar)", "value": "5b3a0c471759a1e33c27cbd825fbf14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250981, "uuid": "55df31f5-067b-4812-9f4a-28aed945e805", "comment": "Malware payload (Vidar)", "value": "0257f7a632a3f3e167eb208b7a9c582d849735263092d94fe3b12e9e673ab8ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250981, "uuid": "5ccb15c5-617e-4abc-924c-8050106bc7c8", "comment": "Malware payload (Vidar)", "value": "6023747988fcb579929057b1262dad4520b2d150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250981, "uuid": "5fa56e9e-7025-40e2-b27b-992251779e8a", "comment": "Malware payload (Vidar)", "value": "b24fd82555ac5df3676bf298f1c885dcba6a27ece1f87528c86e25ea9bb781fd51f18f9653541876ff96edeed2c74dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250981, "uuid": "a60107d2-7a0f-4e62-bc91-b3da91cf4256", "value": "T1A6957D0B6D9644F6C49A9735C9B25256BB74B8080B3233D72FA0BA783F767E06D39704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250981, "uuid": "7b311f70-139d-4258-a645-92d4eb6194ee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250981, "uuid": "9aacc616-b432-4e20-8a4f-69a803b66cca", "value": "24576:YwnyIz29VdwRyT4rrNniW3Zjd/K7WSK6HFhele5n92XbCa:YwyU2yRyT8rNnkBCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250981, "uuid": "e4c85f8e-54e5-490c-b7c3-5b8bf0198f0f", "value": 2038448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250981, "uuid": "935212c3-03ca-434c-8dc9-ec2da2802bbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250981, "uuid": "54ad4cb0-3e1c-4d69-bfec-6147fdcffc72", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bceb110-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277740, "uuid": "043456ac-a885-4ed0-9311-835c56548903", "comment": "Malware payload", "value": "4cb321c61ba994666546f37c300dae53", "object_relation": "md5", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277740, "uuid": "61ee1ae8-4642-4957-a3ae-be60bc0b6731", "comment": "Malware payload", "value": "03173d820667658875dcac436be860f04e9f6b476300a8721e015d63b11febd8", "object_relation": "sha256", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277740, "uuid": "309a9927-fab8-44df-aa51-ecfd66effa63", "comment": "Malware payload", "value": "46377767a676bc177530146789f34caf62476c20", "object_relation": "sha1", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277740, "uuid": "7ce84309-ca3a-473c-8efd-f170047ca226", "comment": "Malware payload", "value": "7175c6af1dcc11ba713e08076824f9f08e5913117668f673a339a99a8e4de35e5e21b822f52be485a222af0c7354046f", "object_relation": "sha3-384", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277740, "uuid": "015b3352-86cc-4948-873a-2e32e83666f7", "value": "T15E047D2D8F2BE0D0433EF490C2D99D6773504A56CB7C8B98FF21AFA61D14665E79A20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277740, "uuid": "07e81c4e-224c-4ac4-9daf-8b6a6dba9f8c", "value": "768:s7mxa96MH7rOokUORcpFoa4bOYOd7O36nHcZljXRnSr9nMMzyBQbU5ovOr4kqUXc:q1bNkSoa4mjnHolTRSrjb/XlnB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277740, "uuid": "ee1d6fbd-a55d-4acb-8d0d-2974a1dd123f", "value": 183069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277740, "uuid": "74301c54-bf57-4156-a106-da7b1bebbb51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277740, "uuid": "7e16128f-752a-4770-a9e4-695242e6a0b8", "value": "03173d820667658875dcac436be860f04e9f6b476300a8721e015d63b11febd8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6af46f0-26c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277006, "uuid": "bb3c89e1-71ac-48e3-82a0-ed0696c08808", "comment": "Malware payload", "value": "2d5f69e692f974d21d95f913a9c4995b", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277006, "uuid": "fb10d809-4b2f-4bed-b153-cd28c16af090", "comment": "Malware payload", "value": "0322551804c94b4d1cb5e6439b3519a8756d3bd97fd4a6d5a6ea935bca411c07", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277006, "uuid": "891271e5-29ed-4755-befe-b5e6d9697460", "comment": "Malware payload", "value": "87b4653690450ee4871c06446dd22587948d4e9d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277006, "uuid": "aae546f8-f73e-4c09-a136-d3a2fabb1717", "comment": "Malware payload", "value": "a74eeb4864b1d40cb9ec57d2a5b74a1c65324a8eeacfa536598601f90960391d78b8ef06c84bd6fadffedd75200e6661", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277006, "uuid": "fae1314c-1912-4c5a-9fe5-331bf66d2816", "value": "T13086339FE8032F59C625D56E568EC9703D5642BF8D82EF1728B2B097AFC06C9B035847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277006, "uuid": "0c4cce71-9973-421e-881d-820ca18e6479", "value": "196608:qo6PLR5yla3lsDGI3du/zPMMzCaTFh4qE:B+R5i3UXgqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277006, "uuid": "402e0e7f-cf17-4d4e-8c14-f372ded3cefa", "value": 7851735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277006, "uuid": "48cb3a74-d0c2-4017-9316-69cae54e4a41", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277006, "uuid": "191a9050-aee0-4a30-850e-06d52da6d3d5", "value": "4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e245db-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774257414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257414, "uuid": "e8b9ab68-c55c-412b-8e40-ad75962bea39", "comment": "Malware payload (Vidar)", "value": "18e84a97c4d97ea939b293db3ff71c66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257414, "uuid": "ca47c0d2-0a67-4e85-a1ae-f9685e88c415", "comment": "Malware payload (Vidar)", "value": "03b8faa3c4ecb72007dc76de1bcdcfb43c0ef8d5a2c6ccf1ed16cbea60abc445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257414, "uuid": "15b4eecc-6b81-40eb-ba4d-f06ae7462448", "comment": "Malware payload (Vidar)", "value": "ff10a907bed83abb53d7c5e9a92c438c15b21670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257414, "uuid": "e89b0e2e-9419-44eb-8be6-cec2d3b1a6d2", "comment": "Malware payload (Vidar)", "value": "b6d5fbe7ce5cddfff9eba74ffbd3a668622abbe1d5e9eef0305c6603b052181895cbe384a0d522e6910123acf50895dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257414, "uuid": "0df09997-dd6c-4d10-8a5a-5abfdc71b43d", "value": "T1D466182B3763D5AAD519B13AC0A38B3EE4F3707C373285DB12825B199E499C84F79163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257414, "uuid": "f54c68b0-2412-419e-a316-68d8e2ffd13e", "value": "98eaf7b60465e0041ebf75ff2f585089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257414, "uuid": "e48811cd-95ec-45b7-bbf3-394a37229262", "value": "49152:Sjh2/bYALtCrY1AsvGzkk02neSAlnevxNz3jFPwqn9SV1KBitnTL:SQ503jFR9SWBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257414, "uuid": "20ad557d-447a-4af5-a79e-038dfb28fa59", "value": 6972416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257414, "uuid": "3d4cb9ae-880f-4e76-b06d-2820a5bf5bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257414, "uuid": "442c6e75-d3ca-4b4b-aabb-419a11e279fa", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6230a9-2669-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774237178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237178, "uuid": "ecac2aa9-8c8e-470e-983d-133f0f184e6f", "comment": "Malware payload", "value": "42f2643fdb125a4ebf38fe7999dd882e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237178, "uuid": "79a4eb81-521c-4704-97c9-af573ffb2a77", "comment": "Malware payload", "value": "053fa1dce43437c1f0f9deba4dadcfc02eb1f533f9a1af4f28b05e4dc16e4860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237178, "uuid": "5fadcf88-d608-4ef7-88a5-ea747b3a4db9", "comment": "Malware payload", "value": "99165edd199ea201d90ed636b778ca77cd7714cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237178, "uuid": "184521aa-272a-4f45-a56b-ab10dc3d81ce", "comment": "Malware payload", "value": "164a7b1754da3ff81cc7fd97dc7ea50667d03c4ac07e94cae422a907c350b8c4ed48b248c7d3866fa66b6831490741bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Penguish", "colour": "#23BE5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237178, "uuid": "062a0a96-3d39-459e-9a7e-a98badf82d40", "value": "T12D157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237178, "uuid": "bf00ba1d-ed88-4ecf-a580-5fa9ffec7c71", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237178, "uuid": "ac23bdf0-5b74-4410-b3d8-c4c5a5da6a8c", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6DG:d/QMnl5YL7WzZyQRdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237178, "uuid": "1d77dc77-e20b-43f6-8d45-29c6391ccfe2", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237178, "uuid": "09f55f2d-2b19-4605-aa8e-4836e524b8c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237178, "uuid": "1aa8ace4-f31b-4286-99b8-edc05390ba2d", "value": "Y783284404.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09323481-266a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774237228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237228, "uuid": "91a4e47a-1f1f-4acb-af86-0e546d593a14", "comment": "Malware payload", "value": "5291a14080dc1ab1105dc0a63b7c1223", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237228, "uuid": "94d6a4c9-c7e9-4e4e-89eb-2de8d103bda0", "comment": "Malware payload", "value": "068296e29838df5a98b9e50fcc999d81d3265bd27d4062463241355b84d7799d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237228, "uuid": "c0a95ec1-0b4b-4cee-a7ce-6c66dfc736ba", "comment": "Malware payload", "value": "c07a70a174e651980a9ad1ed8a485b937edcdd05", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237228, "uuid": "44482398-3598-4645-808a-71efaf1623f8", "comment": "Malware payload", "value": "872a1841f5b362d77935d19afc3b90f8620134b1b9573f415200544a425a3998b6bb516eccd769380301452830c1250e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237228, "uuid": "bab09b79-0ed1-4513-b734-b49e9ea2f8f8", "value": "T136925CA916496C79BBC0DE7D9F3C7F0CADE8C1C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237228, "uuid": "0ba01296-5481-4d84-b594-413da403e527", "value": "384:HK0M3vgRjGlsaq7pzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Hgmjf1zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237228, "uuid": "2f629cff-85ec-4b81-8046-58fe94d89f53", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237228, "uuid": "023d8127-91e3-407c-99f9-3b52dfbf2071", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237228, "uuid": "9717d1da-8b41-412c-900b-8c5eba415acb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29cc4eed-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282810, "uuid": "02ff88d1-a6df-4c23-be30-0883fb493999", "comment": "Malware payload (Mirai)", "value": "b45753868df67ca0efe1eebfd67e2747", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282810, "uuid": "5550b58e-4d0a-4f63-a14e-602b4b137936", "comment": "Malware payload (Mirai)", "value": "0728f54024e61004a110382d60a6df2f36906cef88c4d7cb653c5ccf1c476939", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282810, "uuid": "af4c8423-6e61-4a0c-b03d-4c3a75c42fb5", "comment": "Malware payload (Mirai)", "value": "ac8811df6d59b1a262db7a61d193d6078357c34d", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282810, "uuid": "c7e83ba3-cede-4235-8772-c9fa88dceed2", "comment": "Malware payload (Mirai)", "value": "1d9406f0f8c84e2713290a4ac1e814d5ecd5862e4d6861ed24229c332f04523e56e4488826d43db5f16dadecb1d5580a", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282810, "uuid": "bb666abc-b466-4162-88f9-c685b842134c", "value": "T18BC44A59A8419B95D1D02BBBFF1D934873131B38E3EFB1069D196B246BABC1B0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282810, "uuid": "1c469556-5ff5-4ee0-8ab0-9733200bb67d", "value": "12288:dPtlEMgXdP9ohQ2HCFNggEAKLRTkFtVlhf/SqZ8Vzenalt9J2MUtY7URWN:dkdP972HCgkFt8qxQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282810, "uuid": "9c046845-8d06-40c2-bacc-874f024498b6", "value": 574168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282810, "uuid": "928c73f6-ff77-42bb-8f77-c046ada73623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282810, "uuid": "5d1b7d2a-00ad-403a-bdff-e9c11f537381", "value": "5_187_35_166_3923_march9_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b644736-2710-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774308609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308609, "uuid": "f26e13a4-0b12-4bcd-b4f2-7a1f5f3e9a90", "comment": "Malware payload", "value": "b41dd110adf838352431ab451fc7c416", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308609, "uuid": "0ff8f502-5a2e-4822-94b8-418250002792", "comment": "Malware payload", "value": "07b1b7a1b39dc241cdb9d2253db5b92443710696bab2448e6c99b2704d3099bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308609, "uuid": "43f753f6-6ea4-435b-9e11-1577fca3877e", "comment": "Malware payload", "value": "9e5875f87d4ca991e522c64d9d812844f1c0de1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308609, "uuid": "6f2caa28-7f50-4ba0-9fa6-dfb0fc298e49", "comment": "Malware payload", "value": "060c7f49b994502bee7d6b4daa4d0ad6ad4a6e7f21c7de121504e0a9200ce5cded2e92d82f1728666691e8b79c73c2e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308609, "uuid": "59874c62-d212-427b-8c26-cf8e67c8515c", "value": "T174B2099EF363B4E8C76AF070D0DA0BB6E464FE2206759B3A5340C6392E21646DF2D146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308609, "uuid": "987fd81c-4541-42ee-aaa5-009f1f8e2400", "value": "2fd5fa517f8ce943b782c5d3b48b8ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308609, "uuid": "3af05973-ce6a-4626-9b17-414737269667", "value": "768:8Ozyt4Fxd1Hyjh+0xWQMElq2naiar1qCW:St4FjxyNTVMBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774308609, "uuid": "5791a2c4-a8f1-4b11-a491-6985c70477a4", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774308609, "uuid": "1a1cbd83-bfe4-42f2-a81e-3165430b394a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308609, "uuid": "3e173d2f-cdb8-45b7-a6ef-932cc989aec0", "value": "Application_Form_XnLIYrEh.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bea1a8-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240039, "uuid": "b2432ad2-5f8f-4759-9eed-e70659f62200", "comment": "Malware payload (Chisel)", "value": "e7fd280702f09b4a03a6bd33e1dea01f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240039, "uuid": "baa35c32-3e17-405c-868e-00fd6e83f917", "comment": "Malware payload (Chisel)", "value": "07bc47fd46270282e3f3a0a0a98dff685dd9b1599fc69664b9f179924d7803c8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240039, "uuid": "4cc8e9e6-3659-4fa8-b7bd-0e0569826744", "comment": "Malware payload (Chisel)", "value": "4fae42bf37f7586619dad96debcad5b376a6e847", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240039, "uuid": "283c02bb-643e-4fcc-b4a6-f3c8d47b87f1", "comment": "Malware payload (Chisel)", "value": "9bab4d2e53621b26dc27c12f45d74bacef48a2f3fb8b50e4dc93fc1585dc47d051adfeac13cf8a8e944d26ca57677da0", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240039, "uuid": "f3c0670d-7d71-4e59-b3a2-463a67a33dae", "value": "T16FA65B85BC1D74E2CAC9B5302F3252A5733AA8544F82C7275618BB3DFDF27548F622A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240039, "uuid": "5e05ee0d-c686-47a4-883a-b3bbfad29ea5", "value": "3de4accde96db241dde5859ae8f94797", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240039, "uuid": "7d53eeb2-e0d3-4c84-91e6-40b5ad58813d", "value": "98304:yCIAXlylbOQIJ/eTRuDHl51q1yidhAMd92ovE:yChlyNtINeTYF5QyKhJdts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240039, "uuid": "48992db0-cd1a-4ee6-b535-407ccb92d643", "value": 9993728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240039, "uuid": "8ac7d01c-65d0-466c-973c-6ff199349b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240039, "uuid": "b9e26015-97e0-4fdd-b892-d4b648ce047e", "value": "chisel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f68d9a1-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250714, "uuid": "80d715eb-d879-462c-affa-5bef3670f260", "comment": "Malware payload (Vidar)", "value": "3c608d9d0a75c8d183ea5d1ecf83465f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250714, "uuid": "6c60cf96-89fb-4de8-9cc8-f4c330afadc4", "comment": "Malware payload (Vidar)", "value": "084eaddda428c205d0f3b4aedd36ee8fb158d31bcc664c90047f28dbf97a7a69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250714, "uuid": "7a2d53f4-3f4f-4b24-b722-b56d778b3a0a", "comment": "Malware payload (Vidar)", "value": "deba1c6e72cc8b49d8ef45f87a9b9250dbb51f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250714, "uuid": "a57c2fd0-2195-4d7b-be98-0d5f883630fc", "comment": "Malware payload (Vidar)", "value": "0d002cca4bf9ab282a4507a5f389ac6ee630ad0e9cdb67d19b34883346a065f9fa7a2c4c3c6219bd3ab089d4613f1b0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250714, "uuid": "edc53498-3a37-4b6c-a954-7be39edf84b3", "value": "T127A57C0BACE508F9D0AA93368DB66192BB70B8490F3223D76E90B6783F727D05D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250714, "uuid": "14efe79a-4e25-42a5-93ca-7a48c38829ef", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250714, "uuid": "9772b42c-8c07-46f1-86d9-11c88dbeed46", "value": "24576:B9pIvMtzwU0WfM6bpNaX2hPDDZrrziYNS8GTUJzneDnc2sFhele5n923bmgn:BnwSzAWfVNNaXIPBrrziWS3AJztcxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250714, "uuid": "272bf76f-55a5-4fb5-9c2d-7cca953d0636", "value": 2223824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250714, "uuid": "de662c3b-ca1b-4fea-8ef7-670d8767a39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250714, "uuid": "61c6ce36-7708-4f6d-9943-da9554a227b2", "value": "084eaddda428c205d0f3b4aedd36ee8fb158d31bcc664c90047f28dbf97a7a69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a4f3369-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1774257980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "0bb4efab-5cc4-491e-8915-7974a0bb8b46", "comment": "Malware payload (CountLoader)", "value": "da52d2688a0a77647f10f9658695aff3", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "bf961e29-80fd-4e08-ae7f-527a8cc6e0c8", "comment": "Malware payload (CountLoader)", "value": "0900664eaac2d0229b2f3e974f556c780b098756e300011e6aa52f83ff1d9b4a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "b16c9eb5-c1c8-45ec-aa62-ef4100824799", "comment": "Malware payload (CountLoader)", "value": "bace394337d66046f54f4f633919498f75eae0b1", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "fdb40d7f-b855-4dca-a368-05aebfb7285f", "comment": "Malware payload (CountLoader)", "value": "e6344e4b509fd884affb018c0c6939b38ddd6399da944048f9c6677f6e152c641b4e9b73dd6b19641866d7aa0747990a", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "e65ebb9e-ed62-4bfe-94c7-c7e5c0d65be7", "value": "T165B3F3889A8A95749B1F7024871F9C47999D9527031DCDC0FACDBF893F11AA231BF9D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "40f74c4b-6632-4cee-b5e6-92ed40fb6674", "value": "1536:bJ3rpan8+o+sWxV+2NWoisfh1RRrlEVc3RP7lQ:PsxVJ1RRsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257980, "uuid": "1a8220b5-74d0-4d3b-ad3d-ee774e0af799", "value": 116243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257980, "uuid": "b974c1b0-8b55-447f-84ee-dd2cba7bd113", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "f4376a0c-157f-4267-893d-2484c7c2883c", "value": "Global_Neon_Report_541.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cf02d9-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242323, "uuid": "4b957d50-89ea-4100-b83a-fea01cad9860", "comment": "Malware payload (Mirai)", "value": "44c3f9e856f367026f652d55b1e93a5f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242323, "uuid": "e92a2391-afb9-4594-976f-78032beb86cf", "comment": "Malware payload (Mirai)", "value": "09094d44d1ece2ff03cb98dfd22ec4fab80c83d344caeb20fccdee8108089c9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242323, "uuid": "08155878-9b3f-4729-ac03-cc8e3890c43a", "comment": "Malware payload (Mirai)", "value": "3fd617c2839adb8308d9beb9a3aa4b61b64c9849", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242323, "uuid": "e0d0954c-8c47-4174-a934-4e664e1aad73", "comment": "Malware payload (Mirai)", "value": "0e9b62a07753bb9ea783c68e0ab0b51962fc3d3287d7b767f1fcc92bfc3a993ba0ee2a7989a3035472dc068d288380af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242323, "uuid": "a5f59f4f-4da3-4077-aab2-55d7d0d88a0f", "value": "T1FA23F1A3876FE0F8C95938B60874B2D4DAAF6511B356021B1B6293FCFC20D664F51F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242323, "uuid": "7f4186b3-000c-47d7-abba-f5cc892208f3", "value": "768:IcBq+lJIhPNuTnJZAgB9xBvO16XuHTm4Se4ZRY7OLWhltsq1S/VhA4o:toGIhPqAC9bW6uSBDt6hltqVh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242323, "uuid": "75dc718b-cfa7-42b2-b0df-cd0d0631acca", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242323, "uuid": "faae80f2-d2b0-4121-9e2d-50f3143b33f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242323, "uuid": "79ff9326-6e6c-494c-975c-51151e3508a4", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16f1e46-26f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774297613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297613, "uuid": "38218c79-41e5-4a00-986c-5c6325615713", "comment": "Malware payload (Mirai)", "value": "c4fc319da8ae8f7930a0627f5573bc2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297613, "uuid": "101acfeb-8f22-4461-b4e5-53d8b05c7723", "comment": "Malware payload (Mirai)", "value": "09f2377db44da366ff372ddea275560b28c5d35acc0648122c7c91e36c2926b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297613, "uuid": "a21b5c7c-13ea-4598-85ab-22dcc6784e27", "comment": "Malware payload (Mirai)", "value": "3314a5ade9f5d73983f2db72441a2c65780a523e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297613, "uuid": "42b1c7c6-cc48-488a-be31-d4049ae95498", "comment": "Malware payload (Mirai)", "value": "fc22f9d767d09a5eb86f289aa2bf457e86bba0527e38a80c7ac3444378e00c758f983da5b3ef5dee9c07c20bf382369f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297613, "uuid": "fab6ba1d-42d5-4835-bc96-26fa641815f4", "value": "T1BE83D516BBA10FF7DC6BCD3706A90B0535CC951B22A53B367974C928B64B50B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297613, "uuid": "e443bc5a-1057-4965-ad34-1d835a9a4173", "value": "1536:eQgyKYat7eTZvTnxyHVhoTcOhuikIS+2ZcfqZuhUR:ePYaty10KcOhui/2OA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297613, "uuid": "a0e972e9-07ff-440a-877f-f4ba23aa6af8", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297613, "uuid": "14e96c28-81ca-4718-afbf-55ce1a89075b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297613, "uuid": "d5fbaff2-f27f-4f93-83cf-b1c4c318812c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e18d038-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237263, "uuid": "435431f9-4c44-4b87-a430-944d436bf0f3", "comment": "Malware payload (Chisel)", "value": "32df5bf4e246136ca81fe1c68f5815d5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237263, "uuid": "f55570db-ffdc-46c1-8789-6f9b7a5228d0", "comment": "Malware payload (Chisel)", "value": "0a5f7907bfab993c574c9fc6b5955aaf7084154e17f5c57475005a1f09def747", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237263, "uuid": "fad12bae-cf2e-4ab8-b235-098dcfb0e1c1", "comment": "Malware payload (Chisel)", "value": "4cf220597333e6f9a68161b67c32e02bca1f0d74", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237263, "uuid": "b8180e83-2478-4bfa-894c-4787954cea87", "comment": "Malware payload (Chisel)", "value": "4f37f7607c644a87c8d05aa83f3cafdacec21214369750950e0572f433898355703ce3af0f69dd868704c8c69fa33d32", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237263, "uuid": "a8d8d6a0-e559-41f9-9ae9-93f41c8ea9c7", "value": "T10F16337052569B1C5BD8ADF213A86ED0BEF2E0571C044A4793AA4E79E8C3DC687704FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237263, "uuid": "ee13cd4c-17e4-4791-8d9d-5881ff1c8ce2", "value": "98304:IETpNy2rIgmBf53c8igk52hF3RuEryfYTGKVl68SExqEzg:IE9Y2cPU8yUH3RZAlsa2zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237263, "uuid": "fdea9005-5811-4eb6-b6b1-aff565e64f05", "value": 4230119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237263, "uuid": "affb9128-a311-4b8e-98ad-2e5f6a4b06e7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237263, "uuid": "87f69f3c-5999-40d3-bfb1-251374659253", "value": "chisel_1.11.5_linux_armv7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6be73c7-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242324, "uuid": "f2304b3a-85be-44bb-9473-0147f4a67443", "comment": "Malware payload (Mirai)", "value": "c972cab7ad5d1589d7875cabafd726d5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242324, "uuid": "38e28328-c41a-44cc-824a-09fc1adba03b", "comment": "Malware payload (Mirai)", "value": "0aaaeed255d6c651753307165132b2225cb0b9654701425c80cfef9d65ecfb64", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242324, "uuid": "32594723-367d-4389-9c38-91be8d55ad97", "comment": "Malware payload (Mirai)", "value": "68d8c3ddb340c9b6e41abc59aa830e4deebb953c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242324, "uuid": "765f2c04-5f40-4d94-baa8-e029747314b0", "comment": "Malware payload (Mirai)", "value": "3d9a8ad6db990d84a5b94a2c59e5e3cbb18d447e0a37d8b8b30fc247b31122c5430ff7a1ba8602c02132bbeb666322a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242324, "uuid": "d83d191b-6b47-456f-b31b-696766424de4", "value": "T14F333C4DF783E0F0DD4B0531115BF77E96349E025124DE7EEB98BE66AE32A02711B628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242324, "uuid": "fe818c01-3af3-4643-862e-0091da705730", "value": "768:lwzbCo1eCZWUJ2SSpRflrFWwqTlFNB5azjYvzNeVMU2331ANA0B7RhuqDV982N+s:lwdt3SpOzwLMU431ANA0BLBCKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242324, "uuid": "8e69ce6d-4af9-4bf0-b061-b48ea62f6910", "value": 50476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242324, "uuid": "d11bcde3-9085-4d16-9a98-2eca1c75b2d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242324, "uuid": "f5e9b4e8-0df6-4c0a-a28b-f98acb72a88d", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b42e78d-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774249714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249714, "uuid": "2db09d09-db36-41fd-b746-1bc5aa996748", "comment": "Malware payload (XWorm)", "value": "29bc6b886b8b307f655cf2129be0ec01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249714, "uuid": "6bac08e9-2aaa-4314-9021-e96330d1a88c", "comment": "Malware payload (XWorm)", "value": "0aaff85b11f5cc5930d012c17075f74dec16e9ad19b9fa729254d5e60961810a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249714, "uuid": "cb35bb81-aeae-46d1-ae81-2f6013cbcbe7", "comment": "Malware payload (XWorm)", "value": "788e2d094284f2055636c5666fae81e83216f53b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249714, "uuid": "b0f9baaf-b668-44b6-bdad-32d3b3ba94b0", "comment": "Malware payload (XWorm)", "value": "0887a385c55630ce179773feeec2f9d5d8993b90f91f460460b81808af32888e6836efcaa7ca42cc4cca3c61646d634a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249714, "uuid": "862fb0c0-abc8-43cf-bab0-d7ce3a174ac3", "value": "T1F6F49D9ADA9424F8E4779B7A89734C02E737BC5A1B70E68F1B94B4611F332D0593A703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249714, "uuid": "85bd8ada-38b5-4b72-a945-1909fc2344ee", "value": "e715424ebef62edcf8229c713419932e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249714, "uuid": "92d6d86b-cede-460a-adef-56ef005f2212", "value": "6144:3TZ9HLKOtNQH7R38d1KeEbLuyWUJlgaNg/bAQ13lDNLWTvo6+3Jk2wmvLRtT:zeOXaRsdIeEHuRcgaNgf3FNSTvo6MZtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249714, "uuid": "27f4c9f7-8045-4eda-86f7-b2d808c9a626", "value": 776252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249714, "uuid": "ec07ab9b-8c2f-4bfa-864c-ad4749e42a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249714, "uuid": "d5e5f60a-a7f1-4481-93ae-73854c5f6104", "value": "screenshot1_915162331.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e04e3b-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774250024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250024, "uuid": "31366a0f-32d1-42a0-a830-760a5b3b7659", "comment": "Malware payload (CoinMiner)", "value": "c53b34e2ee40db7faa65a6835b1d8c07", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250024, "uuid": "81cecd0b-f260-4253-a55a-8a63184fae35", "comment": "Malware payload (CoinMiner)", "value": "0b2b7c967c4c573b877f6cdc49f787716f5b4d22aa633fc70d069913711c5bef", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250024, "uuid": "005920f5-b280-45b9-9fab-06f4174b63dd", "comment": "Malware payload (CoinMiner)", "value": "618c07452b09cbfdd6bc335972fd9bc2ef86086a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250024, "uuid": "3cf6c885-f8f2-42db-bccf-1d3676993fb8", "comment": "Malware payload (CoinMiner)", "value": "915bab27a0053eafb02c644134544eceecc09716146f22014e8cb64f40ee040e7b4c340668bce4c8f4502c9da01ca21c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250024, "uuid": "be54780b-2138-487e-8e3a-3a370256e08d", "value": "T141A66B07EC9249E5C1EDE5308A669252BF71BC495B3123D32B90F7282F73BD06AB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250024, "uuid": "bfd7eaa7-a464-490d-bcdf-629be3f9c5d3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250024, "uuid": "ebd29432-66df-45aa-9d1d-478ecf9747f0", "value": "98304:dTJ8p/kguqqZmUtWqTddkgywfsSGKn4k/fE:dTWMgNqZ9jkgywfsSGpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250024, "uuid": "76c086c0-324b-41ce-a887-5206270c1ffc", "value": 9774080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250024, "uuid": "634843cd-b576-465c-9023-98588587cdbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250024, "uuid": "ae22080d-e092-4234-a1b5-c6d8684ad01d", "value": "c53b34e2ee40db7faa65a6835b1d8c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b7eeff-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774300946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300946, "uuid": "130db044-522a-41f5-9509-07ebe03cff5a", "comment": "Malware payload (SpyNote)", "value": "7abe7e8dfb891a0b8b849687843bda0c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300946, "uuid": "c9d6f302-1684-4a98-9a20-51dae08b996a", "comment": "Malware payload (SpyNote)", "value": "0bd64f2bfd3b3d5427adfeb8bb72d2522d9758c80995bcf09a60c8631e0f1d34", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300946, "uuid": "ed173b52-734e-4c95-b274-caf6de9316d7", "comment": "Malware payload (SpyNote)", "value": "43a26eba128d8d771650aa3624b49de17eecf31b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300946, "uuid": "5d1b198b-f737-4ce7-8092-f6c89c3f0104", "comment": "Malware payload (SpyNote)", "value": "3a13b525be67dc1ce583bcc85147be64ba63c9b520c559139ae50c25ef62d5dcf0222e201cd1a20962ffc0d35c365c7a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300946, "uuid": "7a5c042d-da12-49a8-8909-69bad59134a3", "value": "T137057D86FB4AF863C9F3C6368675C6AAD6064C544B43E7471985723C1DBBAC08B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300946, "uuid": "ab947f4a-e928-49ef-bc98-40a34a365870", "value": "12288:54Uj3Oa1a8LzeMSFJP/wgYS5WmpYshXZPbGwidNpgao:54UjOa1amejj/tYS5WmD9idNp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300946, "uuid": "7968abf0-96cb-4664-8373-308a3859c543", "value": 811401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300946, "uuid": "b76109cd-8545-4da8-ad6e-0e770d4f6b85", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300946, "uuid": "df8cada9-9e32-4cfe-b239-8eb442808620", "value": "delta BETA.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac662d2-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774257551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257551, "uuid": "09b3c0b2-7462-466b-85a0-755525c65acc", "comment": "Malware payload (WallStealer)", "value": "ab24b3bc75edeabf6fe4d1577d8a738a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257551, "uuid": "6e404369-6355-4191-b943-c96efb4281eb", "comment": "Malware payload (WallStealer)", "value": "0d0e9f9ea4d708f83d70d4bd7c2dcb496a0b3e0a427df75841847f1d8f976e41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257551, "uuid": "e9afe98d-e0c3-4596-9588-f586f06b185a", "comment": "Malware payload (WallStealer)", "value": "12290435957fc2c76a33144703098c5027353071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257551, "uuid": "818ad9bd-b9d6-4dd5-bf64-5b659f377e35", "comment": "Malware payload (WallStealer)", "value": "8a7118fa08a6458d7f7767972ab70ebd493fb74f96153474c38679da89b85d7a3e3cff868b0cfdfd3decb7b0bc37c656", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257551, "uuid": "cc9c4cdf-cfa8-41de-ae2c-c68359aba396", "value": "T13796638FA2748613C8E263B5B20635727E2AD435479983B77CEDE435319F0BE4A728D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257551, "uuid": "920139c5-222f-473d-bdbe-451e9cf4d4c7", "value": "3fc31f00ce7bec32061d57602f099359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257551, "uuid": "2325cf0c-a7b0-45db-b183-bb0c79366a9b", "value": "49152:lqubja4oMJNHEoYA9buMY2z2sDtByoFm5PqosyoKi9YObh3plrR/wSFbPn0SJM62:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257551, "uuid": "96226d41-efcc-4330-b35d-68e12dbf8699", "value": 9435648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257551, "uuid": "cd59e3fb-d86e-4b8f-b4d9-e1de56f1b9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257551, "uuid": "793f3e52-6bbc-4f8e-a87e-c40da1d1cc33", "value": "0d0e9f9ea4d708f83d70d4bd7c2dcb496a0b3e0a427df75841847f1d8f976e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82543ce-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252152, "uuid": "339ee366-0dcd-48be-a781-995f8e6db2e4", "comment": "Malware payload", "value": "bb21b2450418848b4f8b1c2b1b6b0271", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252152, "uuid": "3fd953fc-934f-4ff6-92a5-fcabb2f05d3e", "comment": "Malware payload", "value": "0d178cf3401737b4f372f548657834900399293a018f2991a4a323a4013d2248", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252152, "uuid": "38d577dd-98b0-47bd-9d90-5de1e36748c9", "comment": "Malware payload", "value": "b3eb51f4403b2fbcc950a8d5f716b5d13fadfd4f", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252152, "uuid": "c2f93788-6914-4453-8943-3bee3f2597f0", "comment": "Malware payload", "value": "79a147af9e173e350a0cc9ad33e12b374eac20913ca850a2ad8c67fc3acba98d172a5f7affe457784232cb2beeb85ce1", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252152, "uuid": "5d40b958-f439-4d5e-aea3-1f5a42ddeba5", "value": "T172735B07B5C19472E9761A325874C9B18A3FFD211F61EDAB7789063E0F301C19E35EAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252152, "uuid": "88519dd3-a2a4-4f0c-a9de-2df46bba65d6", "value": "17b0423a800ab1c3cf952ce873bdb846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252152, "uuid": "77729dd3-ea8f-4b08-a52b-94fcdd157937", "value": "1536:oucCpKvx+RFnV2KnsN6TXa+RDZXG8M+dSjF6w1HPGSANiaTsWwsOcd5u0D:BcCpK0RFnNs8TXar8M+dSjF6w1HailsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252152, "uuid": "6471de76-8936-4854-9a82-f099f6db8457", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252152, "uuid": "d028d22b-c98a-408f-b681-de2b6172698f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252152, "uuid": "6c579852-85b6-4775-acec-373461548981", "value": "load.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ee151b-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237248, "uuid": "f62ca8cd-db39-45db-9c38-ea1e4fcdc75e", "comment": "Malware payload (Chisel)", "value": "c47df3eb9281f60b0eda64f1e09a8c15", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237248, "uuid": "6d772377-6e91-445d-957d-3b8604c0c856", "comment": "Malware payload (Chisel)", "value": "0d495798c88eb7d76913fedafbbb412f42308ae72fc656cb83d9aa5165e7dc51", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237248, "uuid": "01f662a5-844a-44ad-8e72-871b5f7fb95b", "comment": "Malware payload (Chisel)", "value": "bd583ad342c38f4163c5642bedbb5f1737dd1c8c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237248, "uuid": "b85c13b6-f421-43a5-a285-b2ee677cc69a", "comment": "Malware payload (Chisel)", "value": "3d0d2f4543e355b75a5c507c820cbb4279625508b11e9d521adc6d57b9a7b2347ef10b51ef41f30d919b3af340bb1987", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237248, "uuid": "d3a3872d-df09-496f-a01e-2fdef1a88cf7", "value": "T127163346C9C2DFB90781540C9E32A151DE667C1B69ADD4312929C7CB39C36AFABCBF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237248, "uuid": "a2256fc4-5f20-422c-8f02-35bee8e4f53b", "value": "98304:OqCjL+Zbg32GAEHG2uAmTzjVYOJnhfEhQa7760dePuUGaP6lpVE4:OHjqZb6ybuOBJkWulTm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237248, "uuid": "ecc6a849-30bd-432f-9021-15c7e08bb7dc", "value": 4262042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237248, "uuid": "cace6f9b-5048-4f15-a024-5bd40b8b37ab", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237248, "uuid": "9d7fa28c-de2b-4310-b5d8-b7a29e625005", "value": "chisel_1.11.5_linux_armv5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c30e022-26d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774284934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284934, "uuid": "4e4a01a8-2eac-4005-bd51-2eb00be1d072", "comment": "Malware payload", "value": "3dda1de4aa5f5014e9e862a98c7815e9", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284934, "uuid": "80c62184-567c-4238-b240-0649c23325cf", "comment": "Malware payload", "value": "0e620510a9d25b5e3968b3cce9fea1a99c1110f65230ce0707532149f91dd5db", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284934, "uuid": "2d8c4311-0516-420c-819b-1a3af54f1c57", "comment": "Malware payload", "value": "8aef5f58d7d7610eb168cf6f3c284c39b3e606c6", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284934, "uuid": "54aa423a-a007-4bb0-bb47-813395aa7e44", "comment": "Malware payload", "value": "5430ed3337e9ea4f52a4704bd7a5bb7d33eae343cd2302b282cd98a9bf0e3706b2842ef00f4b51345e6a0215e118b44c", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284934, "uuid": "e8541794-a3c6-4203-bee0-960b0d82b2a9", "value": "T1B4148B2D8F2BE0D0433EF4A0C2D99D5773510A56CB7C8B98FF21AFA61D24655E79A20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284934, "uuid": "f28a2c59-c967-48f1-95b4-720f1ffb41a9", "value": "768:Zg1Dmp1DJD4k1z9CvrkbQahuEMAiDGOC3MFA6IJUOa2FM+5hBN0YrUeyQEA1qpZ6:46pRJMa8zsQkM5M3M5+hH5Q/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774284934, "uuid": "07f70e3f-a415-4100-bec4-2b88f9a9adff", "value": 194025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774284934, "uuid": "bc179f7f-83f4-4f42-a31f-669a8c0d79ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284934, "uuid": "8ffa1b04-3663-41ed-a10c-7372378ba279", "value": "MRI-20240922885.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc2e2be-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282815, "uuid": "202ed31c-c5c7-474f-a208-d011665547e5", "comment": "Malware payload (Mirai)", "value": "af416b9f42e0f5e978cfc42a6abbfc55", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282815, "uuid": "fb4afcd7-3b95-4e9e-bf81-99c657ed9617", "comment": "Malware payload (Mirai)", "value": "0e9d94669cd8c579034cefedd868de7b36d675f6daf61b28d28739bf2f6759c4", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282815, "uuid": "ac702f73-b6b9-4cf8-bab8-25e64f126680", "comment": "Malware payload (Mirai)", "value": "6d66c03f585cd5e01eb0ce5de76f778d9809a9e4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282815, "uuid": "0fe43e91-972e-4064-bb45-e1fbffdbb9ad", "comment": "Malware payload (Mirai)", "value": "5397d57080f22fc2d5fa110d8077df4d5297aed3c1cb51a141122f92b68dde3a9276d7f402776bac605b0b642bc75445", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282815, "uuid": "a2920095-58c1-4896-b038-28ff0186e5d8", "value": "T14CC44A59A8419B95D1C02BBBFF1D934873131B38E3EFB1069D196B246B9BC1B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282815, "uuid": "a49f9af7-0aba-46c0-ad00-cbf6ab934f33", "value": "12288:TWt5NBnm9jdbLo0xgHCXCLlE/KgReJY7fCFKtw3phWL0aMLG+hbzKkt8DmhW0:TaudbL7gHCt6JY/wtZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282815, "uuid": "1ccb610a-ec16-4de0-9ad9-6d00e53b7c0a", "value": 589440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282815, "uuid": "7077a2e3-cb8c-417c-9481-be2d1c5b4cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282815, "uuid": "72550703-8de1-42fa-ac80-58525fb3aa0f", "value": "5_187_35_158_443_feb19_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131d93fb-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259149, "uuid": "bf1c2992-3d96-441a-bde8-1734111b0e6e", "comment": "Malware payload", "value": "41211e787510f67e1825dd853632d81d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259149, "uuid": "b12ac3f6-3843-4723-ba4f-8b860f944157", "comment": "Malware payload", "value": "0f140bf8fdef08656aee12a2f542654281abad55e33a46f4c3d97c35e9ea3731", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259149, "uuid": "1c4bcfd1-7708-484e-85f3-d3cbed676557", "comment": "Malware payload", "value": "b72aff2b16ed44e173c66408ca382d1bd15f85b0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259149, "uuid": "87ecd065-9b89-4733-8db2-f5bd0e75b783", "comment": "Malware payload", "value": "63be70e5f14ff877a0f014cd23ab5590b0fabbe4c33171bd1c7f797f36dc73d40cfe833d9f4218775688bd8792c929f2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259149, "uuid": "de1ebfb4-2e77-47c0-b8bc-31fda4991793", "value": "T10901E4084F64D1B4C36B9D4141FBBFA57E54A748061C37B62C9FA84C418597A9C7B0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259149, "uuid": "329655f7-0785-46ca-95ca-0334be81c0dd", "value": "12:phDf5kxX6UL5v53R+5QtyntEF0mtmVjDFUTXcYbEnlVknYPOweplH:v1kR6Q5v53R+5SKVycZVX2rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259149, "uuid": "2aa69490-512d-4f23-8daa-196011006e27", "value": 733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259149, "uuid": "95739ae1-518f-49af-8032-9f42f36d7866", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259149, "uuid": "9e7dbbb5-0841-4562-b01d-1dae37c480e8", "value": "0084085_771031729.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cdabbc-26a6-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774263241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774263241, "uuid": "21447f65-d9b0-4100-880f-1e444fcbe992", "comment": "Malware payload (GCleaner)", "value": "6138c1e38892c52064905abd51b7aeeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774263241, "uuid": "cd247500-a213-412b-8e1b-6ba295e543da", "comment": "Malware payload (GCleaner)", "value": "0f416e0e0e1649dc7867fc808ff6f95de544f4c802bd003722ac4e743f48568c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774263241, "uuid": "9cc3fb6b-f8eb-4911-a146-2a60a6a0596a", "comment": "Malware payload (GCleaner)", "value": "25feedc889de2736bbed8434412e44ac9653f816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774263241, "uuid": "d3cc201b-8c10-400c-a12f-37d1b967af5e", "comment": "Malware payload (GCleaner)", "value": "2a39adba640cf287b6a0a1f502dbef07e476720e38841813a3b70c2fde7686756a9bf25de60f5eccfb93c21041a927b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774263241, "uuid": "26827169-cff5-482d-af50-92681fbaf8f6", "value": "T1AFA4604EEB4721FAE7EC9878805041BFD36276555B308ED7B220BA43E61369F8C7D681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774263241, "uuid": "9583d71a-6d19-4c0e-9e4f-2ae8bf784d48", "value": "1caaf1c2b551d7902bfdc051b8e7b5f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774263241, "uuid": "92e91846-f6fd-4371-b185-a32c815e0544", "value": "3072:2IY1HkLSHhC7fzqWTJb5ZZkTSPBlacKPMvbQVpvuH9uJ0Zw67EDGYneHTw60IVl:2aLMhC7fF9T+uWkQvzrnGo6Tw+Vl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774263241, "uuid": "79352a94-0c5c-410b-b084-21ef44eaa038", "value": 482808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774263241, "uuid": "15f4b466-ead3-49bd-9d48-b56db4f8c13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774263241, "uuid": "b14aa39c-2ec7-489b-bcad-275a9f11a1ac", "value": "wmisvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5e9936-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282819, "uuid": "fb127c93-b186-4c24-aef9-0fa75a82fd00", "comment": "Malware payload", "value": "da84d92d3d99965f22404f68d1ecc085", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282819, "uuid": "7d8b2a92-952f-4955-9ed8-b01019bd2070", "comment": "Malware payload", "value": "0fecfec4dc0cef15a2d4ae68bfe25d06ab0656039d46ee303c79254d0bea5012", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282819, "uuid": "9779b8a8-d20e-46ab-b054-a483a089af27", "comment": "Malware payload", "value": "e2aaea9c3b01dc4b0a1be1d3367a2c095007a510", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282819, "uuid": "2212048e-c7c3-4333-b074-780aa18020c9", "comment": "Malware payload", "value": "b16952acbffc83eaad6a8fe54e0771d482d5e1922f09f1c51c84bd79bcb683bee55d87bd78c901b19e329bf8bd6d64f8", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282819, "uuid": "b486630a-a152-4a51-8306-4aa6ef3d6e30", "value": "T1474145A0BD5ADD36F40401BCA48A8F131BD1482F109DB54862FF7962460E58EF79B739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282819, "uuid": "99e23864-7231-458b-954e-87b6103f9b1c", "value": "24:6msuQgqL1/E+N/LrfxaMdfg2R2+W9purQUBpnoiEGQJ7xP:6mXQgqL1/EYfrd42RYYrQInoiEG4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282819, "uuid": "6ac5f293-c923-400f-9f83-d8c459b773f8", "value": 1912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282819, "uuid": "7f4f915f-f92d-422e-a4fd-2e528e829e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282819, "uuid": "f9c12c86-e036-4fc5-adbd-dd189ed0d907", "value": "installer.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32caecc1-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282825, "uuid": "3b113e07-0031-4014-a2ec-2ad6fff2fe30", "comment": "Malware payload", "value": "7b5af84bf476ad1f07a6f981fc680ed1", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282825, "uuid": "88cbea84-e9ca-401c-aeed-042ad0a63a39", "comment": "Malware payload", "value": "121f7a1da6b5d74209a64dfaa42f56d5ce7c52181f49fb256f8bdbdf7c00222f", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282825, "uuid": "83c95420-5fcc-4b45-989b-40fc0798af7b", "comment": "Malware payload", "value": "ef769b95d28da892949e19b5441a48f336dc872a", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282825, "uuid": "320b75e6-e212-45b3-9032-52ab692b7c4f", "comment": "Malware payload", "value": "494593cd517c7a7f51561e7eaf10fef434877486e0e61f09ea040a9ffee441968c5be053956355742da79eb1d214716b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282825, "uuid": "3df404e4-11d7-44d0-8881-3098a97f069a", "value": "T1CD531946A9E37612D6C361BEFF9B80157317AA2793E8B100FC1C97502F427958FF2A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282825, "uuid": "d63aed04-7908-4ad7-845b-1722190c0024", "value": "1536:CZnaHsmaSYiUgMumSYB68aBWu9OjTjP/0c28UA9R1emH2q:xMmaSWgMubyaEKOjTjP/0c28UA9R1emx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282825, "uuid": "95615e6f-9d17-402c-8760-939b4657692d", "value": 66344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282825, "uuid": "439d5fae-9b3e-4d41-96c4-8ad86bf983c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282825, "uuid": "b5fe1e59-6cd2-4cf8-ae21-e99821918c3b", "value": "rkcompiler.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874ec2ed-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240017, "uuid": "0363f46d-cd57-4344-8227-2a512d8f916f", "comment": "Malware payload (Chisel)", "value": "aead470f3e5f0856ba46d158b52fd1aa", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240017, "uuid": "8fbb8f60-f912-45ec-b441-f345179125a6", "comment": "Malware payload (Chisel)", "value": "12f8c74a9f521eeb75231595698b4c9f47328b9047938b048e081b72e63f946b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240017, "uuid": "abec89c8-e454-47a4-a629-9aed0636ed19", "comment": "Malware payload (Chisel)", "value": "7dde59a5d2bd1c4c7d24473df6cc0383bc758c83", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240017, "uuid": "2ec799b7-158f-4a49-86da-e0f7fabe8cf2", "comment": "Malware payload (Chisel)", "value": "bd428b952bbf4c538861e710b2a073a87ffdf165fa3f27c3decd5d50e4947a7e547c5a724208c593f724880d63c72672", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240017, "uuid": "bb89afd7-6ab5-4719-8d8e-5108aa64f478", "value": "T1601633C2829DC0F1D8CD0E33EC265CFAD5257D45A92A31D297B2C713AFF6A769DA0409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240017, "uuid": "07c0e7fa-3bbc-44dc-b585-f7b030a2f5c9", "value": "98304:JLKXcGecxdnh32s7ZX3CMfJs10u/sRSGSOh9WJIZ3GpA7Z/APFsQ0ajEo+:JmXBeI1x7ZiM2FslnWpuZYPFSo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240017, "uuid": "5cf68b4e-39da-41e1-b6cf-7c0f01f8d309", "value": 4355576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240017, "uuid": "73ee5fbc-3350-4926-9ef1-e76c3f411415", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240017, "uuid": "f7b7af28-d624-4d04-a6c8-7e991296b44a", "value": "chisel_1.11.5_linux_s390x.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df77a75-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774257637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257637, "uuid": "f0a9daf9-b6e8-4de2-9ef9-478401cccabb", "comment": "Malware payload (SnakeKeylogger)", "value": "1889c78deedf36e43146ae66d1b57abf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257637, "uuid": "4f3e908c-afa0-42ad-b798-3e4bbf950f12", "comment": "Malware payload (SnakeKeylogger)", "value": "13d0c213abb5022fc31be59c0162d99faaf074678202ddbe628f1782917a1b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257637, "uuid": "018a87fc-ee48-403a-a301-12390ca92bc6", "comment": "Malware payload (SnakeKeylogger)", "value": "7e437ac09a6411ff82e083626d754b78afcc7181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257637, "uuid": "799bed8c-5ce6-46c2-9d39-daadebc9ea6b", "comment": "Malware payload (SnakeKeylogger)", "value": "094abc4c2eff34917c02db41c4b458ef4f370cdef4baeb514b4a59fb9beb58b14356410d1b5eb061d29bcc4074661f66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257637, "uuid": "4a291820-5bb6-4dba-a1c4-d8c765efd6bd", "value": "T1BC44B78A6FE89811E6FF4437D2B6D024C6FE746345698D2E1682E8193A3D944DF0BF43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257637, "uuid": "091f0ef4-b243-4a2f-ad14-a43f067b6790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257637, "uuid": "78a41f9f-1462-4f59-8b48-e098fba8e0c6", "value": "3072:DpkPuCwVgvfvst9tZtOtMtbtDntJ0rxZUhzGior2GzlVvfpmuRbeLAS/m6s0WUYk:oXULjISpderpmuRbDS/mxJb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257637, "uuid": "d54c5609-1e73-4208-8782-5ff4f0fc0d3f", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257637, "uuid": "8e6bd746-15fc-44e7-bc40-1290a5a71acd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257637, "uuid": "cfd4c03f-1683-47ec-8543-c945eb32d479", "value": "Remington.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b83fcf-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252072, "uuid": "8c600c5f-f86b-4e5f-9a40-fbfab78813b4", "comment": "Malware payload", "value": "31fe3b4d01199d55d8d807b36907a7d8", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252072, "uuid": "f0959020-dbfc-459f-a1e9-b449fed66141", "comment": "Malware payload", "value": "150b0f104c5a024af620203a465335539deafca4f1480f3121be293d199deb7d", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252072, "uuid": "6e99c83e-d39c-4fc7-aa47-f1fc377b84a6", "comment": "Malware payload", "value": "517e9f5d027ed1d232584e2995f7a8e595d499f9", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252072, "uuid": "68972bf9-1910-427d-8895-d12e23712d0d", "comment": "Malware payload", "value": "7416c7f03ed0f2d4e47ce7dfcd6a2fa1e676dffd27c724421e98116d07ca543dc48e9b8a5134d60caefaa52f5a20fd56", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252072, "uuid": "c3dcde34-8389-4d49-9da7-331a1ac33b7a", "value": "T111C6CF21777258B6D67205359BAAE3F9B73C992403B841F772802DE9E8344E23D3469F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252072, "uuid": "95ca112a-29b5-4ce9-9ce3-56e021fc44e6", "value": "5af8c7862d04051ac2090d4b16336b63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252072, "uuid": "6a19f124-9c32-456b-82fb-2ffab3cef6f8", "value": "196608:kISiu71OP5k+oqSF7fE73MGhJGyuj6JJkjnfB1Oq534U3k3k0ZXIeCr:kXORk57ccyuuUfPURHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252072, "uuid": "2f3ac541-5d80-430e-8025-4636bb636a00", "value": 11779072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252072, "uuid": "d3b9b0fb-f8ae-4023-8c32-e5e77fa99629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252072, "uuid": "e136a508-2e03-4185-ab31-b3cc943b5643", "value": "HP_Star.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bf7e2b-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277672, "uuid": "466dc823-48da-4216-9f44-6af0348fe922", "comment": "Malware payload", "value": "39411f31ccad546ef3eeaa24a813b66b", "object_relation": "md5", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277672, "uuid": "d1e44c6f-a60d-4ca5-b053-f59303bd449d", "comment": "Malware payload", "value": "153b0855f09b16ebdfdaf6e520e616751b3324b852193f97cb1c9b0958c7a93b", "object_relation": "sha256", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277672, "uuid": "95310841-f498-4b7d-a5fc-33586ad05f51", "comment": "Malware payload", "value": "86dbec44e2ead21242acd6126ec4e829b75e8499", "object_relation": "sha1", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277672, "uuid": "e17efa74-b15b-4661-862b-6ba2949e4bff", "comment": "Malware payload", "value": "97c00f624167d0b6d2a7f350aaa7d83a38beca331b152d9e3b4296388e96e7f28e0de2bd53e3a2376c01305495b10511", "object_relation": "sha3-384", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277672, "uuid": "29983806-ab88-4c75-aba0-a596a16255b9", "value": "T11D31CB78CA70FCC043AD72A0891A3E0B20A44A67CB358F78E552089A7E1D665DF2A59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277672, "uuid": "06ae1a2f-754a-41de-abb4-b6bad26ede1f", "value": "48:qkTsIgYQdt4PvpMf4hZCU8vHfIDz8eZpwui:qasVYoKJMf47vyHwflZ65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277672, "uuid": "0f9c5460-3052-4dfb-9b18-7e2d06ace2ab", "value": 1675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277672, "uuid": "0c054ff0-0db2-49e7-a654-f9d828f3349b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277672, "uuid": "8f71e1c3-f7d9-4627-8948-49f117611f73", "value": "cmd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36216082-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282830, "uuid": "790fffb4-9a89-433f-bc00-9862f0ee9be1", "comment": "Malware payload (Mirai)", "value": "f997ff9c4e432535f9449b16bd712ee6", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282830, "uuid": "53d43787-6981-46b5-bc8e-5d826448f45f", "comment": "Malware payload (Mirai)", "value": "1579829982fea6472611a6687e2fc2dd504ead7bd6ed92e021f17918aab71a8c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282830, "uuid": "43f06d86-a9de-4e00-845c-949d9b3e04c3", "comment": "Malware payload (Mirai)", "value": "543dda4f14fe05da3465fee2eb08426fe5f859cb", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282830, "uuid": "89817134-c7b6-4608-945b-7064270cc607", "comment": "Malware payload (Mirai)", "value": "2b155a0d8804af8a2bfaea264dd02d620b2b89231e9fb491bc445be13878c847668a5d58f433ff616be1687129fc5316", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282830, "uuid": "fbbc04f4-bbb0-42fa-b632-899923e0544c", "value": "T1DFC44959A8419B95D1D02BBBFF1D934873131B38E2EFB0069D196B246BEBC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282830, "uuid": "5942bfba-d404-4b74-9488-8283838584fa", "value": "12288:6IDtjUvcDvdc5ZbHAHCgLBzoExKqRa8YxtCme5IUraVzAnaZR9J2MUvQ7pRW:nLdc5VAHCi/+8Y2IUrco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282830, "uuid": "6711bf55-338b-4693-99c3-f485cbd110b8", "value": 574056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282830, "uuid": "7f8b4ed2-acf3-4c17-bd50-f160ab798a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282830, "uuid": "41d246cb-23b1-4638-8035-1db6eeedacd5", "value": "from_wireshark_103_77_175_243_34567_march3_2026.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e6714-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774232442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232442, "uuid": "72ac2369-4c1d-4a94-9a6d-a8d8f44ad8f1", "comment": "Malware payload (Floxif)", "value": "5f2f05050bd0c9395997d5d98b0faaec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232442, "uuid": "f6f29a69-cf7d-4502-b96b-39b76fa61f52", "comment": "Malware payload (Floxif)", "value": "1622ac3fa3cf29bf8f3e87b81bb0c17655a513b4d038b12eedc15e1c2eeb357f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232442, "uuid": "76a1695f-9a7f-42d1-8b42-807b9aa96ff4", "comment": "Malware payload (Floxif)", "value": "c3ba70c8c58cc8334434d79b1cfb2c01ae8cd2b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232442, "uuid": "fd27cd8a-3b27-4fab-8f9f-c198f5540eb2", "comment": "Malware payload (Floxif)", "value": "13eb784f6a3c062cf5f30c2e6c533f23f54be6b02ed7f5c4d5064132e10cf1a0c26a249a87532846da68bd1df92c357e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232442, "uuid": "af175c07-76e8-4aee-8b28-c23e482ca727", "value": "T1CC24CF4079C0C3F6E4B228303574AB705EECFC3C0F665AAB974515699E3C5D29A68F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232442, "uuid": "22ed60b0-cd6e-483b-b7b2-e2e471592dda", "value": "23b9079896617a8a01351c21a6caa337", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232442, "uuid": "4877f784-65df-4196-b4bd-cc31c590fefb", "value": "6144:ayC2zi7aDccGLKZH2FaLw9hH4JdBV+UdvrEFp7hK3oc:ayC2zi+D89hH4JdBjvrEH73c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232442, "uuid": "6cd75c03-e0c3-4184-889e-2dd09192ad83", "value": 229831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232442, "uuid": "4cba2489-bdd8-4bdd-8863-b78875a1b549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232442, "uuid": "412ea8f9-4963-4b9c-8677-1d22ee2bb6b1", "value": "1622ac3fa3cf29bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39160e9d-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282835, "uuid": "ec14c84e-9536-4f9a-9d29-60fa49188fda", "comment": "Malware payload (Mirai)", "value": "8437d2f80f1ab1eb2fcbc044741893ae", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282835, "uuid": "8dbd565e-5be4-4b82-ab6c-a504c500aab0", "comment": "Malware payload (Mirai)", "value": "16e3ac66f85aa3dc0f49bd6df44ae29e7512fc7e293f8e2c24bc11dcfa249a78", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282835, "uuid": "81f04e80-b429-4a7c-93e5-d2984362bbcd", "comment": "Malware payload (Mirai)", "value": "e3d17a03e6e4cfe842f157024f881f82714fdb14", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282835, "uuid": "5218d935-3c6c-48f9-abb5-c4eb5cc02b20", "comment": "Malware payload (Mirai)", "value": "d6b1a08eda09a97dd9044d4f18a5fd59abb8fa4d069b748c167fe5559d19ae0c010caf4d4eeeb4917b732c1658128c2f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282835, "uuid": "c20afec8-c9e1-42ed-865a-b920b78d62b8", "value": "T194344C46EB408A13C4C32779FAAF42453333DB64D3EB730699146BB43B867AE4E76605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282835, "uuid": "3606ca86-0437-4446-b8bd-c7fe605fd98b", "value": "6144:bwtVzsbVPH3lSeux9azTpYdo/871UbwiWyAbf7y5TGnJL/KHbCIimDj3Gqw0:UfzsBnq9azido/871UkMAbf7Aq/VmDjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282835, "uuid": "6e3d118e-8e9d-40d1-accc-4ce7edaf842c", "value": 246591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282835, "uuid": "d5e2f557-649d-4bf8-b4ca-29505fc2a72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282835, "uuid": "a302e1c7-0697-4ea4-8c2c-76ee1fa3d083", "value": "arm7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b164e9-2694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774255657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255657, "uuid": "87496be2-467c-40a0-af26-0866d4d11477", "comment": "Malware payload", "value": "20cf4b12fa866c28fe7523a717340e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255657, "uuid": "dc48697b-6e47-4d5a-90ac-3eb66d6b451c", "comment": "Malware payload", "value": "1715ad9008e4efcc8b45aef982f663cb79f78a0f654e3348db6def52f00a085e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255657, "uuid": "53f50bf6-c2c9-43e0-8ccf-50860686b88b", "comment": "Malware payload", "value": "06f3b55f0d66913cd53d2f0e76a5e2d67ff8ed04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255657, "uuid": "d45a5422-2094-48fe-8d4d-17a116e09383", "comment": "Malware payload", "value": "edeaeefb135baea209e3d79281fa3e354d3f313864f49208ff4677d7b9ae0cec0dbdd0261244bcd1d1ae4c22e6b3f18a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255657, "uuid": "9e64a50d-58aa-4499-81e9-dd1de8b5e6cb", "value": "T124567D17EC9215F5E1B9A27085639522B7307C482F2367E72A50F3643F36BD06E787A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255657, "uuid": "46c54db3-92fc-4328-b32e-8c60984234d5", "value": "55e5f67a48f05149804a2dc56e6cc0a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255657, "uuid": "deab1c0b-c59d-44b2-80cd-437fa3eeca10", "value": "49152:JDFZWTcq0X4lXBvOnlsvZVPBNVniZhUn20ZTz+FR1W0WRB+BlBGoBGJBdvBdsBdf:JeTvNri3UDNPiQEZXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255657, "uuid": "b6f85efe-d672-43ba-930e-029b3b252630", "value": 6117888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255657, "uuid": "b541e4fb-547b-42d9-9b83-211907de854c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255657, "uuid": "55e37110-7672-4597-86b7-b217f732a5dd", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7977e3-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774300957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300957, "uuid": "0a04ab96-56b0-472f-a5ff-1112e5e8b0fc", "comment": "Malware payload (SpyNote)", "value": "56f8a4547589971dd255b5371550015d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300957, "uuid": "055642a6-37fa-4710-a5f0-56fac56507ba", "comment": "Malware payload (SpyNote)", "value": "17372844a0ecb548c70275a5e06f522a2445f2781410a246130757e0b7bc5396", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300957, "uuid": "584ab9b5-d6d4-4df4-915b-226dd3b8f229", "comment": "Malware payload (SpyNote)", "value": "cbb863074e1b48471000490c3fb3c6eb45fe4e74", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300957, "uuid": "3deb975b-5cd7-43e9-b19d-171a77bd85bf", "comment": "Malware payload (SpyNote)", "value": "62d0c7d8139a0bb06d0aef6d6a40d4c43deaf36cfdeaf1f14919085d8a0fb7cc7ec023abe8ac3e67f138c69e71b943d5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300957, "uuid": "f6939653-5add-439f-9531-83be59cdd0f5", "value": "T1FAF412437F46CCC6EAF7023A5A9C41E2253F6FA60D42C6973A53F26ED5736C09B81944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300957, "uuid": "c6ad6d53-5623-4dd6-ad5a-0309fc203f39", "value": "12288:KcWRLGvBxGufjKAI22Z4DdGcajhb3pSjaWbs6bKOYIPTLXeYswusT3cgtN0Fos0A:KcWIHjKJ22Z2dGc6hb3pSrs6mnITLHTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300957, "uuid": "d1d3bf76-0b15-4d70-8f82-ae5785c8dbf2", "value": 733499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300957, "uuid": "337d1cd2-d4c4-46cb-a59d-b1fb709fe8ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300957, "uuid": "8c0fca57-9e97-4767-b148-c3b4cc0b6a35", "value": "ready.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d712b9d4-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252177, "uuid": "10f0be77-93cd-4cab-b34b-4d84904fe05c", "comment": "Malware payload", "value": "f9649eb5ff6b9e6eda83d6bc3acef0a7", "object_relation": "md5", "Tag": [ { "name": "3850b4b", "colour": "#5283A1", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252177, "uuid": "a60aa892-8ec8-4ae1-b43f-303c06932c77", "comment": "Malware payload", "value": "19ddfdf0a2960255a7b52e8b9e9d1cf53d6938c4c155329725501a58f9787d22", "object_relation": "sha256", "Tag": [ { "name": "3850b4b", "colour": "#5283A1", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252177, "uuid": "823a2eb2-509d-4b94-9422-be658efe5edd", "comment": "Malware payload", "value": "437d3161a8128ab5b4f257cfcfcdd272bd6aa97e", "object_relation": "sha1", "Tag": [ { "name": "3850b4b", "colour": "#5283A1", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252177, "uuid": "b8007110-5bae-47a1-ad54-db31df8aa81f", "comment": "Malware payload", "value": "335dcc0a2570c2d0487a699dc4c2621b605f99dccbfa9140ffe58f1efc192b3df6eb8b02bfa81f0a15df08d80242c1f9", "object_relation": "sha3-384", "Tag": [ { "name": "3850b4b", "colour": "#5283A1", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252177, "uuid": "e25518a6-9357-483b-9ddf-af89172c0505", "value": "T1104165467A23966408EED2D1E7769981C31ED89D0616FC34009DD014CE6CE2A83FABC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252177, "uuid": "4b1015aa-b2b2-4705-9a76-7fcaf3c6b932", "value": "48:xRWAydjLtP/zLPDVSMGH6FdhwLPRxpGnQ:xjWNLLPpSML58RyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252177, "uuid": "8d4b7315-9e8e-420e-8a3c-415d0d95e4d9", "value": 1951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252177, "uuid": "bfe3fb8e-fc34-4c99-b26c-0582044daae4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252177, "uuid": "73f22606-208a-45c8-957e-46356dad3d37", "value": "Invoke-LovelyPotato.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b31391-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774242326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242326, "uuid": "8721397e-a1eb-4621-9158-d56b123ace79", "comment": "Malware payload (Gafgyt)", "value": "7c166c0211aa809a3a7a41ab93ebdbde", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242326, "uuid": "872ac58a-6d1a-46b4-92e6-55c216ef1478", "comment": "Malware payload (Gafgyt)", "value": "19e116fcdd51f82471b55ca2a2198433d2214826c7e446d4b0dce9a7b9d51f42", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242326, "uuid": "acc74375-01df-43b6-824c-79745aae18c4", "comment": "Malware payload (Gafgyt)", "value": "9f429ef99dd510e6f995fae0397932a3b6d1fdfe", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242326, "uuid": "efa42dff-1b6e-486a-8338-d90546deaea7", "comment": "Malware payload (Gafgyt)", "value": "c280b9c65de74642e41497847086191f8d8039832627f78089c953de5b9c3a6288f49f6ac367c22bb27bf05f2de1a96d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242326, "uuid": "d3bf966a-9f35-4fff-943f-a64f50cabb5f", "value": "T188C32A05B30C0D47E1633EF43B3B27E193DFDA8121E4E640655FAA8A91B2D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242326, "uuid": "1f514bf9-7671-4491-84a1-10e408942d72", "value": "1536:6cB72AZ4ex10JrZqQ7UrZb6wI0vAnjiLVRuzae8Dhq6N2te5f3dSJ:6+B4exMF7oZKJnCNYawJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242326, "uuid": "c9adfd5b-bc4b-4e9f-8646-818cf41b8489", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242326, "uuid": "8694d8c3-fe9d-4ea1-ae1a-e0570fa341c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242326, "uuid": "b6425cb0-fbfa-4e42-923c-68273d663888", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602b3f51-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239951, "uuid": "00f6d6da-9b8e-468f-9bb3-a0f519f04080", "comment": "Malware payload (Chisel)", "value": "af85766e9357c69e58107fb4e21687f6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239951, "uuid": "cb59c644-8643-4aaf-a874-69314e256e1e", "comment": "Malware payload (Chisel)", "value": "1a100ebfc14624c4f654f38d24640d65fad67baf71f1a05e082c486953d897b9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239951, "uuid": "162bba0b-be55-4be4-bacb-d0e298e2b57b", "comment": "Malware payload (Chisel)", "value": "2182390f62952a663d20e4c665f9bdb36f50a4af", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239951, "uuid": "2c79dba0-dfeb-4d91-a6a3-51b7062a182e", "comment": "Malware payload (Chisel)", "value": "b0557982f024719ee712f9642e3bf4a3af9054e9208cbe3d0c17f5843f70697c0929759e44d4a9c5d9478e07a6d02c0a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239951, "uuid": "fb0a6829-f410-4728-af18-5d2291bb9e11", "value": "T16D06337242A934FFD5DECA5F5EA010C37E7BD088C09A6EC810BA4BABB64CDD751C5618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239951, "uuid": "ba83d9db-e19f-4b33-92a1-492c3505d0cc", "value": "98304:WayevTUsujBA9rs9vIM7tFRxJUU4MNPf9Op1+/JlgLmWI3jI4WeQEf:WzNjBA9rs9l3i2N0eJ2LNI304Wepf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239951, "uuid": "42b66c85-ea9b-4d18-8d31-d04fb20a6f10", "value": 3889961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239951, "uuid": "e220e677-2385-4c76-a1ee-bd721b1a616e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239951, "uuid": "94beb33c-1498-48cd-bde3-b52705611462", "value": "chisel_1.11.5_linux_mips64le_softfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5120697e-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774250663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250663, "uuid": "e60197fe-3310-4261-b8e6-9a9bb1a4ce6b", "comment": "Malware payload (Mirai)", "value": "6668a08a088e146aeff783f40e0b839e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250663, "uuid": "fc2609dd-29cb-4522-9eaa-80bdf81cdcf7", "comment": "Malware payload (Mirai)", "value": "1a6f324487b89aaff2e54ef8247fa38b72708102c2c5cd14c2d83a4e58d818bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250663, "uuid": "c9c55711-7b27-4160-8594-87a9f20139a3", "comment": "Malware payload (Mirai)", "value": "d5adb4e1f95b3a6d6a710c281c851e2a5cbe713c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250663, "uuid": "0fa4e25e-3fa4-4154-8222-7646163236ab", "comment": "Malware payload (Mirai)", "value": "a30efa72738846419e11004d154a540934497183efb1dbc08b6270e90159f939fd14a7f1dd9f97d8d6b6a97d68d17dcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250663, "uuid": "dc1b2b7c-a6dd-42f9-bb11-74fa405fe15e", "value": "T162241855BD416F26C6D126BEFBBF81CA33232BFCE3DE3212DD0457143A8A85A0E25552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250663, "uuid": "8229e8db-aa7c-421f-9fdb-800045d5e998", "value": "6144:5uttHRbe7/+LZmpMg3YJlfnHBUYhtDFniOBIOaZRxonKOQTHPSRoIwnFXqce:QDg/fMgYlfnHSgtDFnpBIOaDxonKOQT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250663, "uuid": "024e4d4e-76bd-4d43-8916-04b4f0a52087", "value": 228544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250663, "uuid": "8dc9bb03-8d98-4db7-8572-c08b3a9b2a4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250663, "uuid": "b3d7c85f-f9f0-4d28-892c-c1a9c75f7d16", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0139ed27-2676-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242369, "uuid": "c4c588c7-34c3-400b-a524-6a7dbd057c15", "comment": "Malware payload (Mirai)", "value": "a085b5897038e0b2a324bcc2b39a7e1d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242369, "uuid": "f755ffa1-361b-4787-8616-a77ae97469e1", "comment": "Malware payload (Mirai)", "value": "1acac8bea2b990f9a0d8c06297a268aaf3148ce9619c043ebf96b6247bafeb19", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242369, "uuid": "fa3377f7-a165-4c9b-8607-6565707f2374", "comment": "Malware payload (Mirai)", "value": "5aaa34ec815e03dd178e02b5df03c3e2142e219a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242369, "uuid": "c88970c7-59f0-426a-bdd5-89acd0351f53", "comment": "Malware payload (Mirai)", "value": "0c5710b20a5642156d9d93439730b03b42aa66765233b2dc2fd01b257e317cab383b3ac28993506612608f288fc26e27", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242369, "uuid": "79bc1a97-b5ee-4536-8d44-9bb2d2557ce4", "value": "T11CA328A3CC762F58C628D5B4B0B18F796B93AA6081475FBE1567C27480C3D8DF6063B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242369, "uuid": "5570428a-ab00-4cc0-a6d2-e203d390d1df", "value": "1536:7NufPeqU2CVKCsNV7lsLPC9z+NzWuBx/3RhyXAI:YbU2RC4kPCtSzWu3/3L1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242369, "uuid": "0e10f888-1de4-49d1-a8da-ba5097e006f4", "value": 105056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242369, "uuid": "0213541b-d1bf-4193-b258-09b9d77abe54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242369, "uuid": "91576c99-89c8-4f53-a5f9-01b12618dc85", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42cd4d9-2694-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774255581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255581, "uuid": "9b4a2d51-5a3d-495b-8353-9e88746edcf3", "comment": "Malware payload (RustyStealer)", "value": "a5b3dd6bd91aee9c2a9e95a2ad34c6d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255581, "uuid": "8b11ce7c-c77e-4b5f-9e74-73fa0bf79cd4", "comment": "Malware payload (RustyStealer)", "value": "1b1f80b7745c741c95fbbe421628c6f485a4d37df285860a3fc32355980e8d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255581, "uuid": "4708eb42-1033-4d5a-a475-cf20a76ca651", "comment": "Malware payload (RustyStealer)", "value": "f109e7608a2138c0537b8bebec103a274ee7961e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255581, "uuid": "282d9ab4-651a-4a26-94a2-035124654c9c", "comment": "Malware payload (RustyStealer)", "value": "493128215f73596f68d86a23b5ccbe492593177c32a05ce0310204318c65eb89d2e73647b8cc5a0309a4cf6f56c6cd93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255581, "uuid": "afb5581e-1a8b-4c6e-886d-7535ba6f70f5", "value": "T15BD66B2020D86607FD7ADFBD89DC76540F7AB2913722FE389B4109ED4FD1B59CA025A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255581, "uuid": "fd019e31-f289-4078-a616-49f76699758a", "value": "196608:4paKmG/4Mh5st4kdYsa/oKSkHT1o7DAKKgZw1EDdUy9U5Db0ae:rG/4t4kdT3kHT1onAKKAnD635Dbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255581, "uuid": "c929f37c-3a1e-4997-b34c-b6cd7b341676", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255581, "uuid": "daaced3a-3f88-4c02-b17b-f460f6cde935", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255581, "uuid": "5bfbc9ab-a56c-42ef-80c9-5748bb44572d", "value": "doubt5476.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58278f2-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249543, "uuid": "0161f0ac-8d4e-4198-95d8-e19e36783b56", "comment": "Malware payload", "value": "cd0bdd4981c265aaf47df66c50b01ad3", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249543, "uuid": "ce995303-e017-4e7f-93c9-49e9893cb481", "comment": "Malware payload", "value": "1b2ecba6b296aa48da3de6d9c256aee8c1af47454d4c69d7e812dbe5f654dd04", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249543, "uuid": "bb30a786-cb93-44f6-bfec-b25470a9a7fd", "comment": "Malware payload", "value": "282ab69dca5fca5d63fd010cc864ef0f22c3b86d", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249543, "uuid": "4240cf59-9365-4fbb-b881-419b2deb6cab", "comment": "Malware payload", "value": "7a9bf25dcbbbd0df16d0ad305dfd1cf5b80491dffc885c465ae9eb70086b1c23cc88f349b458558aa1e9a4c7a9e9c91b", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249543, "uuid": "a81e0292-76ae-4c60-8922-658bf972fb5d", "value": "T1AB563332F42C55C6C43BE4BDD0E31BD583E2230ED587D47A95A23AC4B4E278A48DDA5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249543, "uuid": "0915ea54-7d5f-421b-bf07-fa90e05ae32a", "value": "196608:06lt01fo5EbEMj+0uU+HB/OGUElH6XU8YYlbHXUZZft6:0uag5EbEc+rU+h/PUEl0U8YYlbEZBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249543, "uuid": "1588b36a-a8c9-4f97-bdf4-d7587af4c64a", "value": 6464641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249543, "uuid": "6e289033-cd52-4e80-a01a-7d83f9cc59f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249543, "uuid": "be6ceec2-09c5-462f-a2fd-42cd15352487", "value": "2surionimyeaqa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6704c09-26aa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774265034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265034, "uuid": "5dfe6aba-a8ff-4684-a696-5a607bef6e13", "comment": "Malware payload (AgentTesla)", "value": "16e7a6b930725d3fba34c1c1634ec152", "object_relation": "md5", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265034, "uuid": "ba1a0e6e-66ec-4827-a4bf-64d852d896fa", "comment": "Malware payload (AgentTesla)", "value": "1bc2de25d74abc115aa2629c6c05e6f5e873f8da32b7f875f35200e1228caa36", "object_relation": "sha256", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265034, "uuid": "f421f401-db5e-4e3a-81d9-87e4e7741fbe", "comment": "Malware payload (AgentTesla)", "value": "a76c29de0d5aa97ca4c07208dba6f4125b559a89", "object_relation": "sha1", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265034, "uuid": "e7fd990c-01a9-402a-a36f-73ba5159fdf5", "comment": "Malware payload (AgentTesla)", "value": "151d9bb80f6ad6b926b39c8e55383f985650092cbdc94809b2fdad118423859b7f9bb052f496cb83264d66455676b28b", "object_relation": "sha3-384", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265034, "uuid": "6ab90de5-567e-4781-8483-2a4ca980508c", "value": "T165843970C930159A4F436B9EFD6A0772CEBC8A1A5A3B45B1F5C9030E51059ECF3BE629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265034, "uuid": "1c5ab448-ca37-469c-b7f6-a69adcc9799e", "value": "1536:zxyI1xyI5xyIboXHWxyICxwxyI/xyIboXHdxjxyIbcxyIYxyIbdx1xOxyIMbxyIN:UHxHB5HlPJJ3HlsHYHlLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774265034, "uuid": "8c06f46e-737c-4817-a715-f5f929a71672", "value": 381396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774265034, "uuid": "82530d3c-2120-4802-a2ac-114b61117813", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265034, "uuid": "1753263f-5098-46ea-8127-6f74043639c0", "value": "23-03-2026-002812.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1854f62-26d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774284863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284863, "uuid": "26412b1e-436c-4f92-b7bf-d72092cf83e7", "comment": "Malware payload", "value": "f7101c581319fcd581f3045b5b7d6d09", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284863, "uuid": "01652884-e846-40e7-b82e-94f1d3326af4", "comment": "Malware payload", "value": "1c05b182d5cb5506495038e05e61514f441f3ee8c03f2a72b4e66cc92fb627c7", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284863, "uuid": "1f4f10f3-df78-4193-91a3-554ddd39ce65", "comment": "Malware payload", "value": "a83284681a78334b5c40f6914011df97e9ec72b4", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284863, "uuid": "dc4e526a-e428-4f4d-b4d6-35173de088e5", "comment": "Malware payload", "value": "85da921bdd6f0673889503e987eb3ea7edd52cf4cdf1fea3223411873a9c2c331985094a25c7c030440863393c420366", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284863, "uuid": "c3b6d2b6-5dbd-44fe-bfc2-9f68e4cbd549", "value": "T12B3701E49DA93E2A28782206937EE49CC224D072F24765A4D4BBD3D19EC761F03F87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284863, "uuid": "84d89c45-0e29-4793-83da-1fa4ba375280", "value": "393216:3zZShZzrv9YAppTWme9vKeUS2JjWqrc4btEDh90uFf5+Q:3IfPvnpMx9vnUS2JFrGVBL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774284863, "uuid": "ad2c8cb8-5f04-4130-9588-b7d8005c2b39", "value": 23178392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774284863, "uuid": "ec03759e-05ee-43a8-ba79-0e70ffe2b318", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284863, "uuid": "816f0cc1-e3b7-475b-b19b-a0b83d6c5a38", "value": "File25.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2831cbc5-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774229120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229120, "uuid": "158ca957-3c4a-4173-b445-f0a9f1340a4f", "comment": "Malware payload (CoinMiner)", "value": "c5676c32f7561a91a6ae87dab98fa1f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229120, "uuid": "22f9136e-5de0-4714-aedc-06ec0bb3a82a", "comment": "Malware payload (CoinMiner)", "value": "1c79053283b689cd734b8993bccd694ecbd4db853a6a50909473e1f1c32e115b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229120, "uuid": "beb433e2-e15e-457c-a9b6-df4c8193181c", "comment": "Malware payload (CoinMiner)", "value": "1bc945f65019d571ac017865e46c87748fb9efd9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229120, "uuid": "4abec1f4-1573-45dc-956f-df1e004bd4e8", "comment": "Malware payload (CoinMiner)", "value": "8d551a496f7c12350e7f2e4a6648b9d8cf3c601c07bddea63a438baa2d518f04ab506ae8c629479b3bfb0a59c06ac8e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229120, "uuid": "d758f7fb-4815-4f7f-af5c-9b6784724a80", "value": "T151565C41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229120, "uuid": "436b4906-f8d7-4a50-b3ec-17e0787ab4a8", "value": "c782987849999c5ae345a5deafbd73fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229120, "uuid": "3e0f7efa-2151-4135-8e23-cd4145069547", "value": "98304:oemTLkNdfE0pZrD56utgpPFotBER/mQ32lUf:T+q56utgpPF8u/7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229120, "uuid": "0d9e284e-7bda-4ecc-a1d8-0edd64f6b78e", "value": 6363753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229120, "uuid": "bb44a2c5-02d8-42f8-bb73-86796278707b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229120, "uuid": "2969d106-cbcd-4b18-a647-0a2c7c8deee2", "value": "1c79053283b689cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0424cfd-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774301181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301181, "uuid": "66dfa950-5809-41dd-ae9f-c4d9911f1ac5", "comment": "Malware payload (Mirai)", "value": "a65a01a16d125e903222d7c6a41d9ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301181, "uuid": "55f1a090-422a-4713-ad5a-307522618e19", "comment": "Malware payload (Mirai)", "value": "1d37424bd4cbb269100d1e708f0e47bce99f5b0c5bb53a00d2365d89afa2a189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301181, "uuid": "ca3b2fcd-7d80-47c4-828d-1e67739aa417", "comment": "Malware payload (Mirai)", "value": "95f5f6e04dc70e18b71b3debe56b04f57e3e1e57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301181, "uuid": "c947860b-1e48-4c14-bcdf-71bc7441c18d", "comment": "Malware payload (Mirai)", "value": "0d365af573aae83568a09700d586f50de75841afd1c8be1d4900e39637f9ab6c21180c0f1168575895cecf87895cf390", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301181, "uuid": "0e2cc967-d77b-4c7a-83bd-301cab88b76d", "value": "T172330745B8C19A6AC5D0537AA62E658E3351B3F4D1CF3703ED985B1133CA60F8EBAD40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301181, "uuid": "8d448fc3-80df-4922-be10-fa088d166afa", "value": "1536:j/UEhOlK2tffR09N4J5/3PJUVMTgi+Rd7/:j/U0OlK+qN43//1eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301181, "uuid": "5dc403ef-af5d-4315-8029-83b882b02aa1", "value": 52476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301181, "uuid": "6ddaf2aa-866c-4c69-baf3-d30e17f60760", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301181, "uuid": "1f12f0ef-14dd-47d5-9865-fcc8aea4a824", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3526d600-26f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774297861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297861, "uuid": "4c321261-e583-49f0-8289-fd4b70c83a4c", "comment": "Malware payload", "value": "acdc26b40332f54ad1f24aa996f72193", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297861, "uuid": "472d74ed-39ea-4e24-b84e-bffe5f2b6a2d", "comment": "Malware payload", "value": "1e1883289ec619ae7d2b60e1b85e032a29f14401d1108cc9918bdef390940c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297861, "uuid": "666524df-c603-4fa2-b684-f12d3b55d2c5", "comment": "Malware payload", "value": "a5cf7e895d7ab8203d6f2e67cf9eb8e3e58500ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297861, "uuid": "f59f55cd-cddb-4863-b92e-88225937e90b", "comment": "Malware payload", "value": "b59d3f9a975e505981cf592d9fc877894dbea46dea6c430b2b21fa7f761d11e4412ea38e190c9c7d953a3ca4677fc170", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297861, "uuid": "d21c1d2d-a5ec-4224-b3fb-e093e865bfbc", "value": "T1D4F7333BE18F6139C0AE127525B3D520897F29A164629C236AECF8DCCF250755E3F687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297861, "uuid": "f9e96ada-97d7-4705-abf4-e63517777a93", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297861, "uuid": "db6eaeee-04f1-4674-bb7f-8c3c0ebcee2c", "value": "1572864:vibp32FzeZjKmqyQvJOhcnU3LODgOlh2C5xImQ:FFCWm4hG4U3L3OOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297861, "uuid": "2eb609eb-21ae-4a37-9f4f-a47b530f7add", "value": 71705352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297861, "uuid": "56eb6630-8e0e-4b19-80c7-f0ab2a5a4b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297861, "uuid": "6a988805-6fa8-4340-876f-5747da5a00bd", "value": "Certificado_PCMG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fa9500-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774266261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266261, "uuid": "259c6c97-4d61-45a0-99c8-4d13aace87c8", "comment": "Malware payload (RemcosRAT)", "value": "1e2153a42b25167d0f621da0251c78a7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266261, "uuid": "01aa6279-a2d5-4557-b639-145b518d9f2b", "comment": "Malware payload (RemcosRAT)", "value": "1fcd45e99c12157e5b4b9df0a64a51a591eedfe96eb0575d88eb10af23603650", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266261, "uuid": "1031961c-0458-4b94-9fc0-422e96447fc2", "comment": "Malware payload (RemcosRAT)", "value": "bbabdac55b1da4aff3690056b961f2d0c66b3bf9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266261, "uuid": "c3968ee5-271e-4527-b175-09e79606e27a", "comment": "Malware payload (RemcosRAT)", "value": "7dd0c1425af30e652e9dc070a029b21d184c0fda0b5ea93ec8aba203ec0426860a8244ab570dd308e71c3830a702f950", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266261, "uuid": "ed5eaa27-e0c2-464c-86c4-d9111b714fdc", "value": "T10F74E0BAF19985DCCA43C0B1A2168540174FEC943B2A8B25605EB377F5B3FACD783586", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266261, "uuid": "8e8658fa-6a6d-432f-9ee9-3597b2ad27ef", "value": "6144:4RguCu9QX4S0BuSVPvjt2LkCSrUFopF+BB5k9ZJiGUE+3gSQOSn:4Tf3S6Hlt2LMEopYVkXMGbhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266261, "uuid": "62a2cec9-d188-4095-931a-2e6e0ab0f713", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266261, "uuid": "d42ef63a-9136-4227-86c5-7556acc2ba56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266261, "uuid": "ea724269-a689-45ac-aab1-4eb049a50347", "value": "\u0540\u0561\u0575\u0561\u057d\u057f\u0561\u0576\u056b \u0562\u056b\u0566\u0576\u0565\u057d \u0561\u057c\u0561\u057b\u0576\u0578\u0580\u0564\u0576\u0565\u0580.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef24431-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282845, "uuid": "7282a370-eb6e-4d32-8d81-0820a3973250", "comment": "Malware payload", "value": "9b7641ccb4ef4cdc3795d1ef6a0b3097", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282845, "uuid": "e3c375e5-19a1-44cb-aa6c-52bf013fd412", "comment": "Malware payload", "value": "204edbbd9ab906160ea75c77681a47a21f018f18eca0927a901df6fe24fbd532", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282845, "uuid": "c9e60f8c-6c15-41aa-a5d2-f418a39bb490", "comment": "Malware payload", "value": "da60cccb482b2c12b7718107ad6a1f48fe15b7fc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282845, "uuid": "877c87e0-9689-4abd-bf77-0023d5c612fd", "comment": "Malware payload", "value": "2433008ae181f89bc754d8caf2c8f0460c8323c2b5e35f035125c77d44af05d00bde51267f0779ffaf10f0d70d7bc8e7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282845, "uuid": "005a7d3f-0fb8-40f6-a15c-b726fb6ad02b", "value": "T1ED450192B324B82FDD3B81354C4AC2791B25AD51CB96630BAA24373C6C773D94F49BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282845, "uuid": "34cc0d14-2bf3-4f52-ab45-252ad611e0b5", "value": "24576:q/SRWUxGfRWDREubWm0MLjIGZbDWIpF3ZbS7UgKFO:Ngr6EuR58E5F3uUg2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282845, "uuid": "d1f5fe01-f432-48f2-a516-5e114dbed376", "value": 1175528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282845, "uuid": "f35df87a-bfb1-44a2-8ba7-307533fe392b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282845, "uuid": "5f421d52-0f8a-45e2-90cb-c6186732d85a", "value": "204edbbd9ab906160ea75c77681a47a21f018f18eca0927a901df6fe24fbd532.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5b1010-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774250097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250097, "uuid": "0fde158e-9369-44f0-9eae-c37ccdd9625d", "comment": "Malware payload (RemcosRAT)", "value": "75d772f1e55ff49a9b427956e9b0becd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250097, "uuid": "21cc9fef-9494-4fcb-9bd9-d3b993bc743d", "comment": "Malware payload (RemcosRAT)", "value": "2060843297ed37182ee31e4e94afc86a7821f6493125cdbc6391d28a7f933330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250097, "uuid": "99f8dc8f-d0d2-47fe-8313-9b2f117c1934", "comment": "Malware payload (RemcosRAT)", "value": "3e4f9d389848d9f58c357a9bfd9366462525bd60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250097, "uuid": "d074c9e4-375a-4e37-af30-81cac12964c6", "comment": "Malware payload (RemcosRAT)", "value": "0562f3db86bf6ce075e9f0ae2994e2a23c7d68210d37542cb24c5aad7df96c019956e7f7ffbbab950f21dc38eb46b26c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250097, "uuid": "827ac251-49aa-44b5-85b3-14ace503672f", "value": "T1BF5512643288D913D5EB4BF46B25E07A03B51D8AE8A5D70A5FDCBEDB3972B102C44363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250097, "uuid": "f1dffa31-e815-4344-b286-ddb786abcc1f", "value": "24576:6gZRi/xXIDU8cq9c41Rv5dqfmpMC6X9zr/YgcKbh7LKvAAgEjMJx:6gZRuFR4PqfmpMC6X9A+Cvpg+MJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250097, "uuid": "c8c60a00-8bbb-4be7-8831-abf0861f2641", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250097, "uuid": "67adabdf-174d-4222-bffb-57fbd50bb583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250097, "uuid": "59a13c5a-5cf3-47cc-8ffc-c172966a212a", "value": "Rechnung938894389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cf3ac8-26a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774262865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262865, "uuid": "84882913-cc89-4941-882e-8c16c615ed3f", "comment": "Malware payload", "value": "e8895e1947d289ab3dc1a10d6326fe73", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262865, "uuid": "1c67c60b-7676-442e-8e69-bcbe84294dff", "comment": "Malware payload", "value": "20d4833af9c6c79a3758c5a71c1332966c44783de0070444f93814a91fec5dbb", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262865, "uuid": "a46c394e-61bd-47a9-bc86-2dce888fb986", "comment": "Malware payload", "value": "ece37f38a3079cd0f9416f5e4b98503631c8b473", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262865, "uuid": "60a81dae-9a20-4be9-b3be-52ce80175893", "comment": "Malware payload", "value": "c3002f917c453ff79ab18f95eb8ce5e66ab9067340d714daf9687d126a01d04478038742fca9afd9ac84b9967b59b014", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262865, "uuid": "cbc62b3d-61d0-47fa-b085-d43ebdc30335", "value": "T12F3601257AA2C072D7723130969EA77AE7BDB9309B3542D726E01D3C2E705C2593C26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262865, "uuid": "f4ee2d88-40b8-4969-8a26-316526138705", "value": "edb0a89022b9c14b574f0c2cef13dfa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262865, "uuid": "d3836df1-7d02-4a73-913b-fff6fe2d148e", "value": "98304:lnAQff5+yN0EDi026vPOLGxJJJG65CvuqaYGoDdGgbQyDlSih/FFhCX9wGRyN3d:lL5T1PpJy65CvuH1wdtbQyMKkX9wGmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774262865, "uuid": "b3470e1c-72d5-41e5-a169-3e7768ac2ced", "value": 4974377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774262865, "uuid": "94041bbe-0ced-4d7c-88c1-b57fe29b54e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262865, "uuid": "634f626d-4b73-4567-a72d-ed0992836aa3", "value": "temp!_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47946a39-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774229173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229173, "uuid": "e5a91e6b-0c38-40bc-8e99-ad2371e5cac3", "comment": "Malware payload (Snojan)", "value": "6e48f37fa6638cf71ee982cad9ee534c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229173, "uuid": "d2bab304-5b2e-42b8-aaff-0888039d8b45", "comment": "Malware payload (Snojan)", "value": "213b4441622f118b5b6f5ca29a09f2fa746bdbfd3741082ddb739448c59a65ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229173, "uuid": "4bf736b2-ac49-44b4-957f-876433ba02c3", "comment": "Malware payload (Snojan)", "value": "d45e6f44c980701eb324eccc0400fbb0cffeddec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229173, "uuid": "1a9540f6-b9b7-4a19-b6a4-9c656c43bc53", "comment": "Malware payload (Snojan)", "value": "b61199402d81bd0caac9c64546247004a93111f28954f63d432222c41bc9b16d6e5bdf79a14332db5589e8d8b27ca139", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229173, "uuid": "5e10a78d-9c94-4cc9-ba38-91ae136179e3", "value": "T1D3345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229173, "uuid": "d2327a08-3fc1-4b31-9bd1-ee9abb753b3f", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229173, "uuid": "dd50fd24-a1ff-4665-8986-f2a78d8378bc", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/e/FnncroP9:wwDeM7iNEkgiOb31k1ECgJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229173, "uuid": "f57087a8-6608-44e4-865a-c8776b6ce1d0", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229173, "uuid": "3e203b49-eb45-4581-965a-34583244e0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229173, "uuid": "aecfcccf-6733-4a6f-b302-cbb30ec119d5", "value": "213b4441622f118b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f03e49-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277654, "uuid": "ee52afa8-0afc-4f3c-80bf-61f27be20ea0", "comment": "Malware payload", "value": "7806ba36e632007d6e4f81abfc3e5007", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277654, "uuid": "434e16f2-3200-4966-a29e-398ae5e43380", "comment": "Malware payload", "value": "22bd242efe35e978c208ce3bb0a566f5d3b09628022e9b10f7f1cf3b52c56919", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277654, "uuid": "8c7dee94-7888-4c72-bea9-49e01b42fa50", "comment": "Malware payload", "value": "b96bb31e99453b3dcba71ad1abe89492e62a4b70", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277654, "uuid": "af723cc1-60f8-4cf8-8d9d-1af273167a95", "comment": "Malware payload", "value": "14db2597f8d9259a3c34bcf4db8415aa024b68247f6edd2a008d8e792a5f0f6dafa7b3d9ef08dd6e6d35fabc85a48ed3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277654, "uuid": "282011e0-e2d9-4fdd-9746-7c664214eacc", "value": "T151925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277654, "uuid": "795ee7c5-ea6e-4e9c-8474-240be35d8bdc", "value": "384:RFcuQpWx+BL0SWL0gSzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:RF8i+BL0SI0VzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277654, "uuid": "a2a6b19c-69a0-4465-a51f-be0c893333ab", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277654, "uuid": "2fb0a149-c264-4861-a105-8c6446fd0311", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277654, "uuid": "82f16e4c-2c04-46f7-997e-af7f5169568d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55ca99f-26f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774295150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295150, "uuid": "59db94d2-6df6-4fde-80c7-e770111f2322", "comment": "Malware payload (Mirai)", "value": "6de7989b9828643ab751ba7236e45493", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295150, "uuid": "6ce0505f-c70b-4f33-a6ec-700d1517c78c", "comment": "Malware payload (Mirai)", "value": "234342d1278c527dd9a1b8a08ea4bcc6f295d321a6f80aeaa88088f57718e9d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295150, "uuid": "44fa97b7-2467-4704-b663-803847c4be19", "comment": "Malware payload (Mirai)", "value": "9759696c96ae19a3a273075a454b7302876c432d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295150, "uuid": "f644bf0d-e54b-4a4c-8ba0-1974bbe0a3cc", "comment": "Malware payload (Mirai)", "value": "00e6010fba6879e683341028830c31c82e618fbd5cec63487037684ee175581f60c3048abe408a1b4267e19cbcd339c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295150, "uuid": "c252a3d7-099a-476f-8e18-3e1b794b7959", "value": "T19CC31B15AFA20EFBD86FCD3741ED4B0624DC5A4612A87B3A7674C938F50A58B0AD3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295150, "uuid": "9a618220-5712-413b-9c73-4745fbb55465", "value": "1536:DLvbXqfieziDhTo6D6R0gWB6TmfUlSJ8Nj4sfT/UevZZmB5Af0ROdoYoNdNDYgXp:DLefifDy6D6R0ZwT/vvYRO7WcDml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774295150, "uuid": "30c28575-1e2e-4309-9f39-58e32b085ea4", "value": 119860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774295150, "uuid": "4e91b571-1a45-4248-bf90-beaaa6705922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295150, "uuid": "2d4f8fd9-2d52-4bf6-96e9-26ed4623f178", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831b9cc8-26c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774276947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276947, "uuid": "516b8493-06ba-4cb9-a4a5-c5800079ed9a", "comment": "Malware payload", "value": "cbe1743e9aebd3e3002b2b005deb332c", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276947, "uuid": "64138d69-bfd4-48d3-a164-69a5eb007714", "comment": "Malware payload", "value": "2640fc95373dd299cc61966c2df5ba9e013280ee02944d11bb4d1f70ee57aa30", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276947, "uuid": "cd6d2d06-17e3-4757-a0e9-0f8c18e1b2a6", "comment": "Malware payload", "value": "44068866546ffea6ef8ab8a639c2151b13f9fd6e", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276947, "uuid": "c8ba95de-d3b3-4072-bd28-61c9daa07d6c", "comment": "Malware payload", "value": "4efefc4207bad05bcf2cb319f07721c4d361f8bb96408f2a768f3cab928c5faca96a557a4aef084c22e09302243a4e8d", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276947, "uuid": "034dbe74-0f18-4f74-8da3-09e934199e50", "value": "T1A53701E49DA93D2A28782206937EE59CC224D072F24769A4D4BBD3D19EC761F03F87C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276947, "uuid": "98f13c46-6f95-49c9-ab14-ab173657785e", "value": "393216:dzZShZzxv9YAppTWme9vKeUS2JjWergKhyICWQ2r+GXFf5+2:dIfVvnpMx9vnUS2J7y4+YBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276947, "uuid": "3829a2fa-dadd-49e3-8d50-0161b650e8b3", "value": 23177344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276947, "uuid": "3032fcee-c8ca-4570-ab9e-33282b980534", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276947, "uuid": "3872ffe5-4c20-47b1-8483-22a90e1db32a", "value": "RuntimeSSH_17.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f076a-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1774250704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250704, "uuid": "772f7973-05c5-4f6e-8cb7-1ba323492f68", "comment": "Malware payload (CoinMiner)", "value": "39eca8ca6e06bfe166074f74a3cade47", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250704, "uuid": "2710c7ed-b9af-4cc3-be7b-52e59af4870b", "comment": "Malware payload (CoinMiner)", "value": "268270f48221c6254888ec7b25e9f8a53ec76bfbc05ed424b3e5de1ff6a49bd4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250704, "uuid": "0c4b5b2f-a516-4451-b023-4c19b8a75b32", "comment": "Malware payload (CoinMiner)", "value": "e2cc5a97f5ff5e1a6266a7c1e46f6d5ac20cb802", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250704, "uuid": "c778f5c9-bc90-40ee-bcb2-63bdcaf25efa", "comment": "Malware payload (CoinMiner)", "value": "bf74cf59bcd02dcb9157d0830504561bf87ac590a7525b0cea8b918d6afa9ea28d65b00ebd79e4ab192dd2bf6703a2ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250704, "uuid": "d6a1c5d8-f84d-4f33-aa93-b33044309e9a", "value": "T19F465C07EC9515E6C0AAE2318972D153BA717C486B3123E72BA0F7392F77BD06A79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250704, "uuid": "39c4c198-5f1d-4d15-b4f9-65407122a6a5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250704, "uuid": "dc8b36a8-f25f-4a6a-8deb-3fe4451d86dd", "value": "49152:S8WU6cndwm9OPk92YEIPVbpz66iZCiF4kdbWhVEf/0YxawKeK9KEQ15E:SmOANbpzCLF/deHDwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250704, "uuid": "73567706-3804-4bcd-80b1-b25f823f0fb0", "value": 5825024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250704, "uuid": "823972c1-2d85-443a-8d5d-1f29a19e762b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250704, "uuid": "7b5bf043-5047-4c81-8e3e-ee3cb944e51c", "value": "39eca8ca6e06bfe166074f74a3cade47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7b0ba9-269d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774259195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259195, "uuid": "ea32cd1c-f5dd-4d67-9418-3453263f73f4", "comment": "Malware payload (a310Logger)", "value": "03826c7a1c771799de46fd6e049cbe86", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259195, "uuid": "a80c4a4b-9ee5-4a79-9cb7-f4c91cf15459", "comment": "Malware payload (a310Logger)", "value": "279a7ad5be46888ccda508e413e15f6d3ee37a78c396171b3c8f3ebaf95ade28", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259195, "uuid": "217ffbc9-f5f9-49e3-938c-8651b721255c", "comment": "Malware payload (a310Logger)", "value": "9bfaef30adce96f84802ee9c8427edbd3b653c8e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259195, "uuid": "4d9d6a2b-ad67-456f-a632-00135e039967", "comment": "Malware payload (a310Logger)", "value": "3b6cf392ee4233d7937fcf5b8f90e3a7d1ab61e89c49261968506b813bfe7e5dc5baf66f40ea7712dcea849a025a50fe", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259195, "uuid": "cb07b942-0b8c-4088-86e7-23147e2335c9", "value": "T1C5B5AE046980DFB7F11CBD2E20AE0A5FF362788EE8B7255C6E51FD89061D3E990185F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259195, "uuid": "002f4b59-0b6b-4546-ae9e-b039db3be22f", "value": "24576:w3JrcNxfSTcATIr2r1DutX0LOSYMsUJFop5s/xHZe3fE1dHXCcp11p5M0TzfUTml:wZo/myzXXSYpu6Mb9p1dze05X7IypMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259195, "uuid": "d846dc47-2e9c-4b3e-b06f-4fc7b9964ba6", "value": 2458466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259195, "uuid": "8c33295f-2933-46e4-af29-39b140dfaa79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259195, "uuid": "5b83a113-20ee-4924-af5f-8b31c9237331", "value": "03826c7a1c771799de46fd6e049cbe86.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07d438f-265e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774232382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232382, "uuid": "02d171c7-cc7b-43d5-bf88-89c4be826da3", "comment": "Malware payload", "value": "82682651c950ec33882db420f68d003e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232382, "uuid": "d6b0c7d9-145a-4c18-b7c6-f0f2e9fa3f83", "comment": "Malware payload", "value": "27eea532f33f664a71e953deb1a65592ddb884abde1caea2bc7fcda60875dfda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232382, "uuid": "50e91da6-283f-4e75-ab4c-4f6223874bdc", "comment": "Malware payload", "value": "3a851c1c9e28ef7ba553e88c95e393dab937d4f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232382, "uuid": "fba24570-1005-47c9-9648-ccf544e7d48b", "comment": "Malware payload", "value": "2072a47a7d1f3d66728a3ece4ffa5592139fcfd58262e036dc53b4ac56ddbdbb830235e702343384ab0cff7aec195b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232382, "uuid": "bfb727a9-1036-4366-8e79-f7bf4006c056", "value": "T101B418147FA98A09E180253E454E5618D7AAD1F226337303370AFF624D05DDEEE2D7EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232382, "uuid": "417bc6ae-348a-42ee-9387-e44f9c67ce33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232382, "uuid": "750ac440-b756-43f8-8a3a-2822a0e51343", "value": "6144:zkOJKSWYLJtULYnSaOr1/o69Xp80F/RkNCbQKciDCeoTp+Ty/wNrbVajqK0jncV5:AXTYXxMo6XNkYN4jFheC40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232382, "uuid": "28667d8c-eb0c-46bc-9815-2a13884c1279", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232382, "uuid": "04f7a984-2cdd-403a-9380-75a524a40a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232382, "uuid": "c1231b61-9408-4891-b5ce-1f2548961e3a", "value": "27eea532f33f664a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1bde7a-26d3-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774282711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282711, "uuid": "3ecf5b7f-fe84-409a-8bc1-b6b01bf86ace", "comment": "Malware payload (SnakeKeylogger)", "value": "05efdca9e8b3d881d1ebdaceca847767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282711, "uuid": "9a246138-fc2f-48e3-ac55-2a13136ed458", "comment": "Malware payload (SnakeKeylogger)", "value": "2804023cb811e89cd1fc6bec5614a689929a3c23f68939142176c7b2fbdd4b9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282711, "uuid": "b1daf285-59a3-4481-9814-90e3a1908b87", "comment": "Malware payload (SnakeKeylogger)", "value": "072a5bcf3642e64be1a5d124bf22698b3efd3ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282711, "uuid": "ef6ab8f6-6ece-4bf9-b9eb-c267a6d1a462", "comment": "Malware payload (SnakeKeylogger)", "value": "f69364ee62c4498656842fd160b999fbcd5a2cf48440e27bd6456e4de23948e3cf7add1e9ed7bc7c807e578bde3d2e11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282711, "uuid": "e5609d5e-37ff-45ab-84c3-9bd629f5fac0", "value": "T1A1250219B298CA02C5F7A7F92BB1E07A03B55D9EA461D74B8FDE3DDB3962B005904343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282711, "uuid": "03917d15-d616-473b-b021-dfe4de299a29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282711, "uuid": "31eb6bd5-49ee-45c6-a4a6-7e7a1bfca248", "value": "24576:VlL5eMJyMWgcm7ShRckwBh8IWC31Sy1D0v5U811FNQ:VlL5eMJyfgH7cEBhJWC31nqUwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282711, "uuid": "c334f242-ad36-4d2b-85a9-2b03fba48e64", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282711, "uuid": "5b1ccd26-6dbe-42ae-8bd7-3a598c5888ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282711, "uuid": "ffeea363-2c6a-400e-9ef8-f0dc068674a8", "value": "MV ZENKEN MARU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0f19dd-26e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774290737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290737, "uuid": "f839a693-9de4-4254-aa56-0b5cb19f05a3", "comment": "Malware payload", "value": "58e0d7679c6968f5e294b5fac26bee71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290737, "uuid": "5ad03edb-dfa4-4d19-a440-00a7270959d2", "comment": "Malware payload", "value": "28c18829d918fe59f24b866ec40878ca11deca0a137aacb5cb2a582bb5b9d08c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290737, "uuid": "8bdd80a6-1759-49f4-b7be-e1c5b0bc746d", "comment": "Malware payload", "value": "8575df9c294f110ebd19312cdbc28bd8105fbbab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290737, "uuid": "3e5cbab9-5289-44ec-bb5d-53d5fa4792bf", "comment": "Malware payload", "value": "55438b4ce41eafb16621c5012ea1846ab4d2f68caf2f0422574fe38c4bd5bcf64b27bfc23b08d2a73214802d453aab3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290737, "uuid": "0fc7c808-76d3-4939-b7ca-9eca937c08a4", "value": "T148D623ED819413E4D8E30A80768B53DE7090616E45FE8C2D3AD62C416B31DBF664EDBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290737, "uuid": "6ab06c8b-dbdb-4c2f-8d1b-0d564000003a", "value": "63b62ab27b711ad483853cb2121799a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290737, "uuid": "07a690c2-b936-4412-8e64-3e48b4456eb1", "value": "196608:Sldo6lCJR41cFlFm9p65mS7SdI81s0dctVn09h7UtVkNBIDrlj2a3:Sldo6AP4gFm+5mSIRmt509h7dwDhB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774290737, "uuid": "233f40f0-e0b0-4569-8798-edca5703df19", "value": 13661160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774290737, "uuid": "e5d35f75-b16b-4a8b-b548-5de8255c8f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290737, "uuid": "aa0db450-58d7-4cea-82f6-cf3643960e49", "value": "KiddonsModMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720e48b2-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250719, "uuid": "b166c2d8-868c-4eda-abfd-19840c1671eb", "comment": "Malware payload (Vidar)", "value": "7ce101cbfa6ceffd4ea619cdfae6b7b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250719, "uuid": "b347eaf4-6166-4f19-b5e2-debbd53db5f7", "comment": "Malware payload (Vidar)", "value": "28d7760af0252dc178b1dd46e0c591940c37f777e3ad3338ee942c9cc8a56825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250719, "uuid": "4a5a9c14-3543-4087-b020-18bda97af529", "comment": "Malware payload (Vidar)", "value": "9bca49e9ada6896be8da4fc8dfd5cdc90d276b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250719, "uuid": "92f8652e-bf12-4d53-85bb-0a9ee3607cec", "comment": "Malware payload (Vidar)", "value": "ed2e49299cdb8fc80a2cb1e384ba4e5c348e73cb1e97fc5b9cdbd4ae27b50689fa4d2a05e1e187269d751cf07e271f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250719, "uuid": "6ced5e8e-9e33-4a1d-ae2e-7699feb50ffb", "value": "T17DA57E07ACA109FAD45AA7368CB761917B71B8480B3333D36E90BA782F767D06D78744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250719, "uuid": "c4495f2f-3918-47c8-9505-9a67127558e1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250719, "uuid": "47b8bbb0-5ec8-453c-9539-5fd9048a8e61", "value": "24576:Y47XPFOxCkYyTwO2MyiXZn1MoD70vX3f/YO0V1H/7+JHEdsFhele5n923bfk:Y47QxyyThumqo8/3V0V1H/7+JHJcDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250719, "uuid": "f63bc3a9-02ed-44e6-93c7-b5c20c5dc2a1", "value": 2232528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250719, "uuid": "337de0b5-274a-48f1-887e-7b9790212613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250719, "uuid": "3273e56b-ef71-4dd6-9761-9d075a68a479", "value": "Bootsrlapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e358c6e1-26fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774300730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300730, "uuid": "2a2bf323-36d2-48f5-ab13-12aa3b3ac468", "comment": "Malware payload", "value": "d0deaf5edbeda5a78c6d4b675ba8ff78", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300730, "uuid": "d7903dda-b4df-48ca-949b-53f9ab606d5d", "comment": "Malware payload", "value": "29251598ef3e4a68ceee65defebaeb53f6533827b5cf39b242b75e41fb46b7ac", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300730, "uuid": "02f23a1c-b2a6-4002-a4a9-3ea24a5a52aa", "comment": "Malware payload", "value": "6a3fb6be75661476517e3156a9c24620a903fb26", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300730, "uuid": "d5209fcc-8d94-4885-a0f6-8b8fe62c5dbf", "comment": "Malware payload", "value": "37a7f28ac4eb139f3fd1d6fe4de7e0daa426065c0720e1ee74af5c2f80118f203fe32b95d65bded80f2a5d2ced205dec", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300730, "uuid": "7c5d6360-f7c6-4e54-858d-0f2773d0ef9b", "value": "T17667336CFC66ADC3DFA9B07D99A4A3919EA20CA6C9000B411D38F35C3D727CAD785197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300730, "uuid": "c3636db9-adbb-4932-8ebe-4162b596ee18", "value": "786432:e9ugPq7oZ5ZcKZ5gQ7pWuJcA1P59+Ltz+0jBepYjol55a:AdPxZ6QdWuH1hZ0Nxjol5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300730, "uuid": "708a54dc-0a6e-4a2b-9038-5dc2e0b4c577", "value": 31203238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300730, "uuid": "edbd6898-a8d5-48ee-be59-0d458bb20952", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300730, "uuid": "d5ab7c35-3490-479d-93c7-7fad06b3dd8a", "value": "Node_Min.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457558cd-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282856, "uuid": "60135cd2-0df7-437d-bdeb-3eb0b73b97da", "comment": "Malware payload (Mirai)", "value": "ad307312dd9475791be8840abce15823", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282856, "uuid": "8da0770f-8be7-45b2-86db-5394fd17f3d4", "comment": "Malware payload (Mirai)", "value": "2ab6cb64f05f18b482ace03e7f41617f28bfdb8e54da7070bc183a661f104e56", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282856, "uuid": "6c39f151-b3c7-4cf5-bd22-525bf310fd70", "comment": "Malware payload (Mirai)", "value": "b356f9a0aa941d2b4c8388591b6f03b586c60fee", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282856, "uuid": "dc61eb6c-9fb7-4557-b66a-1b528ab46243", "comment": "Malware payload (Mirai)", "value": "2a9ab0527746d26b6964b2acb5d0fb4e0e6f5bb9f5dae01f19fe8cd46251e7b3359bcb717d31c918cf23eff1c4fe4f24", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282856, "uuid": "94df3832-943a-4e22-a7c2-02a2a9d4a56e", "value": "T1A2243B8AF9409F16C5C226B7FB5E4348732257ACD6DA7102FA196B74278B99F0F37240", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282856, "uuid": "32d85668-1300-4b9f-a413-b810aeae1ee6", "value": "6144:eiTLt90hKY/ByFQHe7G6QIT/Y9HWpuDRAJA6:eiTLMhi2HOGzIT/CHeutAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282856, "uuid": "73e73020-b5c1-494d-bd9c-299f8738aa8a", "value": 221664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282856, "uuid": "4eed97d3-21d1-469e-b083-42e50e6fe7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282856, "uuid": "5dd56e50-de12-44b7-9dc9-92e01905ed0a", "value": "tcc_arm5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb134642-26ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774292529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292529, "uuid": "869bcf2d-7ea6-4b6c-993b-274ef76ac2ed", "comment": "Malware payload", "value": "d56dda37d9e9e245887d4e4a43f4ef3c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292529, "uuid": "e69cb767-8fc5-4781-ab74-37d17da7fef4", "comment": "Malware payload", "value": "2b4305e8d52f7ed314adbd6fc345bbc914b2f0ded27b034cb9c9b07c2c4966c9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292529, "uuid": "60d999bc-216b-4496-9b99-dc6150f72b6d", "comment": "Malware payload", "value": "8311727356ce17e748bcc5478bd3aeba9fafd9f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774292529, "uuid": "f8db70ee-ca77-48a3-8e28-cfe8ee09b839", "comment": "Malware payload", "value": "87dc94232fd826cfedb2c9d5f210ec4fd4e546c00050daeefef5e1c228f870fc459f4e677b86601967652854ff47b02e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292529, "uuid": "f8d910ec-1fda-4be4-aac3-fbfc9e65f0b2", "value": "T15A925CB512896C79FBD0CE399F3C7F4CADE882C42124A3ACBA4F3D215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292529, "uuid": "daa7ffcf-045e-4380-9f6a-cca44692fa04", "value": "384:qFcuQpWx+BL0SWL0gdzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qF8i+BL0SI0qzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774292529, "uuid": "68742ddc-e258-447d-90d3-d61bb75f8128", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774292529, "uuid": "b08b13e6-eecf-4034-a13c-e24aefa7eafd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774292529, "uuid": "5ee5f024-16de-4165-8b09-a6a02fa6243b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fe09af-26f2-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1774296010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296010, "uuid": "9ba29ed6-4b5b-45f8-b048-2b0e9ebc31f3", "comment": "Malware payload (GuLoader)", "value": "25d83a555f662ac46ee8a4f6a1824137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296010, "uuid": "ac7a9f6c-7f2b-4296-a631-5a349cd21c6a", "comment": "Malware payload (GuLoader)", "value": "2bb3924ac13fbbe690c44e6c2207117428fabb4588099b84db66a0203ca00ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296010, "uuid": "000600ab-647a-4e04-b294-2153db45d6de", "comment": "Malware payload (GuLoader)", "value": "6f0271fcdddba2037cf119041fa0d4c944d3aefd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296010, "uuid": "39fccd4c-2d91-4239-b1d4-29bae17641c3", "comment": "Malware payload (GuLoader)", "value": "18e416a4a3114c25e0954e23c93b3e79a250a2cc920f0b59d978946134d0a362b63eb08a6dc6589e4c39ed6a5025ae65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296010, "uuid": "3c195afe-265c-4b3d-be7a-7e87fa2dfabd", "value": "T1DFC46E2564014041DA0F1F71B16D97A67923BFBA297CF21E2A3AFBD626F72C2D13614C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296010, "uuid": "daae9657-c04d-4a6e-b4f2-3ba5abb8fc75", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296010, "uuid": "0c00640c-d213-4a55-a58e-01f8517e8e86", "value": "6144:SYa6eJsYMZ4YdvJe+ECzk9WT+z1WyMGjhm9d6HAkbQFqTaHXxSnbrHE9+I1:SYEJsB4YxE8/CMyXhK2scTa3WbrHE9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774296010, "uuid": "7c6deac1-0c9e-440d-89ae-3eaaf1ec8e2f", "value": 551376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774296010, "uuid": "a96b9e43-3125-45ed-ae16-a7688562b2c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296010, "uuid": "2e5fca75-9e9b-4626-a0e6-0bfe7e233707", "value": "rSPAREPARTLIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36ada40-2682-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774247929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247929, "uuid": "46d3aebd-494f-4fd7-b969-e63e6b38f2f4", "comment": "Malware payload", "value": "d731c8dbb66006db0c2a2e55bb9cd5ee", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247929, "uuid": "b389dd41-b9bd-4be0-a485-a7a79c64d968", "comment": "Malware payload", "value": "2beb1b5c09a3d63dce6b4fcb51354103f90ecc74f1e565026a6629433686d919", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247929, "uuid": "beba59de-df0b-4f37-9f66-cfd6578c75f7", "comment": "Malware payload", "value": "6bfe5bc40190fb9d6c0770c1e30cb70e3f04ed77", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247929, "uuid": "d5be72f3-11b4-4463-99eb-ca4026fafbff", "comment": "Malware payload", "value": "60e7a7b8ec0b183b418009259c239e42f5a31676f043f3c64f97d8ae1cf51bc266cc286ee567e0f093d2ebb437679ecc", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247929, "uuid": "93ae96cf-c6f5-4989-90fa-62f1a8963a9c", "value": "T19BC3F0DF098E88DC858E5458571E6C27CACB0213CE5DD59039EFFE853F21EE560A6AE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247929, "uuid": "69485964-7f8f-40eb-a0dd-265200b8fee4", "value": "1536:rqPv0NLEDIG1aIfxO2Ifj5rwftC8xkC7m3:rqPMNLEI2aIfxO2If98ftC8xkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774247929, "uuid": "8607bb61-e6ae-4b15-b47b-d70942e719f4", "value": 118366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774247929, "uuid": "70999a36-f812-4ca3-9386-ddf28464dbe7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247929, "uuid": "9ffdf76b-c3a3-4573-a36e-0388cdc99f9f", "value": "Gamma_Photos_Europe_6773.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e7d5fe-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242321, "uuid": "2884e779-caf8-48c4-88b7-fc21ad0b0972", "comment": "Malware payload (Mirai)", "value": "9df95ac0d9b2d5e9343349f6663accca", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242321, "uuid": "0e5bdc67-2f8f-43e8-a77f-bc40b3421be8", "comment": "Malware payload (Mirai)", "value": "2bf9c9135e276fa747ac5c29f51b8f2d035613d0dadbda57336bf52b5d3dcb7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242321, "uuid": "17a4b135-081e-4e18-abff-ecee1a111529", "comment": "Malware payload (Mirai)", "value": "f3906b8cfbe31d1d934ac477a2d080428d4bc185", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242321, "uuid": "45feae88-4d23-4764-b03f-eb959245abf0", "comment": "Malware payload (Mirai)", "value": "f928ccc7336318dc29ff12c122535e362a46e6fcacf89b98e4cdb8eba580b38ff452e33cecad3e8f6377ef9e326951be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242321, "uuid": "6939b452-dff1-4560-bf74-079f3f160c01", "value": "T1ACC39DABB24F1051C82647F41BCB579C2E3325019E2B9AE77C6E373E1A369DE58063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242321, "uuid": "e8da86fa-64ce-4f3a-bb78-1f1d565f8abf", "value": "3072:wf0GQgHfg5nBR4YYSOxTKB6Aq7mgbgiCrheiiU47qe:wf0tJBR4NSALD7rnCrheikqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242321, "uuid": "48717283-170b-4bef-869b-11e1e79c7400", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242321, "uuid": "4f9ebec4-bde8-4e07-9bd0-94202416f370", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242321, "uuid": "0579df91-1054-4c2a-95ed-33ee22f0a743", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9930b1b1-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774232316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232316, "uuid": "330f76d3-eb25-4864-be50-d389568d5b9c", "comment": "Malware payload (Viking)", "value": "95421f678c5e323a06479ab2333dd979", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232316, "uuid": "f3b63b1f-36cb-4f60-8739-709a25fa8613", "comment": "Malware payload (Viking)", "value": "2d36fd995068ae22a9fbf24c80ea919f4c6953085094419202c017483fe4aca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232316, "uuid": "b98ff5d1-3c25-44fa-aa85-4e28c9117655", "comment": "Malware payload (Viking)", "value": "e27b496b01c1688d059066f4e1f5b2b75b260936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232316, "uuid": "447b0866-166b-41f6-912b-cd147e83b7b5", "comment": "Malware payload (Viking)", "value": "f5593e53d91c9ade68e99211beef0290ec7643d9fa2d1783af3a8cf9a57e81ae91aab7ffc886bec24eae47c81cfebb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232316, "uuid": "000b451a-e692-4a3e-ad06-01372164cacb", "value": "T1D625AD1B6FFE48E1E486413554A70FE2A5F4AC21BA21C74AC3B0756EEDF4390F90CA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232316, "uuid": "e4b4b0a8-1742-4914-b209-098bb6f91773", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232316, "uuid": "f8da429a-18b6-47a0-ae68-75a0fa6220b0", "value": "12288:SjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiQ:JuuuuuuuuuuuuuuuuuuuuuuuuuuuQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232316, "uuid": "fe87b88c-5785-4094-a8d0-33711a4b954b", "value": 1013396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232316, "uuid": "e865d9b9-dbef-45e7-bcf3-34681f3a1dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232316, "uuid": "ae634142-7f0b-4139-9f0d-04f38304a104", "value": "2d36fd995068ae22a9fbf24c80ea919f4c6953085094419202c017483fe4aca9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775cf680-2695-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774255881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255881, "uuid": "15ad5815-c006-4b57-b2b1-314f54f18c3b", "comment": "Malware payload (FlyAgent)", "value": "2a198d8e8955e9c8c637eee18e8e7c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255881, "uuid": "4e40bc8b-59a8-4a42-9451-7a2f914ba9cf", "comment": "Malware payload (FlyAgent)", "value": "2d382ab0769b9a78234a05e5edfec7c62b92d85035f0d768623a1aa8f9d785b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255881, "uuid": "a426e285-8ddf-41ac-973b-226783a6a701", "comment": "Malware payload (FlyAgent)", "value": "87814d4a0e13a8b3163ebfca08bf080fcffd4e4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255881, "uuid": "5b4958e5-4d1b-4b37-a65b-243668ca7a40", "comment": "Malware payload (FlyAgent)", "value": "f6b4ae14303c8e53084e417874369daec3b0b6d83868e19ef92e4d31cf741705c40bbc063c42ddf711a6665ee4478cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255881, "uuid": "b6ad8874-fcfa-4502-9f0f-fc672523a3fc", "value": "T166557C13F692C0F1E61C227124FB6339BE7497450A71CACBE794DD791C32691ABA720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255881, "uuid": "a6d162fb-174d-4da6-b3e2-df9373c2ead3", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255881, "uuid": "6a177e00-6047-410e-a240-e28246d8f234", "value": "24576:WBS9qQEK6QywlBqH82QoXFkrzkmmlSgRDko0lG4Z8r7Qfd7iu5l:WZaClSFlG4ZM7QlVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255881, "uuid": "8c88991a-ec6e-4ceb-89bc-e9095c0f4e4f", "value": 1378532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255881, "uuid": "b25ae9f3-cb7b-4e30-b0c8-48fb5424f8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255881, "uuid": "c8ba80b1-7e3a-4211-8f7c-ba88a808b91b", "value": "2d382ab0769b9a78234a05e5edfec7c62b92d85035f0d768623a1aa8f9d785b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff476b3-2686-11f1-a769-42010a9c0008", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1774249588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249588, "uuid": "ab41ed80-dfda-4939-bcee-4408d453bfeb", "comment": "Malware payload (Adware.Techsnab)", "value": "a19382f26c018617785086dcd9311b16", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249588, "uuid": "171b8cc3-2b33-4105-ae85-147edaa4d602", "comment": "Malware payload (Adware.Techsnab)", "value": "2d686d98148d3560890480337c70f5386bbc9342e74583dbccfdcef87da33687", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249588, "uuid": "072f2362-0c69-469e-b2ee-3d145a62b729", "comment": "Malware payload (Adware.Techsnab)", "value": "39ef147ef311cc1ad69c1253afbed859d6f2d86b", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249588, "uuid": "c89be01a-67bb-499f-a6c7-ceccff2dd208", "comment": "Malware payload (Adware.Techsnab)", "value": "7d2ba3d5dbe02a4cc72f7cd485952433c61f16534af784e9910d011fe3349d9dca5250a42c13557f6abe68bd0cf827d9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249588, "uuid": "a27fd3ee-4426-4d14-84cd-4a3f1c6acd5d", "value": "T1CC43A6E70F8CBB2923472F50AF0A078510E9D5F2E8D7E8BE52A757484431527E39AD2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249588, "uuid": "421d7eb6-df48-4db2-8797-ef29f2441ed3", "value": "1536:afm37V/oV/gc2ggJN8qMF6OQWEU9nMbWAjkLgc2GJrMF:Hr8gLgvPcE0SMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249588, "uuid": "0ee653ff-eb45-4a0e-ac4e-76848c71bd92", "value": 55240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249588, "uuid": "88fbc04e-1914-4d3a-8fa4-cd5f75caa2fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249588, "uuid": "7abb8002-cc53-40a4-989e-f7d80208f265", "value": "2d686d98148d3560890480337c70f5386bbc9342e74583dbccfdcef87da33687.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a4493d-26d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285088, "uuid": "8b7505d0-c5f5-49f4-9a16-2c63be33b801", "comment": "Malware payload", "value": "0c9f8fda8d912353c550ad23fddc0523", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285088, "uuid": "a4f0eca9-c8ed-4748-a3b4-d4667f0d87c9", "comment": "Malware payload", "value": "2dca60a0f08e79e4c6851bc2253e95ac193f16183d2265150000be136f0f247f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285088, "uuid": "c1fb8788-b49a-4188-8f8c-c3fafce9b4b3", "comment": "Malware payload", "value": "3fe3ab94d23ee2765ceeebf8c0d35dd4d48738c1", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285088, "uuid": "d3f745b5-bdb8-4365-b0ae-d9984474fc33", "comment": "Malware payload", "value": "1fe8da0eee70f4778e7c852fb781199978af5c5ab64859086c931cc96914c43327175a944460ff1e3f4e5c1a80e278bd", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285088, "uuid": "3d13bc0a-21b1-41df-82ed-f02e44e96660", "value": "T1083701E49DA93D2A28782206937EE49CC224E072F24765A4D4BBD3D19EC761F03F87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285088, "uuid": "476a2711-474b-46f2-abe5-1b7bfe2ecef0", "value": "393216:jzZShZz0v9YAppTWme9vKeUS2JjW+F1LHi5kkE4Ff5+u:jIfAvnpMx9vnUS2Jt14BR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285088, "uuid": "3f6bfe98-70ee-42bc-9293-5aa2d099d108", "value": 23178456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285088, "uuid": "60081a92-4f57-4e80-99e0-e829d8779772", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285088, "uuid": "51b6d482-2d07-43ce-b6c6-81ead508363b", "value": "2dca60a0f08e79e4c6851bc2253e95ac193f16183d2265150000be136f0f247f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9ea56b-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774258039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258039, "uuid": "78441d9b-a613-4de1-9c79-28784c33dfaa", "comment": "Malware payload (WallStealer)", "value": "2f08d72708b5063604c552c88b2cbaac", "object_relation": "md5", "Tag": [ { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258039, "uuid": "cb4185d6-0577-4add-aff7-8bb04f492252", "comment": "Malware payload (WallStealer)", "value": "2ddffe8a65220de0a64597307c217ebf34957ea9e810e9139136b43e0e1fbb88", "object_relation": "sha256", "Tag": [ { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258039, "uuid": "5969f7ca-2b87-4430-b71c-847c0aab0f8d", "comment": "Malware payload (WallStealer)", "value": "c208af6437182ce171b1fc17be3eae4cdc106b2f", "object_relation": "sha1", "Tag": [ { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258039, "uuid": "397a5f7c-9ceb-4c9f-a2ec-15f94527d992", "comment": "Malware payload (WallStealer)", "value": "8797f777c50ef3766e97b3356679bef61a95b099a55901995fa9e195be5d3e61ed5ffab37e7e06e161bb6d43128a4402", "object_relation": "sha3-384", "Tag": [ { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258039, "uuid": "8a776966-3855-44b8-9b67-3a3b4573ece8", "value": "T126063329F4523112E85AE6F519B01E9113F28DB1022F4BD41278B59FDE73F6CBAB4872", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258039, "uuid": "223c75cf-5711-4c28-9fe1-a14ddf36ca7e", "value": "98304:YKH4Nb1s4TBdPBZ6MNlrL/Ock6SzoVNpCEv+g6xUc:YaJ49TJlHOcklepCM+g6xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258039, "uuid": "f7567a09-015b-4312-8225-e49db8aab84a", "value": 3835104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258039, "uuid": "4e4cf55a-5e3b-4ba0-879c-75537fda2759", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258039, "uuid": "171bfdb5-b0ba-48fe-ab99-eed40677ad3c", "value": "2ddffe8a65220de0a64597307c217ebf34957ea9e810e9139136b43e0e1fbb88.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4fc7cf-2656-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1774228781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774228781, "uuid": "f9d46653-ac05-4e4d-a564-2fd989e31749", "comment": "Malware payload (Joker)", "value": "a89c1443e7aeffa61355114457089ec2", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774228781, "uuid": "9c78dc7a-e307-42d6-b7bc-43a26f0f7582", "comment": "Malware payload (Joker)", "value": "2f5454633c80c15f88bbf90d265fb8dc110ea79836de16d8c680b1380f163dae", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774228781, "uuid": "c96810bf-d0fd-43dc-a1d0-8eb98098a8ff", "comment": "Malware payload (Joker)", "value": "81d41ccd67683e6b4d275a8dac2770b33e595ba3", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774228781, "uuid": "6719094c-2f99-41a0-b91f-dc20a2d7640f", "comment": "Malware payload (Joker)", "value": "e45ec8adaac32a89bbf89e4fbfcba16944b6cb5d5d91b7a4d47b7b607878be5c873cfdc7ece6b61d698c5381a40e87f5", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774228781, "uuid": "3f2e934e-94e1-4314-a07d-b6d1ef4a7a04", "value": "T1A0972309FB0DE82FDED7B07C8E6A0252626634DD4210C36B6921D21DFE936D54F2ABD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774228781, "uuid": "625aad3c-b668-4497-be79-3760a539fbea", "value": "786432:UuPjKKpfjZiePS/3uEjvjUlE4OiBtEZwAHQKb5KRdhMFfy+y:T9pfjvPSt0XtEZ5HLUjwfy+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774228781, "uuid": "fef2c868-a7c6-43a7-9fb0-25736f7f8236", "value": 39915711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774228781, "uuid": "c57aaadd-5571-44e4-a9d2-a72fc01abcbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774228781, "uuid": "dfd414b5-0c63-4563-9c00-92246e15007e", "value": "com.warhaw.fastclean.peter_1.1.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5f2164-2710-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774308616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308616, "uuid": "63c13d2d-1999-4338-be77-49d1f60b95ec", "comment": "Malware payload", "value": "ab20cebb03f09b8a4e37f7795092f61c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308616, "uuid": "68d1e1ac-f403-4433-9e5b-cadc9999ee39", "comment": "Malware payload", "value": "2fcbb3ae05059c9062052094dcd23d513d66a3950bec0b7aec9c4294e9d3a4e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308616, "uuid": "aab196f7-5847-4a0f-9423-75067147143e", "comment": "Malware payload", "value": "5ac817e7d1e48f9c4c5d066e7f0aa5cebcb91129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308616, "uuid": "9ab05fd6-d076-4ffb-9df2-95daa02dc315", "comment": "Malware payload", "value": "041702dd94ec807559ec3efe2378059892938b6ddb78b01793c973050cbc92676740407538acc9ad288f4214a3b17079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308616, "uuid": "93f31d4f-f344-4e6c-a6bf-9585ee596233", "value": "T1A0447C57B29156FCD559C03C83569173B676BCCA02216DBF02E4EA303E6BE252F2C729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308616, "uuid": "0fb7a588-8e27-4c38-b929-95e174ae709b", "value": "ff8aaa4522ef34d544e2ae180c4ade8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308616, "uuid": "15a22f00-44e9-4ac1-b56b-bcbca2e0539c", "value": "6144:01vsAVze8H/Vd5ICR+34pxsmu+SHWOHfwV4aemP9Cf:+DKqj5S4pxs+SHWOHNaeE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774308616, "uuid": "5919f8f9-54ee-4f49-aaae-53f61598b9ea", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774308616, "uuid": "d4c8f0b4-d657-4561-b15a-91317cb2922e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308616, "uuid": "f788fba1-ce3a-4a9b-8dcc-da3958bd21ca", "value": "rust_loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a07f1e-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774229193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229193, "uuid": "5c27acd2-c37c-4a67-81b8-88f60d689b9c", "comment": "Malware payload (Snojan)", "value": "61661e8bdff76cc3d0e44ee9ccd5266b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229193, "uuid": "db464e65-4bb5-4e9c-a9cf-a327e12faaed", "comment": "Malware payload (Snojan)", "value": "2ffd17aa46fe5d7ab8c1d6d46a4f6c9baf0600e22c5991e474b43c9552f83a5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229193, "uuid": "2a118155-5b64-42fa-8ef1-cb733fd1db30", "comment": "Malware payload (Snojan)", "value": "195007128608dccb029ed630af4585d22705c19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229193, "uuid": "ef28032e-a931-4444-b6bd-c4bd1e032ebf", "comment": "Malware payload (Snojan)", "value": "1638b2cab1135b88354c0ebe9d45dc45036ccda051f7fee7ecac66b998524ce335ce5988fc9463fd1ddc74f09f13aec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229193, "uuid": "11bc2513-ef72-48ed-b525-18df5d176602", "value": "T149345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229193, "uuid": "f44f137a-f8fb-4cd2-b9bb-9e537872bfa6", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229193, "uuid": "648efbfd-efea-4fe7-9cfe-7ad6beba713f", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/R/FnncroP9:wwDeM7iNEkgiOb31k1ECdJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229193, "uuid": "90deb6a7-0fc8-4edc-866e-53ed7c9b9142", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229193, "uuid": "6d98f76d-fe19-4676-be73-939f5fdedb45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229193, "uuid": "ba3165bb-56e2-463d-bb54-d365bdfee537", "value": "2ffd17aa46fe5d7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1ac111-2688-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774250168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250168, "uuid": "87af1214-cb0e-4f5b-9a5f-914a35864ba1", "comment": "Malware payload (RemcosRAT)", "value": "6a93d36d434644edea42485c7ed52e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250168, "uuid": "8c034f5c-9a55-443c-8d95-97dc7e1e6d4d", "comment": "Malware payload (RemcosRAT)", "value": "303cb96b7e8f6c0e6f41d4cb1683ee22093a9efb4031f900cabf56b88ff830e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250168, "uuid": "5f0a4df2-b567-4e3d-9433-87688e3ee9c8", "comment": "Malware payload (RemcosRAT)", "value": "91ffa886579a1480ad9fd4737e77535f36f3ea6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250168, "uuid": "fca34598-a104-4956-ae4f-75ce16485d82", "comment": "Malware payload (RemcosRAT)", "value": "55d39d92514b82c64f4dc71bb27e6232a8aae465b06571a1ff1b7676bebda0910aecdbd7d15106141991e676b3ea28c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250168, "uuid": "91201fa9-4f50-443e-9383-548043864cf2", "value": "T104C4221436EAC447DAD20F7019DD56A76FB1BE62066011072714BFEA7F3C1D36A0AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250168, "uuid": "f817af4b-471e-4c73-97db-c16ae50c1662", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250168, "uuid": "4caed992-45e6-4fa2-8e4e-4a2747c270cb", "value": "12288:XgiOOe5cWM+IwXU8fH2mdsSuq3H0kAwX5smGmxW+i5xvSQtStX5YpVB:WOe+a3XUPmsSp0twX5tAxvLttpVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250168, "uuid": "1a13f6f3-61e2-4d95-8554-6554263ffeed", "value": 554440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250168, "uuid": "f708d534-fb34-48e6-9d27-2611f7e4d30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250168, "uuid": "36736114-2fd7-4ccf-80c7-5be076061790", "value": "Communed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "468c1e5f-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774266107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266107, "uuid": "85ad2a92-a405-4dee-b98b-e07d9078e7c8", "comment": "Malware payload", "value": "5e57f676016ef898e4b1e16d2f3242d4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266107, "uuid": "c0fc1e5e-f602-4351-bcd0-6436c44950f2", "comment": "Malware payload", "value": "308fe328373161a158813f92197b2a0dba67753abe1862e20adc5e8ed4585408", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266107, "uuid": "7cc0bd8f-8591-49b5-a445-5c1d6831d8e4", "comment": "Malware payload", "value": "be517f3870a09bc5267abbd9dfcd23e2bd16d4e7", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266107, "uuid": "d672f74f-e719-4c17-ba8e-970c3d436cb5", "comment": "Malware payload", "value": "1b4e6b3fec6f64ed06333ca8044a1628c29638d5fffba7f342ea0025dc2129a1387cdf98de372d8f74aa9add8010702a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266107, "uuid": "70eb9082-e581-40d0-9c4d-c41069fe3717", "value": "T153B5D97BCA6D8B4F024657B54B8686C8EA7DB5F122ED76ED4B14AE70434A3844FF4C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266107, "uuid": "aab312db-0b22-42d3-b84d-1503713f6523", "value": "96:cAAzRvztw1uJA2WwMxJMQyzj8/NKuiDkcVfqG0+rEUDO3LvVFqb6zgbg4h/Jsn8r:GRtwcJdWwEKfXcrFzuOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266107, "uuid": "b5449ba7-046c-4548-9194-59680cf8d06c", "value": 2347562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266107, "uuid": "f10f8b96-a0d3-4097-89b5-7a0e2986d93c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266107, "uuid": "f4a5de53-b0dd-44ce-9944-228219848b61", "value": "23031114.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777be5b4-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250728, "uuid": "467a179f-b179-4e8f-90bd-c2d04ff9c4c3", "comment": "Malware payload (Vidar)", "value": "47302c17ab41311b82aa5191c126694d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250728, "uuid": "5f18fc15-d76a-4e6b-881b-41c70efe24fb", "comment": "Malware payload (Vidar)", "value": "31dff78033cc317ea51721bedacf6b720ea5a742bb2175d8bb2943a76b9a6681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250728, "uuid": "579e472f-c713-43b6-8184-1fd4aff746eb", "comment": "Malware payload (Vidar)", "value": "4ea3c82a9660e44e799f7d51779400e9fde20b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250728, "uuid": "e0b6b788-a9a9-474f-8150-47e59739a4fd", "comment": "Malware payload (Vidar)", "value": "395608ce6c01bdd3a16fbf0d52e49ba4fc819c1aaf5ceab8b154adb7fdd9360f755e43004ed6ac287e9209b82014f73b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250728, "uuid": "372e7855-8f2b-48de-8417-963548f550eb", "value": "T1E6A57D07ACA104F9D05AA736CDB662927B71B8090F3223D36E90BA783F767D06D75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250728, "uuid": "de7ecbba-eae1-4326-8e32-2bc7fcf8e37b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250728, "uuid": "3c403315-22d3-49d0-8add-3ff29a5ae41b", "value": "24576:L7rF66odGiOjCW466u9l6a0uh5NPauqBJ8jDEp2pMIasFhele5n923bKz:L753ozQCt7upVh5NPPqQvNfcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250728, "uuid": "fa976000-4c45-4125-9811-bda844ee6f9a", "value": 2221776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250728, "uuid": "3f6615a1-98b3-4771-bd7e-96a090d82ad0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250728, "uuid": "bd59b6e3-3bd1-4757-b557-e40e2b44f40f", "value": "31dff78033cc317ea51721bedacf6b720ea5a742bb2175d8bb2943a76b9a6681.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c9aadb-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249592, "uuid": "b6ea3300-e3b8-4c49-9f63-3efb1c8e2198", "comment": "Malware payload", "value": "a8ed5d6fe4218b0fbf9be27f18ca26ba", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249592, "uuid": "1cb03d61-d257-486c-83e2-b29e76de8cf1", "comment": "Malware payload", "value": "33252d0a8bc81574347b217849d9f26fa5cc97dc0bab25a2c29320e2c72b12fc", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249592, "uuid": "febc1962-6bcb-4e08-92a9-dc38c541b72c", "comment": "Malware payload", "value": "733bf8df276d6a6325276cd43dad21581654ceda", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249592, "uuid": "fd6454c9-0209-4354-955a-92d3fa8f6d35", "comment": "Malware payload", "value": "facfb256b5666920daa4bb2811da6a5f25ada6d67b5a1714b7e49546bf02e33271cac4da2df1ab0436b7c26d8675d3c2", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249592, "uuid": "e7b1c2c6-9633-4325-82f4-7aa7d2f58074", "value": "T195334BC54E76159CCC7F14249C6EA5A889C1C316BAC934723194EF2AAB907D10EF6BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249592, "uuid": "58b98631-4d86-4828-bd3a-bffbdf750027", "value": "1536:cB9up066fwgBOTi4ov4YqoeSt1sfZWNXIUJMpjCtj+91:KY0pLETi4oTqoe81sfZWCEOjCty91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249592, "uuid": "6ab602fa-0ad5-4bfe-8300-5ba7e7408b84", "value": 53466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249592, "uuid": "d66e4df7-1a51-4bb7-9b8e-832caadb8f89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249592, "uuid": "b1ad7332-6fcc-4ab4-90e7-9264cc73571b", "value": "33252d0a8bc81574347b217849d9f26fa5cc97dc0bab25a2c29320e2c72b12fc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d18d81-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259228, "uuid": "b652f7b4-2fa5-457e-98bb-97b3a127019d", "comment": "Malware payload", "value": "ec2a53be81fc5db8ec669c8d6f1ffc08", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259228, "uuid": "6d06e2d3-c530-443a-bbca-afd9d15eb3ec", "comment": "Malware payload", "value": "332ea10aff4d51d2414ec6a03a368d41a2f98d28732396a88f4ea06b2175b488", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259228, "uuid": "0704fec5-0add-44a1-8307-c2d6fdabec9a", "comment": "Malware payload", "value": "5655ab558fc9c849a640dd3b6dcd2ce0c4ff58f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259228, "uuid": "b979661c-bedd-409a-838c-745c739aa9ed", "comment": "Malware payload", "value": "da422b36aab46e45de6e9428c67f5f710d90b9ab9dddeca947f495f6f16efaf6f9866ccd41d10e34199b6804319aabf8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259228, "uuid": "8c614a83-7c29-44f6-8974-aa8b6fc56d66", "value": "T1F6451264A54B5C68B4E07ECB85F50FC2FDFAEBC8119E6A55EA50C7DEB047C2E84E0211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259228, "uuid": "6af98e16-079c-4ece-a909-03cd64f09479", "value": "192:ZTgi3KCTPecCj3+3idS3+33hZuZ5ZSHdByCZ9M3MHn7Ei2EPfa5mPfqfPio05BFs:MUjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259228, "uuid": "ea819a1e-8928-4656-b8bc-9317c4d2a8bc", "value": 1238834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259228, "uuid": "b41f6d7e-0041-4f52-bc09-130f7bffd3e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259228, "uuid": "75f3a58b-2566-4950-abb9-3cb6f2211981", "value": "whtelinebuildersgood.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17bb9518-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259157, "uuid": "c673c664-2672-439f-ade5-c4c8d4a6afc8", "comment": "Malware payload", "value": "ab3041fac741201089f94ccb05acc231", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259157, "uuid": "915cd1d2-be3d-4fcc-b5c9-b5ed950cc77e", "comment": "Malware payload", "value": "33571c811bc98720aea043b768cf2dd453559f2876ab35aea0c2d5043536e93f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259157, "uuid": "15c3ad67-f0cd-48bb-bcb8-aaaff7aadf9c", "comment": "Malware payload", "value": "ef968447229a5848600fb3647f7e35ea42edee9a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259157, "uuid": "8f82b8f4-929a-40bc-a3a4-36752a00d05a", "comment": "Malware payload", "value": "36e7de94dc69a9714514c053a3687b3668a6e3a4e98d1b74cf4e7ede3532412188cc67c60dc74097a34ce0351bc1f6ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259157, "uuid": "e46c442f-0344-4022-a0ee-f82f49822f44", "value": "T1EF55AE69BED6389F125581B52C17726989D9812343E335B5BB3A2DC1C30DFFA39F2290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259157, "uuid": "b3ecbdc0-2fd0-4d84-a0b2-34cf421c4515", "value": "384:Deeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee0:B11QgbonjOSIA/aGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259157, "uuid": "263f1fbc-bb93-48c8-910a-72d629327aa8", "value": 1370179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259157, "uuid": "9dfae059-b337-4a99-8a90-f82718994d44", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259157, "uuid": "2e425e66-c4bf-4a7b-8a3d-86dc09bcf061", "value": "ab3041fac741201089f94ccb05acc231.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864d8d04-2659-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774230137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774230137, "uuid": "7e2cd7df-69f2-4f42-9303-13ac9c0ee6e3", "comment": "Malware payload (njrat)", "value": "794a0f9737b3ddf39aa60f4db470963e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774230137, "uuid": "3fa836dd-ec5c-4e8d-8f57-16baa0e56b02", "comment": "Malware payload (njrat)", "value": "3363d6303e76b785f58f2a2f3366af0a0094f742aed46448a3f3a97b300c404e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774230137, "uuid": "4a9fd63b-fc6d-457f-b835-a11365cbb975", "comment": "Malware payload (njrat)", "value": "5911a896a7e929cc011fca1870aca338d926cc3f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774230137, "uuid": "480d02a0-14cc-4190-856a-342d45eedc30", "comment": "Malware payload (njrat)", "value": "3cae81b63d05ebf7b912aab31cd9a10556794c8f2c75481196ed3e5ab20785949e44ef5ff9f356d44366e5cd34aa14dc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774230137, "uuid": "7c31063e-bfa1-470f-9324-10a98a3bf96b", "value": "T1FBF3295A374A4B10E57C1CB0D0EF593003F29AC33633E7892F85669D9E522E29E4D7DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774230137, "uuid": "5ba2c034-45e8-4819-94f4-cc8c34204aed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774230137, "uuid": "f6224b36-6219-4a0e-8e74-fdfe4e028f9d", "value": "3072:fIIj/kFrrfTHiKoDsyIHvV1dfGiQEHHVYbnymBQ5ZxfXftP6Ob:fI0KONIB/nCbym+F3Z6Ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774230137, "uuid": "a4ad369f-391c-408c-99f5-9aea70bc23b0", "value": 169472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774230137, "uuid": "40708953-4b8f-40e2-9eaf-6f73ca5417ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774230137, "uuid": "f7233025-9448-49d6-925a-3dc1ae31eeeb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14dfdcc-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283010, "uuid": "fd76a9cf-882c-4965-a41a-092a99958cc4", "comment": "Malware payload", "value": "036bcb62be72c4663b9564955f93b05f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283010, "uuid": "d6db3c0b-e085-42ac-821a-03ab1c68623d", "comment": "Malware payload", "value": "345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283010, "uuid": "dea2059d-926f-4955-a695-2a36aac43e74", "comment": "Malware payload", "value": "87a8245f24cdd2667992b8300858c6bdedd3c5a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283010, "uuid": "45a92f2d-4faa-4179-af85-c2a989996b8c", "comment": "Malware payload", "value": "840de11573dd705a8411ff3bf633f7c758caa8f4fd35c42e828f2c5eb718964b3524d6868cff60169a83c67cfdb532db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283010, "uuid": "bb3f4659-f2d9-4bd7-948e-2f2e0aadf602", "value": "T11785E18BF2560869CABF9275FA430EC51C159C5EBFB2EBE822C585BD707E310DB15212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283010, "uuid": "84746ad7-086b-4d46-9e36-d7d56f71375c", "value": "24576:3duzFM71hL76naZQaz9oPuUgwbbMiLnKaeky0RwkM0opDib:8C1hL7xZ36jf7KGi3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283010, "uuid": "07c296f6-9025-4770-8fdc-9b1c3b3ef4b8", "value": 1712624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283010, "uuid": "2c0c41ae-cf94-4311-804e-02314c8dabf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283010, "uuid": "84ec1771-43b4-411c-b9af-edd9fdd2b540", "value": "5b2475d4915c5aecbeb66f52fb4e5b5c342144830cc32cc039a6573b5b6cb2ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de762fa-2689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250631, "uuid": "7dfd2344-f276-4986-b8a1-cf6fe28531db", "comment": "Malware payload", "value": "2e05580c3ec652a2602063e19a443931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250631, "uuid": "96449c17-2918-4559-871d-8dd45ba05ae7", "comment": "Malware payload", "value": "346d1708106b2711d59474a17c57ba9607cb3216b15870ee8c5677b25a6df54f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250631, "uuid": "7dd1bbb7-cf76-4009-b6e1-9708e627cbcf", "comment": "Malware payload", "value": "9ad07604ee47d80a0e7df2597f273a277862695f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250631, "uuid": "51003ff8-4b27-4faf-8441-6fa4fc8f5b1e", "comment": "Malware payload", "value": "b3cf08c1c983896edb28c33ba9af72d7883189603ed09f7a3f77f0e3dbdcec2f7a870ee2a60b74d2b1a3d9d72c305e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250631, "uuid": "57066f93-5f1b-40f5-a7f0-fc7316d348b1", "value": "T1CD479E87E8A32DD4C4AAC374D47A419BBAA27C091B3823DB1A91B7301F367D49E77741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250631, "uuid": "31b6e1bc-9bbb-4d7b-b7ce-e36ac9afee45", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250631, "uuid": "c97b2f36-bc71-4bc8-8b61-be690b08214f", "value": "196608:mIxm5KZImFi8N3yLhltIHSr/aTKlSj2Uz/RRb4FjGQBr7veQPo8xKU05iuC7/Byr:mDTmX3C7tIyr/aTKlWz/Vw308YbW/BI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250631, "uuid": "902e1201-e137-4d7d-b381-4fb326d305f4", "value": 26727936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250631, "uuid": "61e1abbe-cdee-4da6-a596-8e631ffd5fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250631, "uuid": "4437933a-c48a-42c6-bb9d-957f08ae6a45", "value": "corvus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5254a034-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282878, "uuid": "9bdd6efe-7486-480e-ba2b-c6862ab1aec1", "comment": "Malware payload (Mirai)", "value": "4918635350211f0d758c7993c12a5e49", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282878, "uuid": "420fa00e-95a5-48d9-ba5b-cb6503ab7e54", "comment": "Malware payload (Mirai)", "value": "346daf47075628ac55cec452a9e4a95b22abb12a1c51764f5238b781b6901638", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282878, "uuid": "9d4b3228-a4bd-487e-9343-aea45562868f", "comment": "Malware payload (Mirai)", "value": "2f48a5cdd2e7d9a8cc42f7fea42f6e653c1abd48", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282878, "uuid": "d5774eb6-0558-4c3c-8f01-f46fbfe84d28", "comment": "Malware payload (Mirai)", "value": "13fb2090d88aced750fbe817fdff25a743d95ebfd5e55374cb9cb0691a3524d1a4556c89447d4fdfe8286582aae7af7c", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282878, "uuid": "e44b552c-b99e-4e0a-9d5c-fe7de7b2bfef", "value": "T11CC43A59A8419B91D1D06BBBFF1D934873131B38E2EEB1069D196F246BDBC1B0F7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282878, "uuid": "3d26cd0a-e923-4ae3-a518-c88b18accf99", "value": "12288:pX+tZou9OdaIYeNBHCoSXpEjKrRk6hkpCS4jAj4iufaQ/cTM3j1wG8hW:1RdaIpBHCU76hdAc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282878, "uuid": "2e0e2fe0-4596-44ef-a5d4-d7e4585d95b7", "value": 581016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282878, "uuid": "62004c6e-0744-471d-ad52-f2719f25f373", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282878, "uuid": "64fd14e2-a5e5-453d-95e1-ce6b3c50dd9b", "value": "5_187_35_166_443_feb24_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08ce2f9-26b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774270634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270634, "uuid": "daf5b6b0-ddff-4987-bb48-147618af647f", "comment": "Malware payload", "value": "754b213fd78a54bb04dd59ec5509a049", "object_relation": "md5", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270634, "uuid": "fc3e8047-eeaf-4279-a284-fafdfe12a625", "comment": "Malware payload", "value": "3480cad11074a7547d81606ecdea19f652768bde74d6bfe1266f45c0c8defe77", "object_relation": "sha256", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270634, "uuid": "b6df8843-dc92-416b-9879-1ca35fada8e4", "comment": "Malware payload", "value": "3e4cee97888680b0d67123c3f49d4f6aeca372a9", "object_relation": "sha1", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270634, "uuid": "d49caf1e-0f58-438a-9f31-c4691a4b0f6e", "comment": "Malware payload", "value": "68771234734bd928afc08dec8c12ce2056380c610d76d8f9485aecc5880333adf792f731cb711f4a6d3687888bb3a0c0", "object_relation": "sha3-384", "Tag": [ { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270634, "uuid": "ba3fee12-e94e-44e3-8479-24e58b837f08", "value": "T112E6D986BDE80B09C27C637467D5098E1E9A9C1483060E6A52E4F55899FF9FCDB3CB31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270634, "uuid": "a3ebf97f-cb15-4c94-a6a5-005bb8539a2f", "value": "3072:1F/pcGnh3vs/InbrTIHvPnHmC5irCuMo/+ncoZZihnhYtZ1tZxYivw:1lrZn7y/EGuH/cpihi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270634, "uuid": "50854f11-4e7b-4ccc-a756-89a01d5aff6f", "value": 14680064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270634, "uuid": "faf76af2-7fb2-4f3e-856e-e2d19f736247", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270634, "uuid": "1b359832-bf23-4406-9164-920140db3557", "value": "Argomenti_PO_2026-03-13_7492358.pdf.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30c1fde-26de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774287335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774287335, "uuid": "2a8dbca4-71e0-44df-9c3b-25645245c01e", "comment": "Malware payload", "value": "5a6de27132f62412bc064d1ae37127fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774287335, "uuid": "3d759f79-c20b-4d63-ac9c-022f32f8b6a9", "comment": "Malware payload", "value": "34af4409264d852ba0c694c1b63c7a60daafed958e4f3f32cbf243e0e17e15ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774287335, "uuid": "1780abec-9c10-4de3-88bb-181d808f3e73", "comment": "Malware payload", "value": "fdd10899914fc8a41174b50b5d4451bfcc67e299", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774287335, "uuid": "3fdfe3d7-1764-4830-a54b-6bde8aec9e14", "comment": "Malware payload", "value": "a0b40df6bd066150eadc8379ab580cbe35cbe9d8643d3963bddb256c77e7994a1e5e370f9ff5cbafedce128dcb6252cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774287335, "uuid": "f7ccd79d-32df-47cc-8043-0a3ede4f60b5", "value": "T107C55C07FCA015F9C1AEA1358533A556BA71BC442F3123DB2BA0B7682FB3BE09975714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774287335, "uuid": "dcb88334-4b69-4ca4-be70-050031732ef8", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774287335, "uuid": "713a7a75-c9c0-42f6-b289-fe8fbbdac58a", "value": "49152:zVxpivo8lEvTJpTTezhki++qVBCOMUjDQc3/:zV0yJpTkq/MLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774287335, "uuid": "a85a2b1b-bd0b-4c25-9a54-d679dffb5014", "value": 2555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774287335, "uuid": "6f776b40-d325-48ed-be31-e9dd9b38cbf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774287335, "uuid": "a0d5e968-909e-4ded-ab98-c6ec973cc262", "value": "SecuriteInfo.com.Win64.MalwareX-gen.82588315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f95b90a-2702-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774302710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774302710, "uuid": "d8ea2d4b-816e-4d1e-9e83-15a61a398533", "comment": "Malware payload (Mirai)", "value": "64a57b95caee2023f279878205f6648c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774302710, "uuid": "a41db93e-ed69-4e95-b72f-d2fb2d4b9663", "comment": "Malware payload (Mirai)", "value": "36b1d6c22f3d6cab8c56aa3b6eafba204f91fbd4c0d17a8b8e69c625f4fc1902", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774302710, "uuid": "95981b76-89c0-47be-95d2-5b87d63edc47", "comment": "Malware payload (Mirai)", "value": "21bfa8a3298dea3183abf6f3556ea79ab5e397ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774302710, "uuid": "1e5ec37b-8bbc-49b3-954c-c61fc46089c1", "comment": "Malware payload (Mirai)", "value": "f61d9c65b856f9ba2104eeaf0a2b4ae3568b0b89010b95d2fc130d748af00613095c0be015f1f1fcdd21c98a2351c023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774302710, "uuid": "a247f23b-8c04-4c84-af02-cdb4c10af8da", "value": "T145830946B9419F12C4C631BAFBAE418933137FBCE3E97111D920AF5027C69DB0EB6612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774302710, "uuid": "dc6a7bdd-adc9-4010-a5b2-3b89b6bdd08f", "value": "1536:XUn58zeyDKnVV8IVLsLG4aLEFimzhNwCi9ltqiWpopNC9Y7Z23P:rzesKVSIVLsLG4aLEFimzhNMCpopNC9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774302710, "uuid": "b23aa5cc-441a-49d4-9cb2-c0366dd99a52", "value": 85412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774302710, "uuid": "42b86b61-d166-4254-8b93-7d7e801eab2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774302710, "uuid": "8f4ec533-1e56-450b-9631-c1076961a3c4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f282c98-26c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774276994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276994, "uuid": "da1614b9-00ab-4bf3-a46a-cd1b5f180fbf", "comment": "Malware payload", "value": "2de8e36308b5daa4f748027dbec12311", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276994, "uuid": "120623bb-fa7c-42be-a1b3-9c0e8e0edec8", "comment": "Malware payload", "value": "36b241275dff3331d9e708bdf063c55a7bb438292190e0043336cf7e9f807306", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276994, "uuid": "ed0b3676-2c70-41ef-a1ca-5a7e4b7437c7", "comment": "Malware payload", "value": "6f5d8fd0402dd5d533ea8893bb2b85c5f3ca06f3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276994, "uuid": "3b5c2182-93d4-4d8f-acb4-42ab74cc0852", "comment": "Malware payload", "value": "c302da230cf70ffa05f841816b7f7f225225b1d6a5a4db4a48fccfd2786bab4e0b67aa4f6879c7f97a8b927910f7fe1a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276994, "uuid": "f2b7e2bc-9117-4e2b-ab73-50c9ab648a92", "value": "T14D86339FD8032F59C225D57F4A8E9A703967527F4D83EF1724A2B0579FC0AC9B02984B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276994, "uuid": "9a25cd81-e3e5-41c6-abeb-e341b76976e9", "value": "196608:ej5cpZDhEeDecWySfoERzMMpe9gUxuBakPX:i+ZDGfwo5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276994, "uuid": "fd4c796c-6bfe-4dbd-928a-56d01ce25f87", "value": 7851180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276994, "uuid": "a38e73ad-166b-4881-bf80-9add6fcc6de1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276994, "uuid": "ef7e009d-f990-41d2-b9c6-cab1000ed086", "value": "0d74156089292eee308017c8e8a7550739ecb6149ff379810f7c54b1dbaabc91(2).7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6c50bf-26b8-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774270874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270874, "uuid": "0864012b-0a24-4e6a-87e5-07948050f235", "comment": "Malware payload (AgentTesla)", "value": "b469ebac993a38009d783a6ee040b6f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270874, "uuid": "90888d35-31d9-4390-9131-9c1493804f75", "comment": "Malware payload (AgentTesla)", "value": "3756c250b313520c3f7277343e2f14c2098004699fd9fb4b7ace82c04dec0c20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270874, "uuid": "53f96fdc-ad9f-407f-b0b0-96d9fb9a0b9d", "comment": "Malware payload (AgentTesla)", "value": "e1ec37f52269826d3a815292804751a102d274ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270874, "uuid": "5fda07ef-3870-4af0-a7d0-e662ecb78bf6", "comment": "Malware payload (AgentTesla)", "value": "42b567908e64381260d0c280158dc474ff5efb61c919b2458bab2c15a6f8f77d291e39fe7c01445f2886e297d5d63544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270874, "uuid": "0c20e076-7aef-4cb8-9c4a-e9ba5df6f412", "value": "T16E45BF0273D1D062FFAB91334B5AF6115ABC79260123AA1F13981DB9FE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270874, "uuid": "072bc31f-3b34-4057-bc1f-038943d8309d", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270874, "uuid": "33ce2382-b596-4db1-a4e3-5ac400d064c3", "value": "24576:I5EmXFtKaL4/oFe5T9yyXYfP1ijXdadsIz0KG1Y:IPVt/LZeJbInQRadsIwKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270874, "uuid": "7b3cb5b6-1286-47a6-b313-4917c58aa29d", "value": 1229824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270874, "uuid": "61727115-c5a6-4baa-bf81-36ba0c50a29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270874, "uuid": "5cd64b05-a2be-44ac-9470-d9f4b3fb87dc", "value": "Statement Shipping Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08476352-2661-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774233361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774233361, "uuid": "72debffe-6aef-4151-9a43-c90a062dec06", "comment": "Malware payload (RemcosRAT)", "value": "ee05ee6ac6d33b06097eff5dcb79ec69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774233361, "uuid": "5a120f98-3b60-4f11-9e47-942270826618", "comment": "Malware payload (RemcosRAT)", "value": "38d77ee3b4bc2de460b33d2412981298496a0beb04efc3203ebfedddf5df5aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774233361, "uuid": "c03fc260-1b38-4eb1-8430-d91b570c6b35", "comment": "Malware payload (RemcosRAT)", "value": "c92296ffdd93da53488159fb4b8b170b1ae224ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774233361, "uuid": "bea26463-5e71-4f06-86e8-52bede817948", "comment": "Malware payload (RemcosRAT)", "value": "42567418df289f4c600b062455c041a4f334a67a661f3ea390cd29deb2ed066a5ec5173945dd40226a04cd5aec7bad8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774233361, "uuid": "749dff12-1bfe-4469-ac4a-b8abcd54443f", "value": "T130C4E0CDF144908ED4388E724D2BBE211B112E79E092861FBDE67E1FB9B7253241B716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774233361, "uuid": "67250e35-4cea-408c-99f1-20eb064c9dfd", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774233361, "uuid": "7185b1e8-096e-4570-a8fa-b5c2d1566d66", "value": "12288:i0iyMMMMMMMMMMMMBX2foXwHOtyNDQj/WOANBXmLwIZ4LJd:NMMMMMMMMMMMMBX2fogdQj+OANB2541d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774233361, "uuid": "0d013c64-c3d7-4e9d-8163-57363243e396", "value": 575632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774233361, "uuid": "d12ffad1-b25d-4865-8d0f-64a0b6ff6068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774233361, "uuid": "d9ef0843-b3b4-4980-9381-8a81c6ed3499", "value": "Benjaminite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e091a1ca-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249616, "uuid": "60aa963e-1c9c-45f7-8600-fcb42444c3ef", "comment": "Malware payload", "value": "5f7b93299cae611bf420cc368ed7af6e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249616, "uuid": "f6d71a80-a88c-4c6b-8f5c-9e8b8a4c386e", "comment": "Malware payload", "value": "38f237e54d842d5d913c5a6aa313565347452bb1e0ef1654527a5b0c76079fbf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249616, "uuid": "c15e2c1b-13aa-44ec-9a09-52d358189597", "comment": "Malware payload", "value": "85f73ca9b1ef277eaf9b6758820d4e6479b253c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249616, "uuid": "d93ad673-431e-4b62-b5c4-82806cbe2565", "comment": "Malware payload", "value": "61a87d1d08cf3ab59c9f8ea3d7991cb318434ec70a140aaf46aae7d80769f9fd66ab3615c3001eb1b83a662982144806", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249616, "uuid": "0643609a-d387-4d34-a0b2-7bf177ab7f0a", "value": "T1C4058E46FEE941ADD057C238C9175617D6B6B4483324AAFF52D04A2DAF13BE22B3E341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249616, "uuid": "ba0b42e2-7ac2-4c9a-bc0d-a149b3b2520a", "value": "1db1b2b8b688bca0c29b2a70e25e28ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249616, "uuid": "bf19717e-c380-4329-a206-b77119e99a6d", "value": "12288:qkcdRSdo9IPpqiqz0VQva2jOEIfv1GM5ZUt6qAITZnfFwaLzupSoqv/qsNR:0dsdoyPpBqz0VQvSdjItiI9Nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249616, "uuid": "1d2e415a-1f3d-4694-9a66-fa60d5f6f1fb", "value": 800256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249616, "uuid": "147a0333-764f-4a5b-b328-216a385754cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249616, "uuid": "d6371f0e-4eb9-458a-9fcb-4edaac0be0d3", "value": "38f237e54d842d5d913c5a6aa313565347452bb1e0ef1654527a5b0c76079fbf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae1eaaa1-26aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774264993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264993, "uuid": "a3d0cabb-2de2-4a1c-87ab-512564cc4db4", "comment": "Malware payload", "value": "284899419e012f4c6839d1f97c6775f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264993, "uuid": "cf1c6bbe-1ed7-4a43-bc43-f91d31ff537d", "comment": "Malware payload", "value": "3aea316797f7c7351d96c5750f40afe2ff3840e0c81612af24479ecd85978846", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264993, "uuid": "4b928b70-3941-44d4-a9a8-f94a0943a9f7", "comment": "Malware payload", "value": "37f11245f5c2e8f339ef24fd28be959c43127557", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264993, "uuid": "c643660f-d025-4aa2-be6d-ffed27d434fb", "comment": "Malware payload", "value": "ca010d7badfb9cb2a16a28bd852a9117f42bcb4fea6a2d02f1a70af4a7b8374ba4f1507a8e9919918849e3e2906d7f96", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264993, "uuid": "674ac3dd-76ea-4966-9c64-cb528115cc07", "value": "T139848A3C464F66B5DD9B54AE142B9CDA8D63D68B83162CC22604E9323B05F43F2DE8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264993, "uuid": "4f7a7514-a5aa-43da-b7b2-61d1a19c33b3", "value": "6144:8axIyuZUOY3XzyO9cFlmPXQTEGpMHN6ynd6tXe1FlTi2+1Mn:t2HZUOY3XGbFzTE3N6yn4s1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774264993, "uuid": "e3500cb5-3bcd-4e79-a9c6-393d6441cdcd", "value": 392140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774264993, "uuid": "c1161f59-5a1a-4224-9386-b2085fe4f105", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264993, "uuid": "1eeb4528-3f1e-4fda-a85d-1e6d0aa1415e", "value": "Lumin59.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd06db5-2711-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774309308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309308, "uuid": "ab40fbc5-e747-4676-ae7d-973045a81cec", "comment": "Malware payload", "value": "cf91e0383a405d33dc543eb5f7821d0d", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-garden", "colour": "#838439", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309308, "uuid": "c69a3fdb-be89-42a4-a091-cadb0b10896d", "comment": "Malware payload", "value": "3b0de26de5b19cef038df70f8c2a002f5809f6b13cfab2a13d8f36631947c1c7", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-garden", "colour": "#838439", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309308, "uuid": "2613fbbf-c747-4273-a6af-312f7433a404", "comment": "Malware payload", "value": "438e429f316e8f422b17e7df9e2e06a7d1518a77", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-garden", "colour": "#838439", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309308, "uuid": "237f8bfa-3916-4498-90b9-983c032ff230", "comment": "Malware payload", "value": "71e1d7ae57066d73a0df4b88136ad9ecc3f441e95ac631c97273befb5e062d542a08aaeb0f161a7b4f96f3f49cf57e51", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-garden", "colour": "#838439", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309308, "uuid": "1c1ad518-a563-412f-9c6b-69162e4be695", "value": "T190863365D3B846E4D8B3583CC6C1441AE7A23C666761C3CF13E066662F3B6E42D3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309308, "uuid": "0f5aa45c-9435-4a90-ada4-8f3d84ddf49c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309308, "uuid": "203b623e-e5f1-495c-9ea5-20e2086bc8b0", "value": "98304:APICxZuIItHJenmenTTwiAxxYibcHnP2tWQRaP46R5MwhdDwG1eFsr7/sIKPlcGv:lHaP4eZDwGcssIKtcGfcY3gtjD216FRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774309308, "uuid": "633560f9-5588-46e7-b089-8d1dd83c218a", "value": 8158104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774309308, "uuid": "b2a763c0-de2e-4b6a-be88-32eaa7d01df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309308, "uuid": "442177c5-3ebd-437b-9fb6-4c0a095e8b9f", "value": "3b0de26de5b19cef038df70f8c2a002f5809f6b13cfab2a13d8f36631947c1c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65678254-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (BlihanStealer)", "timestamp": 1774229223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229223, "uuid": "f89d6f51-a665-4c1a-b617-41679dc477b4", "comment": "Malware payload (BlihanStealer)", "value": "ceddc98cec067eaf6600e98b7cd0d229", "object_relation": "md5", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229223, "uuid": "ac977fb8-5aa5-4357-8911-5155c59f50a6", "comment": "Malware payload (BlihanStealer)", "value": "3becc354d9c5b2ef19dfbce1d5b2e2f084446942f5881faea221326c517610f6", "object_relation": "sha256", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229223, "uuid": "fa4f2019-78a9-4825-bbf0-5e15b23d9f5e", "comment": "Malware payload (BlihanStealer)", "value": "a5c97a0b8b216d6c8d45f2854e6a34bb7b3ea799", "object_relation": "sha1", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229223, "uuid": "db83d035-777e-4ff4-acde-b0be61dca5b9", "comment": "Malware payload (BlihanStealer)", "value": "1bac776dd8c0b9ac522f01801f928f1cbb8a4149d09512aa725ce6358c79b7397795e9b0bf08ace1a9e5940b1dc71b65", "object_relation": "sha3-384", "Tag": [ { "name": "BlihanStealer", "colour": "#309287", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229223, "uuid": "99166736-136c-4ab7-b105-0a5bad45668e", "value": "T17973E64B8E71CDDBE804143EA7EAA21C86D3FC5418CCE35A57EE984774C291C889ED67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229223, "uuid": "c05e6d58-1f0f-45e2-898c-563aa8a98540", "value": "23d47cbef5ef7b970f550a993e2e8f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229223, "uuid": "6f4ea3d4-8002-45ac-a93c-0d1e74c9294d", "value": "1536:e6q10k0EFjed6rqJ+6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hyhuhrhr:E1oEFlt6vghzwYu7vih9GueIh9j2IoHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229223, "uuid": "6ce646ff-4a82-4a0d-ab2a-c0771bb9a8db", "value": 79720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229223, "uuid": "80527483-a0bd-4529-aef7-6da15e7249de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229223, "uuid": "f3b9ab2d-ca9f-4def-ab38-824dd6114102", "value": "3becc354d9c5b2ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc964e8a-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252159, "uuid": "3766b733-2163-492d-a5d8-7459c4742b54", "comment": "Malware payload", "value": "e5bebfb48ac903b8cd6af9d575ae4ce9", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252159, "uuid": "f2edcce3-7095-469e-8499-ae9e0ad904ed", "comment": "Malware payload", "value": "3bf7f9e52c2d3f4d11d1f700571cca0556423bd4d69fe037264da4c2ead8926f", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252159, "uuid": "ddbd31e7-e54c-41a5-ad53-3ee2237d7429", "comment": "Malware payload", "value": "70be702d59119ce4df292ba99ed876a46d486c8e", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252159, "uuid": "617ff999-7587-4ad2-b412-46d43e30ba1b", "comment": "Malware payload", "value": "015197477cbed97e6c2a44c4d3d9982e05b1db4212ef2f2453e28db89cb5ea62f75af13cbddd53c1bab091b4f413cf36", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252159, "uuid": "30e2b799-455d-4028-b9d6-ed69db259ec8", "value": "T15676AE41BA96C0A1C68B1530DC7EE7F91B21AD454BE14EAB61D4FEEF78321C27C2621D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252159, "uuid": "9da898c1-000a-408a-99fd-ab2c04a590b1", "value": "8f1f04f2b4de507e3d92fc1b996a5a58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252159, "uuid": "6763c685-665e-4a1a-bbfd-12351fc6048e", "value": "98304:m8pjwKnxcZFhS/tfMHdFG6vUDwqQRZ00kjqUDN84uQE9q/3Cn:mXKejo/tfMDG6MMqQRCDN4QEw/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252159, "uuid": "fc559b0e-d650-47ff-b46e-b0e861c35578", "value": 7790592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252159, "uuid": "558e9c07-eba6-4482-b254-d75eee82f74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252159, "uuid": "2a7ae5a5-79cf-4d77-b761-f35d652e533e", "value": "\u5927\u7070\u72fc\u8fdc\u7a0b\u7ba1\u7406\u8f6f\u4ef6 V9.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5c8af8-2704-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774303482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303482, "uuid": "ebd3f10e-ff1c-46fa-a048-70b718cb4f95", "comment": "Malware payload", "value": "0ca54492fb9b7d3c7b855647a26d3314", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303482, "uuid": "beb5bb02-a2de-46c5-bf60-b3e4e8a2a5fb", "comment": "Malware payload", "value": "3c1a1b37fca9e26dfcb196dd279f4631bc1afff84a6e3f7d43d7896dd8392db0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303482, "uuid": "5a77a1dc-2069-44c7-98b6-d68e11b1157f", "comment": "Malware payload", "value": "9e36236b7bdf3e0206bfa3eeee1c8090cd9bb055", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303482, "uuid": "dc951f0c-619a-4dec-ae3e-30ab63d0b0be", "comment": "Malware payload", "value": "ae89b08f5625bf6c20843f4b637415abbf5006b86ae0212538d92186e99a767fd7a3fb0ec60bbeea2c37c06d9b802d52", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303482, "uuid": "edb99340-3ce3-4e9f-a975-124e3788766c", "value": "T18F2633FF82FA5112F01CC873153736DBE05597E86B812B947D860ACA705A7F38A6461F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303482, "uuid": "4c817ca0-ea87-41d7-b069-07aca615887f", "value": "c05cf134dc19034ad65ea00a44098560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303482, "uuid": "be881305-9bf0-4b86-9bf7-ea99f04c366e", "value": "98304:x+qblGNmlPBXf9jv8ZmOL5JAlvNFg+cnUrE0DA9N2BbBDCf:x+qZDbXf9jEIUPsvNLcnr00eBd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303482, "uuid": "aa6103a8-b436-4e79-bcff-86580ea43696", "value": 4672016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303482, "uuid": "013a7541-df02-4cbb-9dfe-5335be0f4b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303482, "uuid": "964192e6-35e1-4d78-8139-10404fcb14ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ab8d30-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282940, "uuid": "2b11e1f4-27cb-476c-b99d-f7f6e317bd37", "comment": "Malware payload (Mirai)", "value": "1a4e6010e40c300b9d5086eb61b00caa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282940, "uuid": "a69365b7-428c-4934-89af-008f64e880b2", "comment": "Malware payload (Mirai)", "value": "3cbdd8a51db3f04c20a449cfa06e81302ad9220d29652be2fd54681f2f5e5e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282940, "uuid": "f4c360d3-01c6-420b-bfeb-aed2f92a6e2c", "comment": "Malware payload (Mirai)", "value": "f9ca6c9cc0bf33a5225b29050af9df5bcd68c1a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282940, "uuid": "cb1d6dde-0236-4be7-bc39-1a98cb1d2754", "comment": "Malware payload (Mirai)", "value": "f9dd6bf7b4243a6d4cad860628930cc185e42e0bda12779afb1b10725b1da7e3d709737a58b6fcb9ca53210f44b0690c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282940, "uuid": "1410595b-c9a3-4303-be61-8412125f9b15", "value": "T18BC44A59A8419B95D1D02BBBFF1D934873131B38E3EFB1069D196B246B9BC1B0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282940, "uuid": "a9b312e5-023e-41e3-a1db-fceda5403a24", "value": "12288:ShtsAQ/z8LdPD0oBsHCLOmDEXKMRG60kfCxW1w3y6hdeai/1dyYklkOaoShW:SQQdPDzsHC+G60yw6HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282940, "uuid": "28d8c173-3564-4e67-93dd-6f71a31cbe1c", "value": 588452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282940, "uuid": "8df54b88-3676-4867-94e1-f051254b6cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282940, "uuid": "2794d3fe-1e55-454e-a68f-619d3ef2fa2c", "value": "192_206_117_19_443_feb17_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bb896b-2699-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774257650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257650, "uuid": "f4ea2b98-db63-48d0-88d9-2455dc271d00", "comment": "Malware payload", "value": "2b3cd8cf37dbbd78474b73c89a200e45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257650, "uuid": "ff188e31-3f68-4c6c-bcb9-203046d82e1b", "comment": "Malware payload", "value": "3d50311657f285410f8828a47571d97265b8e2f1067187b0c79a7f2c0766d217", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257650, "uuid": "46f37fe2-626b-486a-a8d4-90f1b9bd9254", "comment": "Malware payload", "value": "f537d4385c8ca13543812b2c20a33c8f5062b753", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257650, "uuid": "79609236-a1f8-426a-ac05-5f3e6edf2021", "comment": "Malware payload", "value": "100e3a7717e19a542e626fcc5da674fe597cecb7bc43405bd7bdb7984c89fa52e44f1cdde9b8d2da73df879e39687485", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MSILHeracles", "colour": "#4CE165", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257650, "uuid": "1c366436-2af9-4997-91d2-ae14c7d3d7a4", "value": "T1DC056B12B3E69F16F52C4BB2C4B48C4027B4C8957A97F76B64C536D6E80B391CB23A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257650, "uuid": "94137adc-c061-4d95-a416-aa60e2451627", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257650, "uuid": "bfe105ff-37ee-4d17-94f6-c5c02e37ab4f", "value": "12288:4gmuo8rq5/vy9hzcX0oe/kiNIeoUolPYhlNSK8HwbDl8kFYeYlqOkDF+gyRI8ufA:4Xuo8uxihIr3UmPcuRzltkgYZX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257650, "uuid": "b16cbd53-5dc3-4978-a30e-27b78de06463", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257650, "uuid": "2a9d589f-514d-4dc9-ac63-ebddc287430c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257650, "uuid": "363213a5-8fad-46f7-b72f-274115397d7c", "value": "Vertical Bars.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999f806a-26ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774271830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271830, "uuid": "6a09d3d5-a657-436b-9302-a3fb9549180e", "comment": "Malware payload", "value": "26bebb27d8799289548dfd0e5d5e1c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271830, "uuid": "16dc5f8c-9c28-491e-a21e-26705b6b9fe1", "comment": "Malware payload", "value": "3ddfa28b290b39aab8623a154e17862393b0491d63efde4c68e61a627d66576b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271830, "uuid": "1f0be19c-86ce-4c1c-848d-c395a14a5d2b", "comment": "Malware payload", "value": "763ae18d77f614ffcf26145921a352a0bc8b81bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271830, "uuid": "78cda6b5-02d9-4d60-99a0-50d8d3161546", "comment": "Malware payload", "value": "a68610580786f7c6d83eec3141d66d6fe8c79b55e8088b22c319a2cc0b2ed73e26661d88ef12e4b8321ce7338cc8560b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271830, "uuid": "f51d5318-958f-41ee-b6a0-790436976f42", "value": "T15053FC58DDA3C6AB4DE6C50F46621DF400114875250E2B3AB9C17CCAA39C5CAFFA7CDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271830, "uuid": "2f43cedd-6556-4729-8180-9a5dd3311c41", "value": "768:iu1OtQCRvLAAazxUVom1ZOuskuGCM1CQnc:nc1r/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774271830, "uuid": "09c51220-b7e8-4982-a026-b9e2a4abb6f4", "value": 63218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774271830, "uuid": "a4902c8e-b99c-4381-9daa-9b5348fea237", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271830, "uuid": "c675415b-4609-43ce-a29e-fde5222e2577", "value": "BL BELMONT 578455772 SEALAND.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c688598-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282895, "uuid": "b9127a0e-7746-40be-aaaa-580791c5b7aa", "comment": "Malware payload (Mirai)", "value": "b7352bbfc66359214672681a6ae47af7", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282895, "uuid": "bb52f776-50b6-4c8d-973c-b8994cc4587d", "comment": "Malware payload (Mirai)", "value": "400522dc52473e2a9d38098c49643a833ac5da6f54a39e0c5336c2a301147daf", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282895, "uuid": "4c6a323c-2642-48d2-ba48-627590d0870e", "comment": "Malware payload (Mirai)", "value": "10caee8e27070e7beb31c8de2c72f2fa0ea5f172", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282895, "uuid": "425b4ae5-fd71-486f-9cbe-442b6dae7fda", "comment": "Malware payload (Mirai)", "value": "d11f33fdacd701cac425c72cb4ad447b10251df65f07f5664909bd95c36d4802aff71ed4ab701cb95e98e81a8b2ccd61", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282895, "uuid": "3b4f69dc-090c-4663-8da8-a630118ca601", "value": "T1BD5423E76C8AC3CBA80656E49CAD885770378B71E2CCBA6CF456506146BB73E1F1814F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282895, "uuid": "c1bb9a8e-1cff-4f44-8094-c9fe97f22296", "value": "6144:wVkRHB2avh/gu9/CKO9PJQWu1zo+tsBQQkaz1PQ0qmpMV0Fp9:BHdjC5u1nsqaBPQWAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282895, "uuid": "a70f5391-4bd2-4de8-9f9d-7488f7280bbf", "value": 285056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282895, "uuid": "dbc140d9-adfd-405d-8ca2-46eb786f12a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282895, "uuid": "20132d1e-343f-4f9f-85c4-2ffd838af66c", "value": "192_206_117_19_443_feb17_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d73a08-2686-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1774249645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249645, "uuid": "b6d0a457-1fce-4eb4-84ba-8c75d3c6c28f", "comment": "Malware payload (HijackLoader)", "value": "5ddad8f1c22b190e0fba90f01a97a3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249645, "uuid": "d58ea573-bba0-409b-8963-8cb3ed4b4c94", "comment": "Malware payload (HijackLoader)", "value": "401309e3550e7cb31385ea5c345a45cc075f0970698fdf85495ea8d13a4c58e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249645, "uuid": "657f9a42-7485-493a-83e3-1a1a8af6b9a9", "comment": "Malware payload (HijackLoader)", "value": "343bd250a910c1c60e6ca9b56cb5732e385b78e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249645, "uuid": "4d649efa-bc00-42fe-a723-e99b1edb9a48", "comment": "Malware payload (HijackLoader)", "value": "fc6b5322d246a778b9ddefc5a65fdcd20cfbc481287ef8c16f012b15e6733948a5733df0fc2478d637752380fac72ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249645, "uuid": "a5f9201f-5fd4-471d-9467-b3fa20f7ad03", "value": "T1CE96AD5A7BA840E5D167C179C4978647E7B2BC950F3097CB02A427AE2F37AE04D3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249645, "uuid": "9819e5d1-e66c-4f09-96ae-0fda4f1da620", "value": "e715424ebef62edcf8229c713419932e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249645, "uuid": "ebacde06-85a6-4e96-8028-38d38583d350", "value": "98304:PdmbjH4hGP4OBfm/QamIX3MLDVLCXIPO6TUxIXFpV9V0q5vA1dr0oiMELhQ6:PgjY3F3X3IRLCXz6Ixy0mor0oiMUQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249645, "uuid": "294e9fba-7c81-4d49-9619-acdbaab0f505", "value": 9233568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249645, "uuid": "ca157dc3-38f7-4c23-9eb5-c8608b3592b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249645, "uuid": "936d91b2-3fb0-4863-b2be-55703afc25aa", "value": "VEGASPro23.0j0nba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb34793-2683-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774248079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248079, "uuid": "163361f0-1c99-4a40-b6ba-fd887eb753d3", "comment": "Malware payload (Gafgyt)", "value": "d5ee55a0283a8c850d4e8e101a28d351", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248079, "uuid": "32c8ceec-10d6-43fb-824f-92aa0953d3b7", "comment": "Malware payload (Gafgyt)", "value": "409f05aea10b21cea2cc9a41bf2575c4fc7ac2bdc13d8b83fb4f5d398f11eb73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248079, "uuid": "3d1e10d9-a8ad-4541-9e08-054b27315666", "comment": "Malware payload (Gafgyt)", "value": "b7316adf1552ad574fddccf3545fea53fa3012ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248079, "uuid": "27851f86-8cfc-4211-9804-762e378c073c", "comment": "Malware payload (Gafgyt)", "value": "7d56b78bb52c2dca33ef66b4824a0256a6140c263d91437810597c498f74aff9d3716dfa8cd4a7d1f12b85f4cd223efa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248079, "uuid": "5ab0a9ad-6210-4e46-b665-cf23a4069ed8", "value": "T1A4E32A45F8514B23C6C612BBFB5E428D3B2A17A8E3EF720399256F20378795B0D3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248079, "uuid": "d80ccf56-e388-4566-8276-129b9cc393f5", "value": "1536:vh3XRomWbR7hcOydxKAMvus4VFIzNTsAhaJsm8VephwMdnlsOwywJsDvitcCoTI8:Z3+bphFWxKDh4EzNQAhaO8ft28t3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774248079, "uuid": "79f480b3-9898-495d-bd6b-4dbe616b8b09", "value": 144416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774248079, "uuid": "b21d7d3d-8037-4d73-b520-cf8c0446d0b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248079, "uuid": "6e37457e-12ce-4890-b2db-bce22e9dbaf0", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9158a5-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282900, "uuid": "82359236-cc19-4bb7-a008-f880fcbd9dbd", "comment": "Malware payload (Mirai)", "value": "4ea21521dc359bbd25ca545556bd4715", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282900, "uuid": "62d5d985-1c0a-4643-ba4f-49cde28e55f1", "comment": "Malware payload (Mirai)", "value": "41474b00b02b03fca4fa0e6765d690d540b9a19b11478006acdd865d845ebe9a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282900, "uuid": "f6b1405d-29c6-4714-8172-bcc227be06ab", "comment": "Malware payload (Mirai)", "value": "a8552210095b490aac984d2722b25211c92d5f41", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282900, "uuid": "ea0c3b51-15d5-4a22-aa6c-bf9b65c8820d", "comment": "Malware payload (Mirai)", "value": "7e75ca75def3ffd6fb567c63913b7ae21650c71d96328e4e66bd1a013ab47b62f6e9a382fb5c00bae87ba0a2cc594659", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282900, "uuid": "422625fc-4f30-4778-b902-e2a325359e93", "value": "T18C559D44AD0CAA11D2C0B6BEAF0D438433173B7CD3FAF1265D065B299BD795A4F7A212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282900, "uuid": "1948d3f9-f0bc-4f34-b076-f50b85201e4c", "value": "24576:EQi1o+k8N2GUpU+fdTeGjHC6aLTJpWpuQz:wM8NzUpf1kJQrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282900, "uuid": "184db643-71b7-481d-9153-6c6e7bb5579a", "value": 1294353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282900, "uuid": "2886c966-c943-4982-ba30-7570ab551cef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282900, "uuid": "49079896-89eb-4c0c-b302-c537f67b766d", "value": "me.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610f7a30-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774251979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251979, "uuid": "d845862c-0315-4190-a21e-dd862116a3da", "comment": "Malware payload", "value": "2b4c6d172c5f798b6970f9b4e8014457", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "credscanner", "colour": "#EA4BB6", "exportable": true, "hide_tag": false }, { "name": "e721221", "colour": "#F7A753", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251979, "uuid": "06fb1bd0-3df2-499c-932e-a4e9ffe9897b", "comment": "Malware payload", "value": "4167764b4b801fe68b8deb1afa0eb1cbe3cf526dd9eef055cc67732e75d4acf2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "credscanner", "colour": "#EA4BB6", "exportable": true, "hide_tag": false }, { "name": "e721221", "colour": "#F7A753", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251979, "uuid": "afe9a742-8b3c-426c-b06b-9fa77b5201df", "comment": "Malware payload", "value": "9d808bb470d9dcff08ca0a1c91ab4340d6f19a4f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "credscanner", "colour": "#EA4BB6", "exportable": true, "hide_tag": false }, { "name": "e721221", "colour": "#F7A753", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251979, "uuid": "3a8d12df-d3b6-41b8-9b5f-c15970bf0878", "comment": "Malware payload", "value": "248c296e961c089be188458f1dabd0db1e2dd682af8d9b7c141dc0ea532c4de48f10c9fe65977d3145b91b557fb8434b", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "credscanner", "colour": "#EA4BB6", "exportable": true, "hide_tag": false }, { "name": "e721221", "colour": "#F7A753", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251979, "uuid": "9fc8eee5-8c5b-46d8-805f-75436769226d", "value": "T13E3112622C588441E383E26B1F19557D775A9DF74B5A253CF2DD43502F0502091FC96E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251979, "uuid": "576e8dec-6685-4c73-9ec2-a2884131ed3d", "value": "24:d8EYWhxYH24vUgO5Ae66IFFgaul9K4/RgL3c6/Fq+eTc66F0pKn:dIKWH22UgEP6J7v4/uTl/TeF6i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774251979, "uuid": "bc61f7d6-97a2-47a6-8f79-dcee1f2d53e6", "value": 1490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774251979, "uuid": "4846dbae-560c-44d2-8196-ba2e6bec8b0a", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251979, "uuid": "8df770a6-fdcd-4f2e-965f-f20cda9cd830", "value": "cred_scanner.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794f31be-26ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774293251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774293251, "uuid": "07cea3df-d5ac-47d0-93fc-eb16fda3e636", "comment": "Malware payload (Gafgyt)", "value": "e75b34b21dbc40fc5b918fee8a438daf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774293251, "uuid": "3d729077-6339-4777-8813-927c6e91977f", "comment": "Malware payload (Gafgyt)", "value": "423ba842b643cbb57faab97920485964d16d459ed368f56f150b10ac3747a20d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774293251, "uuid": "b645b0d2-bac8-4af2-8707-0d64dab51c51", "comment": "Malware payload (Gafgyt)", "value": "7c958bf83d195736717919c5ddca0476bcf868c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774293251, "uuid": "1c56e005-2ae4-4149-a35e-3f281a6cf0e4", "comment": "Malware payload (Gafgyt)", "value": "4795251fefa84848a8fed6a4ab4c7a1383e551f8ebc80bb600678b14a26bf54f5e6b21f982474a7ebe296a221bca250a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774293251, "uuid": "d9a8c3fe-13da-4ff0-94d0-610e4052e4b9", "value": "T1E9F34A17B89484FDC496C23C4BEEA626DA25F84DA034B12F2B957F267D9CF209B1D701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774293251, "uuid": "e66e40cf-6e0e-4e07-bb93-a302378e5575", "value": "3072:KutjvRZUql6TdI21T5Fo+620gTmLcIoWqhiqBKaPJYpyXjq28:9tjGWW5Fo+62zTksBhPdzqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774293251, "uuid": "a6633082-b129-47ac-933f-2bc906d22ee1", "value": 159808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774293251, "uuid": "72745617-5f15-4993-aacb-13886d51191a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774293251, "uuid": "ca435932-4cab-428c-863c-e0b6a83e180b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8952da3-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774258192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258192, "uuid": "f3e6d02f-ff6d-45d0-8ca9-6537b5a54c27", "comment": "Malware payload (Mirai)", "value": "842ea5bdd795139936d43f2a72b5300d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258192, "uuid": "8084e81d-2efc-4ae0-be24-ec4f5d5812a6", "comment": "Malware payload (Mirai)", "value": "434613a1c98f4e211ef10e25b6357cb4823fcca14ca3b5ac335213be441a5da6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258192, "uuid": "a2693a57-4b2e-4c42-a9d1-12de8081ade0", "comment": "Malware payload (Mirai)", "value": "8654d23aec0867f541e5eac607392e39e2330b77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258192, "uuid": "4f59b8e4-f08c-4ec2-9b91-2989dafabdf0", "comment": "Malware payload (Mirai)", "value": "05c480f9635c069bbd32233c877a7f0402eeddd2418fbfd85ccfa924485eac452a9bf5c84bb05378b4342aef3c2de94f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258192, "uuid": "a8ad621b-d142-40e5-9364-0dcb883a82aa", "value": "T1E0830946A9419F12C4D631BAFBAF41493313BFBCE3EA7111D920AF5027C69DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258192, "uuid": "a2ee877d-9390-4f88-9885-b103802164e0", "value": "1536:nEns/LWyjC3lJnrZJ1Jz3ajJKqWjx9ACE9l3aiho7WSuQY757hP:7LW8CVxrZJ1Jz3ajJKqWjx9sNo7WSuQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258192, "uuid": "15cdfa76-aafd-4e01-870a-94237acd4a82", "value": 85356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258192, "uuid": "9492ceb6-7424-4116-a81a-c4bc4a3b1961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258192, "uuid": "f687b698-b27a-4bd4-820b-51e0d66cf134", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16441418-2693-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774254860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254860, "uuid": "5b996c1b-4b19-4b3a-b9c0-2f7b1164f7dc", "comment": "Malware payload", "value": "54eb4643d74cdc69740f97eda689d86f", "object_relation": "md5", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254860, "uuid": "d5cf36f6-e2af-4481-8dd9-b8cd701eda41", "comment": "Malware payload", "value": "43af9adb582ecf74400b00514c4a69a16f04ef63553588eca771502a6b74f948", "object_relation": "sha256", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254860, "uuid": "de476ba3-8cea-421c-af12-931db4b43c4e", "comment": "Malware payload", "value": "4ffeb815dd5096e086b7e0c5f9e837d5b5f827a5", "object_relation": "sha1", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254860, "uuid": "2ea5c900-6179-43ca-ba57-ffc2cdcea3b0", "comment": "Malware payload", "value": "070c1ad1075c9ef9adf4d894999a4555f5bea50a0332d71d7a8d576d20169c30dcebe65fae7faed0a3f5bcf5a4a5431e", "object_relation": "sha3-384", "Tag": [ { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254860, "uuid": "b38026df-e2ce-4bc7-973a-83ecd438a87a", "value": "T197A6338EF5B09683703FBB3423BA535304F492DAC2566DFA7AD6034942A35F8D9305AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254860, "uuid": "195419ac-3338-494a-a8cb-19007c170c1b", "value": "196608:Y1s0MyOnlk71XK8nyJGwa7qgI7VZn8G2ti+mUL2xTHazXsn4Go+6E6Djh:Y1rfKRswa+lVuG+lFxrBfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774254860, "uuid": "f42e7fd7-598f-41c5-b890-cb83bb0b9ae1", "value": 9539933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774254860, "uuid": "9e2fbd35-0455-49c3-8804-47e6a02091af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254860, "uuid": "9a63c526-9c15-4db0-a1cc-d53abbeeb4ae", "value": "772f5cc0333e3a41.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d112743-26da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285553, "uuid": "b5c98b2f-ee6f-42c4-b921-2946140b4ebe", "comment": "Malware payload", "value": "ae982faf3b3d021791146db63be2e1dc", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285553, "uuid": "a43b9272-82a4-4de8-81e4-7c458764df72", "comment": "Malware payload", "value": "442a65793c7f312821f230d901e1fae24803e200831658bc00deb31975f8563a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285553, "uuid": "96caebaa-3051-42a3-9f57-82afe5df40aa", "comment": "Malware payload", "value": "3d7c1045da51c5b192c782030ca2c117bb5179ef", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285553, "uuid": "2a02d6b5-910c-4a10-a605-44d4182983a3", "comment": "Malware payload", "value": "6b633a5cb5c6cc13eeff3dbabc076d8f0d6bfb5e11ee27c23ec7f04de0608fa0a8813182fff64e7fe83c880c8937bbc9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285553, "uuid": "cb0d96f3-a8f4-46de-a26b-eb086eea6660", "value": "T14A86339FD8032F59C625D57F4A8E99703966427F8C82EF0724A6B0576FC1ACDB03644B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285553, "uuid": "f345de8f-fe9f-423f-b6f8-d3c7a207dae4", "value": "196608:7PbexPcIk3wOOth9fQNwzzM86pPycOtgb:7wPcyftR8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285553, "uuid": "ee2a952d-f16b-4316-af4e-de64253cc794", "value": 7854871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285553, "uuid": "e328402a-04fa-42fc-9f3a-951949e68b80", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285553, "uuid": "47fe35b1-3905-4dfa-8108-99b71afaafb7", "value": "SearchHostService.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e93dc7-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252116, "uuid": "d5f03065-b2b4-44f5-96ac-036d7f3ec3f1", "comment": "Malware payload", "value": "83a848a005c4fc0db3a1d0bb820d1edc", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252116, "uuid": "29b17e11-3aa0-4f15-a785-86d2f6d26018", "comment": "Malware payload", "value": "44335bb7123c8b6d6121f1ca9e30252641af86a355caaa9bc85b6ce0b3a19454", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252116, "uuid": "1787e455-fff4-4041-814d-891e9fd71388", "comment": "Malware payload", "value": "409df0e3c551d9d706e65203fa9efad80506e1b8", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252116, "uuid": "80347992-65ec-4399-a19a-848d4982b482", "comment": "Malware payload", "value": "e721b63de2be591872387274728ab5af4a98260aada75f05877643d7c7699f0c11210d3f92c222d10c1fef87d71785e1", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252116, "uuid": "cd962a38-54ad-4711-823d-f036a7eaa93d", "value": "T1B6F25C869B980C82FCA78E30B5F4D52AAE31B64167B4C5EF6358C0641FC27C13A3975E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252116, "uuid": "ebe47153-64ff-428e-8be0-32863855870a", "value": "dedd415b5c33a3c593554b33ca32a5b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252116, "uuid": "1c957e66-10ed-4a01-b2c9-393ea8352ad2", "value": "384:zg9xEVrju0iSiALKN8J31JzFmpGmy/pNhch1MeK6j1C9iOUUZ9LDgf2h3:zhhusiABJ3VQaNhiMeKg1SiKzLUf2h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252116, "uuid": "1fee76e0-d35b-4667-9927-172e8a515a86", "value": 36056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252116, "uuid": "09334d58-af56-48ca-b0f0-8b395d574ab2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252116, "uuid": "256dc310-68ef-43ce-a377-7ce407fd6efb", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e289fc4-26a5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774262792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262792, "uuid": "90d9c9e0-bd3f-438f-b91c-41606de796c2", "comment": "Malware payload (ValleyRAT)", "value": "048af18717a3f33bb6f0e6be76c31f47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262792, "uuid": "2969df17-91c2-42ae-bfe4-41547c45321e", "comment": "Malware payload (ValleyRAT)", "value": "44e525ee84e2b8d8429dfa4acff55e8c4aec790e348d02a1b834358787d19616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262792, "uuid": "e46d671a-a89b-4d21-a65b-65de5c9cdcb1", "comment": "Malware payload (ValleyRAT)", "value": "0c9b745cb65e4afad01757db1f28c5dddd3ad345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262792, "uuid": "c23dcbad-cd47-4434-99d0-21e1529178b9", "comment": "Malware payload (ValleyRAT)", "value": "b84fc537238daa3ecfa47ef43e20b5692fdb1117ba67ffb04ce7dc30562493a5c4bb252301b7b7afc0bf299eefbe8350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262792, "uuid": "be19bca9-25eb-4017-88e6-8b2afcd9c6e5", "value": "T1FB067D86B1B55264D5B3C13486A39D1AE67378028F705ADF125AB71FDAB36F00E3B318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262792, "uuid": "1fddadf4-fde6-42af-b8bd-2f03c7998608", "value": "652b7f9b94fba7a4e7168bfee715d318", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262792, "uuid": "4e5bc3c4-89f3-4913-88b9-e980f14fa5b7", "value": "49152:OZtcHmSy1jtXa3x/uYBKWP8FlflTygIyg+xlJsv6tWKFdu9CePTvG70pHFhh6DhK:EMSw0Zk+Jsv6tWKFdu9Cei14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774262792, "uuid": "cdfd48cb-37b6-402e-9854-9068d1d24bce", "value": 3823104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774262792, "uuid": "7e77b39b-5363-42e0-b445-62ba41181ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262792, "uuid": "4677b48c-2705-4ef9-996f-7e692956a99f", "value": "2026.03.23\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6493a0e2-2674-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774241677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241677, "uuid": "896a6403-7f6c-48c3-a35d-a96c433481d8", "comment": "Malware payload (Viking)", "value": "01aae35504433dac3fe27fb96506277f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Padodor", "colour": "#E6382B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241677, "uuid": "533208ca-30d6-4ce3-a5a4-09f5b0d4a609", "comment": "Malware payload (Viking)", "value": "44f7e82e9b79ed74c5d6aba0489fd1993961b3717ed67a1c57649be761f2b17d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Padodor", "colour": "#E6382B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241677, "uuid": "f40ebf96-19ed-4b58-9780-2fc52a832c62", "comment": "Malware payload (Viking)", "value": "fc4f203bd0201600ae5017398a332ce62eb11953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Padodor", "colour": "#E6382B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241677, "uuid": "c0a1575b-2f7a-437e-bf8a-daa8b1b6bf6f", "comment": "Malware payload (Viking)", "value": "0f34d2464a16a05c764c1a7616bac2ba9fb5306634f4432cd539a6314d0a4ed2f3c72cb4b3f81aa0e2e2493e5942ec30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Padodor", "colour": "#E6382B", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241677, "uuid": "1bf90ce1-0dd9-4f0e-ad8d-2b02f658ffca", "value": "T17E347D27B64003B2C6860DB132264FF3FE7A4575036EA945D384C06DA57BEDAE33A349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241677, "uuid": "fcf0f717-0759-4507-a370-070fb03f3c77", "value": "8c06df3257a07b290c16c6c995c9688f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241677, "uuid": "2454cceb-ca43-470f-839f-5e4b318750fc", "value": "3072:t8RinudiP52xx67lLdhOiHxJ3FLCqwzBu1DjHLMVDqqkSp:ykgiPA6ReeJFwtu1DjrFqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774241677, "uuid": "0cb65ce9-d062-41f5-a256-c4ed064e36db", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774241677, "uuid": "e098da40-5711-4214-b49a-1926bc9f71b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241677, "uuid": "43f604b1-3c9d-45be-a608-ada251e0ec75", "value": "44f7e82e9b79ed74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba1ef96-2685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249097, "uuid": "8ffc1121-0854-4cd7-b0be-ccd004ce6ef7", "comment": "Malware payload", "value": "a0caf4fb7b09692f02c3717111d07756", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249097, "uuid": "2a30435d-890e-4469-8aaf-64edbdfb94c4", "comment": "Malware payload", "value": "457b2ac3df567f90dbaaeb833a0a3747ec3f799f36a9584ac6c43c4a7f713ea5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249097, "uuid": "a09d37bd-1834-4191-8dbc-7c10a7f068e5", "comment": "Malware payload", "value": "3a56ee39e650cee8bb48e6a7738c12c22c2278e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249097, "uuid": "7a936b7b-0b56-4a5a-81b0-7ea658f8d0e5", "comment": "Malware payload", "value": "6f12f524ec8f94764fcb54f355cefc0b59c2a36273144a0d5207b08243b1ec54f008ae52e085b2f5da7398adb6a4990b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249097, "uuid": "1019fa12-931c-44b9-ab43-669e29993ee5", "value": "T1BE924CB512896C79FBD0CE399F3C6F4DADE8C2C42124A3ACBA4F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249097, "uuid": "4aed2fdb-b5f8-4cfe-911f-d357905bfc29", "value": "384:3FcuQpWx+BL0SWL0g7zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:3F8i+BL0SI08zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249097, "uuid": "af2484c4-e347-4d50-9458-712f112922d1", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249097, "uuid": "3ef06cc0-1f94-4feb-ab46-97f083fe45ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249097, "uuid": "1eb68940-eb19-478e-b64e-d937cd0fe3f5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a949f1-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774257565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257565, "uuid": "c0218c1e-21be-4105-ba0c-72edb9b078f2", "comment": "Malware payload (WallStealer)", "value": "5f1deb28646e9c67fee11b0dde0889e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257565, "uuid": "db86eb1d-9258-452f-936a-32f2568851ce", "comment": "Malware payload (WallStealer)", "value": "45f8d87956aab91534ae3748dc3edb9d5e3c041eae29ab345306b485b5140109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257565, "uuid": "2d7d960b-7b6b-4c8d-b363-f59979f4345a", "comment": "Malware payload (WallStealer)", "value": "89021dc8bbb2d3ec6520963a9067752b70a516d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257565, "uuid": "475fb140-84bf-4c70-9b91-489eaffaf931", "comment": "Malware payload (WallStealer)", "value": "a4e41123d4526bc9a9bf725afd3f6792e58196e56116b88b22a1c90c8ad6fe454f6fecca7ea03490152945c03e88537f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257565, "uuid": "e3afbc90-3b47-48c7-b5ac-3ed0e40d0ab5", "value": "T1E496528FB2748613C8E263B5B2063572BE2AD435479983777CEDE435319F0BE4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257565, "uuid": "ee73e6e5-152d-4f0e-b6ef-6a6080743c28", "value": "2c1853915d316a65d08a8dc489aff101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257565, "uuid": "e1bd8d80-ec56-4f23-85e9-b295bcbd512d", "value": "49152:tW5SSauP5dbz6+JKhEnCKUAPoFMEy7xnCry9oJmSTJ9ryRSkR2BSLx/vsjE9q3b+:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257565, "uuid": "75295cd7-a6bd-46dd-b5c3-b2e5ac2bd9eb", "value": 9192960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257565, "uuid": "9ce4d93f-aa4d-4972-8c32-d43f7c9155d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257565, "uuid": "6eb76ab9-15ab-4323-924d-b72c78792d0c", "value": "45f8d87956aab91534ae3748dc3edb9d5e3c041eae29ab345306b485b5140109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914fc9dd-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774232303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232303, "uuid": "f0d9dfe0-43a5-45da-9dce-5cdfd255ef37", "comment": "Malware payload (Viking)", "value": "15bd5518a315935f232b08493936c6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232303, "uuid": "4307a28e-6a3a-40d4-a3c8-8566ac85cd4e", "comment": "Malware payload (Viking)", "value": "4610f6fd220948a1d2f8ecf47cafd979b1efa2f8952601626adfad880d405319", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232303, "uuid": "2d20e878-2d6b-4704-8dff-de9dba3b8ec7", "comment": "Malware payload (Viking)", "value": "56a5d0ed58265bca9e98cc0c301c90849af0a393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232303, "uuid": "5939588a-d0fc-4056-9496-d7dc94e32c2a", "comment": "Malware payload (Viking)", "value": "4fd1ac1d75fc587a8ebc825681115b809e90224d1541a595976d6abd9189c74cfc882af985a7007211e533add274256d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232303, "uuid": "f566c2fd-69fe-4366-8614-a450f799480f", "value": "T1ACA4AD1F6FFE48E1E486413519A75EE251F0BC25B921C74AD3A0392EEDF0790F90CA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232303, "uuid": "e21f86fb-570d-4d2d-ac9d-0ab1ca39796a", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232303, "uuid": "9f9a2cda-2188-4184-a4b0-943acea8d220", "value": "12288:SjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiS7h:JuuuuuuuuuuuQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232303, "uuid": "86df3f59-bb64-46f7-bdbd-0a05061a2b4f", "value": 481124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232303, "uuid": "6f149f00-3b00-49d8-b4bf-a5e64e5523cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232303, "uuid": "e67b5ab1-b34a-4d8c-a7f0-cfada7240189", "value": "4610f6fd220948a1d2f8ecf47cafd979b1efa2f8952601626adfad880d405319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fc932a-2696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774256277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256277, "uuid": "c25e861b-ef9f-456a-9dce-cccd4a03d07e", "comment": "Malware payload", "value": "d62d77f4427d9845bbef6bf6d49abea0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256277, "uuid": "25bcf128-47d3-4e5d-8f69-ed831c6a50d5", "comment": "Malware payload", "value": "4645664af58f433d56a1896c03d69b7e4dea3e6f87ac1d4889b26af153a803b3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256277, "uuid": "02410cd8-eb36-4e52-9103-08e8ab1805db", "comment": "Malware payload", "value": "1ee97a2099f7fa9f268e314eefd414b5ca9c199d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256277, "uuid": "5b3f80af-bc2d-4e8d-90b4-7daeb4358966", "comment": "Malware payload", "value": "5537f2c0f7c18b7abfc081c87918c6e33774100db07ea3eeea2c0d1839c06d2f4c616046039f7f88e4da68963a26f592", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256277, "uuid": "db08b42e-8daf-4229-9337-973ff9650a30", "value": "T1D5925DB512896C79FBD1CE39AF3C6F4CADE8C2C42124A3ACBA4F3D205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256277, "uuid": "d4ef33e9-7a2f-4d9c-8130-07fd9d9bd285", "value": "384:cvcuQpWx+BL0SWL0g+zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:cv8i+BL0SI0hzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774256277, "uuid": "89df3da4-34d0-44bb-b94a-090de1b7e3d8", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774256277, "uuid": "4413dc8a-c8bb-4cf2-b5a9-e9073f663792", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256277, "uuid": "fdd5d3aa-ef17-4c23-84bf-d3bb7c2acb3b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acedb39a-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkSideRAT)", "timestamp": 1774232349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232349, "uuid": "ba5e4f2d-3957-41d5-85fc-b4975a05fc7a", "comment": "Malware payload (DarkSideRAT)", "value": "be3523d2fc9dd833488422c207947821", "object_relation": "md5", "Tag": [ { "name": "Confidence", "colour": "#B61D53", "exportable": true, "hide_tag": false }, { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232349, "uuid": "9df8b055-eb3d-4fd2-92eb-770d71b8ff4f", "comment": "Malware payload (DarkSideRAT)", "value": "4661708ed18968f7adf604c9b9155d7114b3ff03a4fcbe4fa5b40464aa74758d", "object_relation": "sha256", "Tag": [ { "name": "Confidence", "colour": "#B61D53", "exportable": true, "hide_tag": false }, { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232349, "uuid": "b9c72c81-e691-4971-aa7e-9e1237aa8b89", "comment": "Malware payload (DarkSideRAT)", "value": "03e9bc8b478f2dcc7be071380a87f0ce287e971a", "object_relation": "sha1", "Tag": [ { "name": "Confidence", "colour": "#B61D53", "exportable": true, "hide_tag": false }, { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232349, "uuid": "289f3e76-a7d5-4b05-80a9-96e9ac34a7f1", "comment": "Malware payload (DarkSideRAT)", "value": "f90f9e5ee30189ff66fbe539a20479fa18a293a00445d1684235d41fd65cec563aae2bb9328eff25684282e66615a20d", "object_relation": "sha3-384", "Tag": [ { "name": "Confidence", "colour": "#B61D53", "exportable": true, "hide_tag": false }, { "name": "DarkSideRAT", "colour": "#E2B7D4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232349, "uuid": "8e5f6c08-8ad9-4d15-9ef2-a3865fbcc5f6", "value": "T17315072E68971659C6A19FFD667A4283F32AB44F5B798A7331EC40E12F484EC4B35D03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232349, "uuid": "fe90f5e7-2ff1-4d3a-b378-f64e4da90c36", "value": "ba30a17f85d796cfeede32121241a066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232349, "uuid": "18b72a1e-ae60-4cac-aa73-23886547ff56", "value": "12288:UALvFBwW+hfYThmVKAubJKueysGbK8fWqCLa2N/3nDg:bTFBwW+h2m4Au9psGbK8fWqCLp3nDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232349, "uuid": "ece8ee80-b0cf-4f5b-872f-2dd75881132f", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232349, "uuid": "69567919-43b5-4917-95ee-52d8da738417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232349, "uuid": "d5e9ee00-4376-447c-b66e-9884cd3bd89a", "value": "4661708ed18968f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b731da79-2694-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774255559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255559, "uuid": "47c6e7dc-93c6-403b-829e-eb2534aceca7", "comment": "Malware payload (FlyAgent)", "value": "40dee27473ca19abeba4dc9817311714", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255559, "uuid": "f9767b13-0540-4dcb-bf3a-d897809cc7ac", "comment": "Malware payload (FlyAgent)", "value": "473630e03727fb5dfe8b0f0e79ae0622c73a8d9eb03c2b3dff8502fdcb927c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255559, "uuid": "0f4d34a3-510f-4743-b133-a403f49ac852", "comment": "Malware payload (FlyAgent)", "value": "ab21314ecf43096665b7078715ee41f62ad143ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255559, "uuid": "a90bc6b5-fb5d-4d9b-994e-eb2ac9e4193f", "comment": "Malware payload (FlyAgent)", "value": "27d16ecf1f74c6ac51a2edb70d4fe0df285a4908d462c8f7a9f1b73fc2e27cef6765dc15966b4b2b9629c4668d0cd9e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255559, "uuid": "3bb36aad-3e67-4d41-8b07-7e768a947739", "value": "T12B658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255559, "uuid": "46701399-8bbe-4ede-9ff7-3ab203677ebd", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255559, "uuid": "eccc946e-e5c9-44dd-956e-18a5811145d5", "value": "24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q5:GcallSllG4ZM7QzM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255559, "uuid": "f0827555-2098-4fe9-9a8b-1fefb037902c", "value": 1437860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255559, "uuid": "af0b78a6-7aa0-4173-878b-da815b40dd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255559, "uuid": "ecfa0a4e-fd5b-4cb0-a8c1-2da057c86306", "value": "473630e03727fb5dfe8b0f0e79ae0622c73a8d9eb03c2b3dff8502fdcb927c28.exe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7c729a-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774251968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251968, "uuid": "91d9f122-0500-4a4b-8ef4-fec4168e8cd6", "comment": "Malware payload", "value": "157099ecaedc4024bde6e21059219ed0", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ce211f7", "colour": "#006A2D", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "responder", "colour": "#8B7122", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251968, "uuid": "73091257-b34b-4a43-b33d-204a7cdc72e4", "comment": "Malware payload", "value": "476314cb590fcb60248019e9f02fd91af704651f1cb095b29851a577a6a94097", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ce211f7", "colour": "#006A2D", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "responder", "colour": "#8B7122", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251968, "uuid": "a23f6030-a69b-4942-a5b0-5b070737ed9f", "comment": "Malware payload", "value": "359ba4c24ae96aa7c47073e2b0e787671f2cf437", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ce211f7", "colour": "#006A2D", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "responder", "colour": "#8B7122", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251968, "uuid": "d344515a-6a0a-4379-8bcf-e811f02e9c36", "comment": "Malware payload", "value": "b4a259ee818731241a818e7ca07453fd187b6c4f4108f86fbe1fe9d835a1f85d7cc2998c9583244de560f7c441567814", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ce211f7", "colour": "#006A2D", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "responder", "colour": "#8B7122", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251968, "uuid": "f0d1d360-9fce-4feb-92cd-b6045edcdb1b", "value": "T183529841A17DA1FF507347B8B41286232B4F1751057A245EBBACD3B23B8E49F6292EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251968, "uuid": "05a31a2c-abaf-4ed1-99bc-17eae782faf2", "value": "384:5UfPObaX4qMKliWaKTs6AWayWvDDRzsi0uSE2fK0jL/L+kfp03:5UfFmKKF4QwTqkfp03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774251968, "uuid": "05668c1d-186d-4e7b-846f-7d49070a8cd1", "value": 13431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774251968, "uuid": "bc409334-b450-4a75-baeb-a633fc15e9c1", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251968, "uuid": "48c4f30a-ef0e-4402-afa9-2fd0bbf33e39", "value": "Responder.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90194560-26b4-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774269237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269237, "uuid": "f589f4b7-5622-422e-b20b-6c3421411971", "comment": "Malware payload (NetSupport)", "value": "646f739241e98f819327983bb8083baa", "object_relation": "md5", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269237, "uuid": "27eba8bb-88e3-401e-abae-442b8b02000f", "comment": "Malware payload (NetSupport)", "value": "481e0358bcca348ee18311fa3f99228d7f09260084e54a7bf142614400b06919", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269237, "uuid": "2a8892a3-8fff-4c30-844a-dd0dad4a678a", "comment": "Malware payload (NetSupport)", "value": "4128e2be4ba0d56b2641a20f5387d3ff7bab12a1", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269237, "uuid": "bc3ea48c-588e-45e2-adb4-79bb50f06415", "comment": "Malware payload (NetSupport)", "value": "c2a6f62a6747328c8c660a4109b8333208002447fa7e8133463160b28d7827ddc8bd89ca14823ede1b5d5127f2ecaf85", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269237, "uuid": "ad4c7ac5-47b0-4163-b123-93e7063ad315", "value": "T1B095330E1280D6EC57A11AFEFCE3203D949905C4A83DD4BE54BF3356F234166EA36A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269237, "uuid": "154c231d-dead-44fa-97c1-9023bf17e94f", "value": "49152:/0f21gzJUHCrs1dcQ5nLEg9BFhE9l8OjzVQC/iv80lyKvW/EwEphN4Gzv:/0u1SUHCrQdcORnwl8OurdnsdEp7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774269237, "uuid": "3f9a3ef2-e809-41fa-9a8d-9161083244f5", "value": 1990828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774269237, "uuid": "a4a0369f-b985-4c72-8f0a-9895cc0bc232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269237, "uuid": "bd264757-8229-48b1-82fb-a35e9dfec556", "value": "situationlaboratory.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0bb456-26d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774284984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284984, "uuid": "2e9ab05a-13c9-484f-aa37-9e28624dce7b", "comment": "Malware payload", "value": "c6fcc61eb707a95e6a83adf817d3d9a5", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284984, "uuid": "e6e46e3f-c931-440b-9a91-023b997742c7", "comment": "Malware payload", "value": "485446ecb53a6177b1ea3ab63c351f6c30db5b3958fe36363563d6fd6b0f0b69", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284984, "uuid": "f7d2b0f0-5e4c-4b45-9f17-c30d3c5a4cba", "comment": "Malware payload", "value": "45e8be271f5a5f621569dbe0a5621a4a10f18929", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774284984, "uuid": "fcbf96b5-2d0a-48d3-9df9-7131265bebeb", "comment": "Malware payload", "value": "54fb7e23f5c7ffc5627c378dad94fffba408fb8d48836a967d5b3617b6366e0edea9c0cd65b7bc50db57edf0e3525433", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7539562627", "colour": "#D77557", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284984, "uuid": "6feda53a-e497-4667-974f-729e6f9ace76", "value": "T1D5B7AF12BB54EEF1C8AC0739565EAB34473200299F83774213E0757EADC65B03FAB65A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284984, "uuid": "54900487-d6b5-4607-805a-a519824f46a7", "value": "f81c1a7f6377a4b71fabeeda0b77d441", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284984, "uuid": "1a5aaba8-6dd6-48be-9c51-139eb920a9eb", "value": "98304:Wp3fpc6VKb8vT6lezN47flyNLq+Ne9Ut6UY90BDzeVvYs8+Kmy0wpDDNW9ymQbae:Kvy8bJzySLq+9Ns8+KTDkI7/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774284984, "uuid": "4f8f8866-118f-49f5-be16-c9f17a50c851", "value": 47992434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774284984, "uuid": "041ee3e2-0bf1-4e3f-9b05-226c7bdaf70d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774284984, "uuid": "ebaa98ec-0388-4adf-88cd-2ea7b2da286b", "value": "485446ecb53a6177b1ea3ab63c351f6c30db5b3958fe36363563d6fd6b0f0b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d939cc-2704-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774303744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303744, "uuid": "03d9c00e-0452-478e-9d7c-7dfef20a4114", "comment": "Malware payload (Vidar)", "value": "b4d751166109f974126bcd0c4c6e47d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303744, "uuid": "1c9c3adb-7dc4-4b5b-9e25-c47a8c3646b6", "comment": "Malware payload (Vidar)", "value": "48548d9678e0433d52837ba124819ae8e7ee54641a96936b32b46deb312f2463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303744, "uuid": "8a84fcd2-ba5b-49a7-b9e5-575cee3f99b4", "comment": "Malware payload (Vidar)", "value": "2be7201a92c9a1bb2b4cc86a0c182cbfd777e224", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303744, "uuid": "8978599e-b88d-4bd7-8da0-c473c7511dbc", "comment": "Malware payload (Vidar)", "value": "c03d167352328d48a0d594da16b6d6b54af52a0542bb7895ba1803e525021cce00d3b976d652e48832dd26ea6faf5719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303744, "uuid": "cbafaf3c-d7cd-4f65-997a-10768c7cad16", "value": "T17D66F76B32649168DD5E873BC06B8EC0E4F371750B3ECEF7069903685A45BC8CEB9265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303744, "uuid": "3bb49c76-1d40-4f97-9b01-5d5d74adbc69", "value": "98eaf7b60465e0041ebf75ff2f585089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303744, "uuid": "ce3d3859-9416-4a70-a301-20a7b2a7c7c4", "value": "49152:Sjh2/bYALtCrY1AsvGzkk02neSAlnevxNN3j6BWG/arBjbA:SQ5m3j6BWG/+NbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303744, "uuid": "ddddf078-3f34-4f03-b6c6-23facfea91cd", "value": 6866432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303744, "uuid": "144efa75-625d-4ecd-9cbb-3f2bfb5afd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303744, "uuid": "59b061fe-09c6-445a-887d-0a991d356d69", "value": "wzyak9hrh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5e2231-26c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774278256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278256, "uuid": "92b7e4b2-dc22-4d76-be8a-0a4934c00cce", "comment": "Malware payload", "value": "8b72fd3a6d60eaea5f4872dc1b026d26", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278256, "uuid": "ab92cd18-76eb-4bed-b7f2-bbe47fd3c4c4", "comment": "Malware payload", "value": "485daddbbebbdb38d77162f0026f7dd50de3ca3fe49cbd25bd708c34f10f4b8d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278256, "uuid": "16e96bad-495d-47e6-88cb-75c31b11b707", "comment": "Malware payload", "value": "9d585ec186e1e6ba10e986b96fe28814b8e3ee38", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278256, "uuid": "2d7b5d3a-8ff3-4cc3-9708-f0c8fa69a840", "comment": "Malware payload", "value": "b55fd136ec39a596654b782a25c34f989dd295339233f398d0539ae17834489d5b06ed86391e244fc2b166449bcf2342", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278256, "uuid": "abe91030-fd36-4918-b632-760cefbc6321", "value": "T1B8545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278256, "uuid": "c1ee58be-e6ae-4b14-99ea-a4b719def3c5", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278256, "uuid": "d2ac03cd-1c85-4b89-86ea-6db338b6cd47", "value": "6144:PBfaB/yttqQ0XWhGF9HIkHyUVdA31W73:ZfwKttq5XWhGF9HIkH337", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278256, "uuid": "14387d38-7dae-40d0-8c03-6290e62fc06f", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278256, "uuid": "e3010035-7f3d-40f3-ad01-e95d13dbb91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278256, "uuid": "a4a46033-aec8-49f5-b97f-8f3aa16aafd5", "value": "4a3b003994112b4dd24ac8b9cc4757f4a12576b57b3cc8f5028d85fbceb7c405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a8b9a8-2691-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774254189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254189, "uuid": "e6704377-eae1-4b8a-b0c9-436e93fa99b8", "comment": "Malware payload", "value": "35cd46ee2d2917c025badd6a745285e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254189, "uuid": "996a6ed4-c654-4209-846a-0a010a7f5789", "comment": "Malware payload", "value": "48e54b857db34dfeae0879195df4861a7d2818f6e736967e056761b4451cf4f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254189, "uuid": "f0eeb32b-029f-4f59-b77d-844d8f0293da", "comment": "Malware payload", "value": "fa47f6f03010026749c2c0057dc85df5ca8367ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774254189, "uuid": "ebcf174d-8092-47da-bfba-ce67a2553170", "comment": "Malware payload", "value": "e44799975485b9774741dbd48fb3cdf476d94ba833408b70ab804fdfce16572d53ee7582ca0d3ea1ae5b65bb3e2716a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254189, "uuid": "b6a1b037-0024-4fcb-a8fd-346f6ebe40ed", "value": "T1A3E58C17FCA018B5C5AE62358933A9957B717C041F2263CB2E90BB782F73BE09979714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254189, "uuid": "64c0dcf2-7121-4d96-bc1c-48aaf7afd307", "value": "5061d15a50b8f9ebb267db1f1fc80a9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254189, "uuid": "2ac54d76-06bb-4275-b168-2f2313d9aeeb", "value": "24576:4wMFmRLoZLzj/NjLsd5fuFdxS5PZnS9Lh4UccmDjSTU4o/GXbmJFbhlykVyjb2zv:4wMFo0ZDNjwPWXS5PFS92Uc3DjwUDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774254189, "uuid": "5e90e1c7-655f-4b13-8556-0fa7f9f9a98a", "value": 3181056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774254189, "uuid": "d32d31ef-e5c1-4e16-b8f5-95269a4eb7dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774254189, "uuid": "56ad8682-092e-4f99-ae6a-2d2c5f6608d9", "value": "48e54b857db34dfeae0879195df4861a7d2818f6e736967e056761b4451cf4f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa88ffe7-26aa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774264987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264987, "uuid": "5556e4be-5089-4386-acad-26e2d90012c1", "comment": "Malware payload (AgentTesla)", "value": "d5723f4a195bb86f13b868b28b299d78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264987, "uuid": "67f07521-40e5-4e4e-8eed-b905a5fc7a26", "comment": "Malware payload (AgentTesla)", "value": "4a3dceeb78b221bffb12ccf076ca0e59712f0dd34de0688a03b2d5a30c27bf07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264987, "uuid": "b61e0f53-c7d7-4b42-a160-e65f405b0559", "comment": "Malware payload (AgentTesla)", "value": "06cdb7350aa166ed6d63a2c7d0c6eafd0ba41e23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264987, "uuid": "d9eb985a-f4c0-470e-8aca-a2bd482e6633", "comment": "Malware payload (AgentTesla)", "value": "42ed6d143ecc0d39706dc4ff366f5209a51a92c7513217fc6f658bce788671d1a90bc15a50532391c9a8c0cdc2b7c4e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264987, "uuid": "ad500594-e776-4b9b-884f-7f3970437eed", "value": "T1C394DFBB5B2F6A0AF2C066141F52630F1EDA95CFD8BA71FACE4B477402801BB5146B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264987, "uuid": "70d4cf15-cb0f-4313-80e9-dc1aafbf0dad", "value": "6144:zh5EGENKfoTg6WGPNrgtPQfqskVxg+7r9cPI1I6z+jufq2z9fdNRmKv:zPlENKfoc5ereQfqskMJI5zffq2z9fdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774264987, "uuid": "6924edba-5253-4b66-855a-a5740edd1cf9", "value": 426232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774264987, "uuid": "b7765758-7da1-48aa-b649-2aab930c0016", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264987, "uuid": "a710fdf6-cbaa-4adb-a263-f301bd8becc3", "value": "Kugle.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dcbfc2f-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774229183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229183, "uuid": "f07e9930-db19-40a0-916a-347c0f664abb", "comment": "Malware payload (Snojan)", "value": "acfe0d3620a453a847b84af0a03da079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229183, "uuid": "907f49e8-f1d4-4b46-9899-58ac98a7cc3a", "comment": "Malware payload (Snojan)", "value": "4afd6ca5d407f3b5bd3709b9dcabf3782406f97917b256acd58cabdcb6d24bd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229183, "uuid": "bbaf3edc-438c-4cf2-9d66-4bd7818ba44c", "comment": "Malware payload (Snojan)", "value": "69da75e374cee2bbf727555da175d479a7d51426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229183, "uuid": "b375fc90-b874-4582-9fbd-b12b55b4cb14", "comment": "Malware payload (Snojan)", "value": "317c2e2c37d99a4e39a76c9e02bab44d6d75d369e9fc6689ecddee3ea723d616ca7a89f7067f4067a8e3220e515479c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229183, "uuid": "90f3c2fb-b9d8-4b77-b0a9-1bd5c7268e27", "value": "T17C345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229183, "uuid": "c1f8b9a2-c838-4f48-9059-3ed5c22afc20", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229183, "uuid": "788857ce-914e-49c5-93d2-02062bd9b788", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/E/FnncroP9:wwDeM7iNEkgiOb31k1ECyJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229183, "uuid": "5aa9748a-a76c-4b89-bf79-a83746ab2cf8", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229183, "uuid": "ed0c8aeb-5184-4d53-b1eb-4deb025b0354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229183, "uuid": "cdf9adce-1c2a-4b4c-972d-4487e863e27e", "value": "4afd6ca5d407f3b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619906df-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250691, "uuid": "5a68e55e-3f6e-4f04-b774-9edb7aa09e5d", "comment": "Malware payload (Vidar)", "value": "f03489e8f3b102a8417df05fa7c04282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250691, "uuid": "5f0a95ea-10ee-4a5f-9555-6bcc0ff7c0fd", "comment": "Malware payload (Vidar)", "value": "4b5ea905b3011b7751470ccbf274f17508c7294c5795c02939509eee0d5e1404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250691, "uuid": "3aa11a59-49c2-4a4f-8684-4f69d09c01f1", "comment": "Malware payload (Vidar)", "value": "5a80038ab9a0fafa13641f97178c3771cc2c0be5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250691, "uuid": "dcbbeead-129d-473b-9297-7e0245e9c0c7", "comment": "Malware payload (Vidar)", "value": "fa0ec084d9e3f1c7b8d30afd4a8d17beb3f83bdbe8c75d01f1cf264e601ee41d5d39c6409d567dd910b6eee14cb8900c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250691, "uuid": "58361331-12c7-4159-9c00-16d1b07ff567", "value": "T1E8A57D0BBC9509FAD05AA3368CB762927B71BC490B3233D32E90AA782F757D05D75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250691, "uuid": "8b8e62ff-5940-487d-aae8-c2b1f32b383e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250691, "uuid": "2dfe18c2-a4c7-4033-877d-12b5ec573667", "value": "24576:pNnK3EN6sNk7zWPPuf4kQNjbHmQ/ppaFAbxxvzbT2I9+BsGPcsFhele5n923bDjb:pNK0NLk7y84kQJbPpUF4xxn+cPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250691, "uuid": "3ebed843-64cb-4fc8-a36c-1aebc52648c6", "value": 2248912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250691, "uuid": "2a822d69-7f79-4ae0-a12e-a787fa55dc0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250691, "uuid": "cc29f83a-9396-4732-b084-04e47eb7557e", "value": "Bootstapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20b6372-2674-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774241833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241833, "uuid": "d6b91661-936c-4733-9787-9bb013d1cbcb", "comment": "Malware payload (QuasarRAT)", "value": "2f06b57ee4f456e4f4daca862495b7d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241833, "uuid": "0d3daf5e-c5e5-4d52-98f4-ae9c9a47ceff", "comment": "Malware payload (QuasarRAT)", "value": "4b66489da4e9b7073a0432c07b55205453f3f65c427f871c7114ff2ad1dd3713", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241833, "uuid": "259e204d-88a8-45d1-b9f9-62fcb3da2eb4", "comment": "Malware payload (QuasarRAT)", "value": "87b1b2d652e974ee3b4aa61a1f6573a4c42c258d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241833, "uuid": "20602796-6373-4287-abcf-8e74f5f23d34", "comment": "Malware payload (QuasarRAT)", "value": "068a12b30612b4c5f532542eea1ab4d81ecae2b3a7b4b9989acefe26b76b5c19e2274641a61214e2df6d4e9c98e6719f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241833, "uuid": "fff5bd6c-fe44-42b7-95f4-18137711d43a", "value": "T1CBE54B0437F85F33E16BE67295B0401667F0F82AB3A3EB5BA581A7791C93B108D417A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241833, "uuid": "007a6e69-3063-4cd1-81cb-b8bc5f953c48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241833, "uuid": "f20eff20-0c6e-4b19-be7f-0e10997fb4d5", "value": "49152:NNba/aHKcFgv9uFqAVau0cPTOVCgZCqqKDgTHHB72eh2NT:NNbaSHKcFgv9uFqAVj0cPTOVCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774241833, "uuid": "92f2cea6-b770-407e-a593-c6e6767f76da", "value": 3220480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774241833, "uuid": "16469a49-9ad4-4720-a118-913094c9deb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241833, "uuid": "a997aa17-9cd4-4ab6-a676-19fc34fca2d2", "value": "4b66489da4e9b707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363b3edb-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277677, "uuid": "d9b4a8be-dcc6-4746-8661-aba93fdddd6b", "comment": "Malware payload", "value": "586d283e7a8979168c2270831ed8bff6", "object_relation": "md5", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277677, "uuid": "60be8889-d065-4b12-b090-909398055ae7", "comment": "Malware payload", "value": "4b8297daccf9745b585916ab4466629c645749350563eb9b697326e11f2ae420", "object_relation": "sha256", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277677, "uuid": "ba08e989-7761-4fe7-abc0-65e2d4ec757f", "comment": "Malware payload", "value": "aa26beaa960db344fec87df4f26414242d3c3d44", "object_relation": "sha1", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277677, "uuid": "1e213f57-792f-4f9a-9940-54c448ae0cbd", "comment": "Malware payload", "value": "59a449e1e31046c5a850bc7df2b021ee6654ba4fc8cd737a06fc323d145349dbbea4e4fe403af99a99c25b55ddee6bb3", "object_relation": "sha3-384", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277677, "uuid": "48feab4c-2109-48aa-b2e9-e5c6845fb979", "value": "T14F31BC78CA70FCC043AD7290891A3E0B20A44A67CB758F7CE552089B3E1D661DF2A58C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277677, "uuid": "3688bb4e-5ac5-4da6-961c-b89d088b638b", "value": "48:EkTsIgYQdt4PvpMf4hZCU8vHfIDz8eZpwui:EasVYoKJMf47vyHwflZ65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277677, "uuid": "05779e52-d96d-40c9-a3c2-310ba40279cc", "value": 1643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277677, "uuid": "846eaae4-39f0-448c-970e-0661b38594a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277677, "uuid": "e6be68e1-1d33-4871-930f-6a2974ae0712", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeea7dbc-268c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774252109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252109, "uuid": "3f82abd9-df06-46ae-a82b-87e6d51205c8", "comment": "Malware payload (Gh0stRAT)", "value": "dd717c0e4571c5506b9aa71bde00a0ea", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252109, "uuid": "030fa3db-2558-4357-b7b9-9a528deb20ae", "comment": "Malware payload (Gh0stRAT)", "value": "4d0ac144f8c297610edb552710c198eef0bac2ac1cacd8210a437941dae3987d", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252109, "uuid": "7b994b86-077d-423c-8d5d-5e04fe33ca23", "comment": "Malware payload (Gh0stRAT)", "value": "6337d8a553f28747abfdf8efe9ed6cfed125053f", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252109, "uuid": "05289493-9bc3-4275-a4d4-e919a719004e", "comment": "Malware payload (Gh0stRAT)", "value": "46b63244c8405382ed6f4edec9747eb82a5d3cd70b76444e1555e7dbb3f5e749b631cdeafb26cf8ce237647e16e9b932", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252109, "uuid": "2f2e72a6-9d49-4ef4-a096-c020d5f5f9e0", "value": "T1E9769D41AA52C8B2C3851430DC7AF3F917657E49ABF24677B1D0FEEB78721827C2521A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252109, "uuid": "c0b6e402-b722-447c-a25e-b9683f915ea9", "value": "ea481caa6554015fdb38adc08fe780a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252109, "uuid": "d9381905-afb2-422d-b77c-065a14893463", "value": "196608:acp0NU0OajUHC/bbID5XTtYzM75pECSpwWNQP:acuNaaU6E5Cz+5kP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252109, "uuid": "03384f71-74b9-4d89-9497-407b3ba1713f", "value": 7319552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252109, "uuid": "a4cde45d-e54c-4640-b840-36efdd26d7a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252109, "uuid": "72cbaa84-6081-41f9-ae83-76fba0928121", "value": "Gh0st.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8fc245-2688-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774250307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250307, "uuid": "d304c477-09f3-464e-bd6d-2f787ed5c7ec", "comment": "Malware payload (SnakeKeylogger)", "value": "043c0620f2839f4152ecc02daa9cf32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250307, "uuid": "5c476d85-04b9-4f11-b00f-3f833af9c4c7", "comment": "Malware payload (SnakeKeylogger)", "value": "4fb1c62f75a74fc547b2aa6ce7d8d147419212045f4d0a83d571fb93e4610613", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250307, "uuid": "a4bed9d0-452c-4a20-bb17-8c49988f2afc", "comment": "Malware payload (SnakeKeylogger)", "value": "0802467ee75249fafd9acb340076a3f4f85bca42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250307, "uuid": "7ebd6d07-8ca2-42a4-a9fd-8c56920a35b6", "comment": "Malware payload (SnakeKeylogger)", "value": "87c05b33dc46f6279ee45b7756af2e6ba9c0f642787f72366e8d9a704227ea6d75e5a58a6c071f5cba20007f0332592f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250307, "uuid": "b7918d52-9218-4b38-bf52-055d4c9cc07c", "value": "T14D250111375CDB02D8FA27FC6966E17513B96E9D9431D35ACFC82EDB39A2B011A08393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250307, "uuid": "587cadaa-6f2a-4323-8a58-5384846728cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250307, "uuid": "72f49ccf-7ffb-45f5-9130-ed8f80968c0b", "value": "24576:ym8rPjL7cQ6tgLuzR44aXYyemghXpuda78+MJ0gO:yP/4dth0IhXAduMJ0gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250307, "uuid": "d4eef948-29e7-4731-9ea1-0adc1536f076", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250307, "uuid": "c7640304-d80e-41ab-9b7f-d710c076b333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250307, "uuid": "2afa8e2d-efac-4f3f-a48d-5efe982f72d9", "value": "RFQ - 43432187-6HARADH & WUDAYHI PROJECT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4194c47-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "7798d5b4-9ff0-4abe-ab4b-9f8372856836", "comment": "Malware payload", "value": "9ac80c2227dd130e5df0dbdd029f7b79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "0e8d69c3-0791-4892-b9c5-c9dfdb823e7b", "comment": "Malware payload", "value": "50724c91065350fbee65e48d290226b6cdb12dca071aab4ea44e0e3f58295505", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "46f6ba2d-6315-4eab-9873-cab6146ee87a", "comment": "Malware payload", "value": "ee47855cd641e1703ff5b28cfb4e186e3e621be2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "66a4defc-d426-48b8-9ae4-e6e0a202a823", "comment": "Malware payload", "value": "0e5190bcd3944c6f5480d069d6839634997e63bf970d3faa0d581a8f1deb51a894a1816fc82d6b9866e4eba45c13b9d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "ca097dab-788f-4159-8603-083412afb836", "value": "T119A69E11FBD89B29E4FF0177E472026006B5EC486B17E7DB6148B8E928733D219B53A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "b51b17dd-4ae0-46f1-ba2b-9209f99ff388", "value": "77269cae0968bddaaee2b7ffb668a92c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "d4a40f71-4375-4ca6-b53a-895430c227b4", "value": "98304:60851GxhiehH7MZcnieml333TQH2wPn1FO9c2FoRA7D15rEQzsKMy:6jPIUZ3QHhFO9c2FoRAnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252145, "uuid": "cda28e08-b38d-4d84-824e-62a7ddaadcdd", "value": 9692672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252145, "uuid": "d61b4f25-f3d6-4a04-9e2a-3fe3f609502e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "5be19f74-35f9-484a-b0bb-4da97d1ffd50", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3915d0-26b4-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774269234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269234, "uuid": "3de416a1-7f54-44be-aadb-86f144989445", "comment": "Malware payload (NetSupport)", "value": "4de40662bea1dec82e44be0081022c72", "object_relation": "md5", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269234, "uuid": "5cd39638-68d9-42e9-afab-d94d695c3643", "comment": "Malware payload (NetSupport)", "value": "50898fc645aee8e8070095ec40ba4a3ae712c973dad75e82b0c5e172323e6519", "object_relation": "sha256", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269234, "uuid": "db2b9bc3-120e-41d8-a5fc-c1776483ada0", "comment": "Malware payload (NetSupport)", "value": "5c8018fd14806587289874a9c93d5d54bdae08bb", "object_relation": "sha1", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269234, "uuid": "6bd328f7-385f-4fb9-b2b9-5e5536767742", "comment": "Malware payload (NetSupport)", "value": "6ec19f5ba28369d277d6ce2096ad841f7632f5a0f8d231d17490a372cc53f29f81b996dd03eaf6640df447ed70432eec", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-242-229", "colour": "#EBAC12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269234, "uuid": "0e9ed78b-c6ce-43ba-b911-ede21af98d4f", "value": "T157F52341B7C58C72F43329777A25D618773978280AF184BFA34C795EAD31A8056F2FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269234, "uuid": "8fc67ea4-01ee-41b6-8484-1427f53426f9", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269234, "uuid": "7b2eba99-0cd4-4690-acae-4b2e4dc6bfce", "value": "98304:yxW4LsBoB/M4yLAC/si3Vkd9ufD+B0Y+Irz24S:wM5UC/sC9fyuY+ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774269234, "uuid": "9148a76e-ba99-4474-9975-d6bc8410cbb5", "value": 3405791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774269234, "uuid": "c235dde6-c282-471c-89c7-c97815a0c3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269234, "uuid": "f2b38fa4-c3fa-497b-8d72-7d720d9c2324", "value": "50898fc645aee8e8070095ec40ba4a3ae712c973dad75e82b0c5e172323e6519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36172f84-26f9-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774298722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298722, "uuid": "82bcef6d-6585-4a44-ad26-fd39fa47f8da", "comment": "Malware payload (QuasarRAT)", "value": "80576d829fed30c90d244279387af368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298722, "uuid": "9377a8d3-3bfd-454d-b92c-3f3aff2709f6", "comment": "Malware payload (QuasarRAT)", "value": "515a1964e8ba79521393a6d4b10fd33de62615940a572d13401c6ce440f53a44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298722, "uuid": "0b52f8eb-b97f-44cf-8794-bec375ceb6d8", "comment": "Malware payload (QuasarRAT)", "value": "51b4b8d5af52155522a8ae622c4c3907f24249ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298722, "uuid": "f41956b3-4fc0-4948-99af-d911d03f5ae4", "comment": "Malware payload (QuasarRAT)", "value": "a6704fdc30ed2f1f15df33282bf51e38a4eb9fd9787fc72fc7c5d31abb95fc160cfa88189e15f1bd2a6d9e330a0bdb8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298722, "uuid": "6aa83814-21f2-4df8-8aa8-511d48aef7ee", "value": "T19FE56B143BF85E27E1BBE677A5B0041267F0FC1AF363EB0B6581677A1C53B5098026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298722, "uuid": "75ba8b72-6179-4ff3-850f-b5981fda5653", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298722, "uuid": "e02d9a2a-5c30-46d3-b335-eb1644662a25", "value": "49152:LvEA62jiaQDKwPFlJn3xFQsZQOVNRJ64bR3LoGdpTHHB72eh2NT:Lv162jiaQDKwPFlJn3TQsZQOVNRJ6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774298722, "uuid": "7170104d-8ecb-4fe9-8061-46c695260e9f", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774298722, "uuid": "21c1e9c8-dae5-483d-a9d5-325330296df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298722, "uuid": "48235611-cfb9-4130-bc84-5c804313e0bf", "value": "MatrixHub-CRAKED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aeb30b-268e-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774252897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252897, "uuid": "d0840e65-a350-4fd1-ac5c-fc16f40d25e2", "comment": "Malware payload (NetSupport)", "value": "66210f25331f16017346a7b342b257b0", "object_relation": "md5", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252897, "uuid": "e5afe95d-00d3-411d-b0c4-12fae52eacbb", "comment": "Malware payload (NetSupport)", "value": "51f3c97998c9803149d4fba98331f62522817d5b8276f82ff650aceddbd8e7d5", "object_relation": "sha256", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252897, "uuid": "10ad7ce8-6162-4e96-a40f-d3b3820288b5", "comment": "Malware payload (NetSupport)", "value": "75a28a426df93295b0e04f64c6e0034ebb1d4fe3", "object_relation": "sha1", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252897, "uuid": "9424b525-ffd2-4042-ac3e-57de03ce8852", "comment": "Malware payload (NetSupport)", "value": "2ab07bb9bc1174928aad5ea4fb2618d442ee06adb6053408378340c4fbac120e173a75b2112e1bbbd133f2c5506eb1f3", "object_relation": "sha3-384", "Tag": [ { "name": "aff-shrd-rt-in-net", "colour": "#24080F", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252897, "uuid": "f7cb88d1-0bbf-4f7f-86c2-f015d38871cb", "value": "T14CB5338DB64DC57BD13DC132409EAF396BEC9867E70739B7436988DEA80994C63D0316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252897, "uuid": "e5343c16-6088-477b-b7e4-73edf75162c3", "value": "49152:VTjW0xx1hwCYrp7lnMsn9aezOCpLwZQTmXzSXe0l1Do8mWLawS6Q:VTqGXhtSXZOWLrTmDSO0l1Dn4oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252897, "uuid": "310c38bf-3006-4f16-bf18-65bc2369efd0", "value": 2315139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252897, "uuid": "b3dbd94a-b326-49ec-9224-1bc82dbd1dfd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252897, "uuid": "4b6f9b66-a460-4552-86c4-6d009c63d851", "value": "firewall_policy.conf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86ff4d2-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283076, "uuid": "c7b36def-17de-45ae-b9ce-db651056d11a", "comment": "Malware payload", "value": "ebc522836a59b3a6102486ae58efff4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283076, "uuid": "018c3871-0f0b-4ed8-b65e-8047223ffbb6", "comment": "Malware payload", "value": "520375c83b097bdc2f83d32e1327a0826878f1ef3815e98210a484e625d2621e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283076, "uuid": "1d5ec802-c9f2-45cf-8257-a48d38533b2d", "comment": "Malware payload", "value": "eb3094c9a1b8795b03b14c3dc2680b79081b52a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283076, "uuid": "c290c367-9b48-4f4a-bd64-e20f1cbcbaf8", "comment": "Malware payload", "value": "cad64515d56b049849e4e66411b0d0f772549dc0f96a82e4f3e9cd484af17495f789698d257b3165815846c68f5a613f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283076, "uuid": "7019d195-37f2-4f5e-97c8-2fca94630f38", "value": "T18EB56C6AF801E952C4E4657AF65EC2C8330313B8C3E93506AE19873579DFACA0E3E755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283076, "uuid": "09e518ac-1cbc-4fce-a11b-88b905296dd8", "value": "24576:F4VFMnshrXcb6wPDq5z7yD7sXiJsZ8ps3WX5Cw1BN7AyLjZ5L9KUDMB:CPcshQbD82H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283076, "uuid": "adad5a1c-98ec-47c7-ad64-228f1b9a419e", "value": 2286332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283076, "uuid": "ddda3629-d3ea-4afb-9fca-43e30d85887b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283076, "uuid": "d631f79a-e12e-4bd8-8256-f7d8c141d663", "value": "app0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d971771-26cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774279138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279138, "uuid": "2973dab9-de43-4614-b387-e76c6d10116f", "comment": "Malware payload", "value": "c5366fe333d3f665e4d588cdb9e1e8c4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279138, "uuid": "b5b34ce7-0deb-4953-aac6-143082e78c61", "comment": "Malware payload", "value": "5291c2302af1007e5fa235e33682441b8a652c10552198181df385450f551776", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279138, "uuid": "e2b25771-52d6-48b6-abc4-ff9489e80236", "comment": "Malware payload", "value": "54a2dcda69fd49a116f59d0757fa6a29c0bffcca", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279138, "uuid": "42fe2238-c43c-42b9-b237-1198e87deec8", "comment": "Malware payload", "value": "f1e01a7db65014a27c061c9e981c58d22e42ce2540fe5ee19dc99d2fc0b0117556cb8b920f6aae2e6110d3851287f601", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279138, "uuid": "7eca125a-5a47-45ab-9639-8a96b8081832", "value": "T1175733CAA412CB87DC738831D1B86699C217BD793B0789837204BBD6B2B3765777A047", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279138, "uuid": "929f0f5e-f7df-4fde-ad08-ed854a686f78", "value": "786432:gcHLmXU4a4N3Gz26ljMUbptAQw9MPu0/bk/g:gcrm1nGHloUFGQw9MPzbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279138, "uuid": "4e4039c6-37d4-49ce-927d-db73fb7350f6", "value": 29499392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279138, "uuid": "6653f77e-0983-4182-9de6-2d72c92c8ed6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279138, "uuid": "18d03179-5698-441c-90e9-cd37f9abd538", "value": "Launch.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac0818d-2667-11f1-a769-42010a9c0008", "comment": "Malware payload (KawaiiUnicorn)", "timestamp": 1774236050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236050, "uuid": "6bece66f-91bc-44fd-9835-9327b0cd0c01", "comment": "Malware payload (KawaiiUnicorn)", "value": "cc84309877edda6313edcd16fd12ac8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236050, "uuid": "9f56a2ef-96ce-42a1-be1d-eb61bdc31d2c", "comment": "Malware payload (KawaiiUnicorn)", "value": "52bbf509e6f229dafc3e3937685f34a3227247c093e011f920a9f0f16b987791", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236050, "uuid": "3ddc626c-ee2e-4503-a006-6beddbcf0c21", "comment": "Malware payload (KawaiiUnicorn)", "value": "5b81aeee4b56af72f94d868b11234f418f8f6a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236050, "uuid": "51bbeac0-9d16-4efc-a9ef-96b4abca2cd0", "comment": "Malware payload (KawaiiUnicorn)", "value": "97853e59f9fa41ee2eca9095bf3bf6baeabecf685902c0ee2c4f0f867bd7987d5398f7e9f63b10a254f893c1be01bf3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KawaiiUnicorn", "colour": "#3DA230", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236050, "uuid": "9a631f06-5bf9-44c2-affb-7b346aff42db", "value": "T1D5A494929C64AB45FE16453427A56EBA004F7D2F66E4422C785CFA0B337399730AFD0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236050, "uuid": "91810f36-d130-4778-82b7-adafc30a4b9f", "value": "5d6cad172c5535e4b6b6bbd246571621", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236050, "uuid": "2056a4d3-3df9-4c3e-9f62-9a0283e48ba1", "value": "3072:AbTzotmNBG8t2bYNPabcvf8/iCKJXepYiJHx6od2Iab++wJka2lZO:AbfoIHt2mPIcvffOZYIa6TJkaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774236050, "uuid": "925516d7-eecf-462c-b6bf-726416dc55e2", "value": 478766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774236050, "uuid": "3d1a37ff-dca2-4b38-bb19-ad4ce166f515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236050, "uuid": "91c24356-0840-4fd4-b37e-38f3f4b1681f", "value": "Kawaii-Unicorn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44298c49-269d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774259232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259232, "uuid": "e56ce4d3-f8d6-480b-92d2-13786a0c3617", "comment": "Malware payload (AgentTesla)", "value": "607666fddb15f47becffad4621769776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259232, "uuid": "d9c7047f-c3af-484e-8840-2f3ee1287fc9", "comment": "Malware payload (AgentTesla)", "value": "52c0aac1045a91b4b399cf0ed194084d7c8880a5ce3e4bc45c6efc18e8f9330f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259232, "uuid": "f0c6781a-48d6-441c-87e3-088809252249", "comment": "Malware payload (AgentTesla)", "value": "b68654ce99d532a3bebee516459de933ed9dad15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259232, "uuid": "3ef36e8a-02c5-47d9-bc75-b74941ca1d1c", "comment": "Malware payload (AgentTesla)", "value": "c075962a7bb16d32831e63e101a946a10cf2cd86f465abf04240b852085a1474ccd42925ba9fa068a64a4a8698f2d648", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259232, "uuid": "397ef1be-f84d-4e2f-abb9-84a96f8835ee", "value": "T1A665AE8D2049AF904A58873ED1FBC700747977A24E162854DE03BE7ABF7E784B61E487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259232, "uuid": "b529a016-867a-4591-b228-a332eeaf50dc", "value": "24576:THOyjdZzhiNZwZ5Ek9DyDIj8K7dZUlpSl4UhVp:7FiPwEwDyDWUlwl4e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259232, "uuid": "7f9c8153-1bcc-4c88-a799-58323c1705d8", "value": 1451122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259232, "uuid": "1f14174c-138b-4926-9985-ed5792ba5e91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259232, "uuid": "6c853052-6e2e-4f75-96bc-1f896513fbfc", "value": "Order_2026-081_Full_Container.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c71b7a-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1774250082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250082, "uuid": "12fda6b1-1281-486b-ab3e-1c28259a1b09", "comment": "Malware payload (CryptOne)", "value": "625c2c2745c1f558a5148dbc509bfd9b", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250082, "uuid": "3d2c9441-7009-4c4f-bea9-ca0f113ecc4a", "comment": "Malware payload (CryptOne)", "value": "542b89df84b56dda6915eaefc450bbf525e831c8afd5f0e620ed7d54d932acc5", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250082, "uuid": "62ca83e0-5138-4169-8d1b-5d9e87e5f19c", "comment": "Malware payload (CryptOne)", "value": "6ff41cdfe0ce6175ff38a28345eb21d410d819eb", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250082, "uuid": "b6f115ff-227b-47d8-9f48-a1ce2305a3cf", "comment": "Malware payload (CryptOne)", "value": "1d93295060bb87619e6be5d7ad357a2f08f8dd574c5ec100403f8cae85458c305c815353bd9e5a7a88f59cce6cb3f57e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250082, "uuid": "9a77cb9c-788c-461e-b2df-5767100e62b4", "value": "T1BB56E021E141A0BFF46989B72C1FE66989A23944F8FC5807BDB41ACC3E2356327FD585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250082, "uuid": "3faac0c1-5d9d-42f3-a2e8-99fd4a362e71", "value": "d4e959c1090e225a59ae091d94757acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250082, "uuid": "1172dcd2-3366-4c44-92fe-16c2c255d03c", "value": "98304:UfNH2lK/GuKBmstKrs+stk6d/tDLoywVyW34CiGxFrfea4B/jkzXg+1acZoPJ:UfJ2lsPKntKrs/tk4/tDLoyPCJxFrfCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250082, "uuid": "76302bee-7c2a-484b-85fa-9a81136e1cdc", "value": 6156288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250082, "uuid": "e529fa1f-d68f-48f5-845c-881aaf67935b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250082, "uuid": "50ef093a-1d80-423c-9595-b3271bf067fc", "value": "625c2c2745c1f558a5148dbc509bfd9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2563673-26b6-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774270261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270261, "uuid": "060e6b24-9297-46b3-8f7a-e4ff083dd19e", "comment": "Malware payload (DarkTortilla)", "value": "78d631abd6ed5d40fd0c761adbcc7198", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270261, "uuid": "17e48580-8934-4ae6-921e-8d17b5571049", "comment": "Malware payload (DarkTortilla)", "value": "54640c7281ade92b6cf79165c948a6c54d37003e74c3868d4bb14edc6e40db74", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270261, "uuid": "6af71aa8-625d-438e-8f58-63a5432384b3", "comment": "Malware payload (DarkTortilla)", "value": "1fe8430d899273d2b1a64cd8960757d5a3313c73", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270261, "uuid": "3ec3462c-3a43-404e-8bd3-c628e0627a30", "comment": "Malware payload (DarkTortilla)", "value": "6db59823049e7af41559facb1af943fc02c191866ddda9eeffe6cbc42198f4417689be825f30f87e43e71aa1604c5744", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270261, "uuid": "b83c01ba-9467-44d3-9ccf-da205889a3d3", "value": "T153E4CF222E577F58C57E1FB8C162055873F0C943A297E76AAFFC00F45963AC5CE2A492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270261, "uuid": "57c35460-14d4-4c79-8141-614d9b29ffef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270261, "uuid": "f2c6c47d-f8f5-40ba-96b4-f0eb77e34e9f", "value": "12288:67nDmn6P0RoxUBgN7XP28r9OMygQHJEuJK+O/7KLnLDr1Vb02ezu+Pi:gD9IBgN7v2E0KR7KLLDPQ2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270261, "uuid": "9a188019-c55f-476a-ae93-311c9e5a9009", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270261, "uuid": "0452e5bb-a0f6-4793-b491-f3b3e7da209b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270261, "uuid": "92140ed8-1fb0-4712-9775-81ad1979631d", "value": "OC-13474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00d5a3b-268a-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1774251306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251306, "uuid": "b866ba5f-ae91-488b-869b-39d3e9ac5fad", "comment": "Malware payload (PureHVNC)", "value": "ab8d2432d8c31d8e6c1cae8fbb50f50d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251306, "uuid": "3e1df41d-7ab8-470d-aa95-dd4fa8f4507e", "comment": "Malware payload (PureHVNC)", "value": "547c51ea56205ea646eed85cc55360d43ae1586932e2fa08ae2634094ac38fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251306, "uuid": "7bb97bc8-0ade-4db6-a476-66545b8e9bc6", "comment": "Malware payload (PureHVNC)", "value": "d98e481ee988fb6cf030b4cfb7726305557fde10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251306, "uuid": "852ba1af-71c9-4420-a86c-220b9a961bc9", "comment": "Malware payload (PureHVNC)", "value": "23da2e383e0a825549d51df2b8ee5163b752e73590fd2dd3cd6421d4791c7627e8e1adb11be3c12bfd3e13e9572af9c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251306, "uuid": "c944d56f-36b6-4708-b5c7-7bae96b8bc8d", "value": "T10AD48DA7B2238E20C2851737C5DB8A5093E5964665A3F34F718423E619073FBCE4B6E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251306, "uuid": "8f8a07e3-5fc8-47de-b75a-0d00d9d189bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251306, "uuid": "1625b8f2-1374-475d-95ac-48d2f375eb34", "value": "12288:DS3SwoOI/SOukWNkQ3q814N3MtPZZ/s1WZlnv53:DSwOSzukWuQKdMtPb/FlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774251306, "uuid": "e8ba5faa-634c-48da-965e-b46214f109ca", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774251306, "uuid": "966f2555-a97c-465b-acce-7734c743e3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251306, "uuid": "68b455f7-dd19-4895-a760-3578a4a112e8", "value": "ab8d2432d8c31d8e6c1cae8fbb50f50d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69744133-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282916, "uuid": "bf16f57a-bb65-4c4e-abfc-85cb1aa794ad", "comment": "Malware payload", "value": "3a172e3a2d330c49d7baa42ead3b6539", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282916, "uuid": "914cff38-a898-4ca1-ae47-36ce6906c02e", "comment": "Malware payload", "value": "54c478b499829a41f57edf93753b9842ab67dc13cff2cc1326ad7ced2f3dc0b9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282916, "uuid": "130425ee-2e64-4bb9-9617-cd493d2cabf2", "comment": "Malware payload", "value": "412f2580770439bdc8379d6cd1a321c17994d703", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282916, "uuid": "055649e1-2cb7-4ced-9bda-c2fc3583de96", "comment": "Malware payload", "value": "7e848c2b02f39e057c6c4d8f9b79555d72a5fa14b4c3818fad3746de48c70a428b9cd9e6c1650fc44e207089807d4107", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282916, "uuid": "93643bee-27bf-4929-af01-9e84f8ad568f", "value": "T1ADA512D2B324B92FD83B01314C9AC2642724AE52CB46A71FA660373D2D773D58F59BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282916, "uuid": "b7d2ad53-2639-4241-87c6-14d48012c009", "value": "49152:LrqVTgHQS8mg8dMWDBdDghzkFYzqB0D6j5MF4uUgOYDR:LrYhmTWybM2BoRFDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282916, "uuid": "6762417f-e0b5-4d77-81a8-73fbce160ff0", "value": 2184840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282916, "uuid": "bfb34a99-2388-403c-8ca2-b8f903b6e125", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282916, "uuid": "d3784fe9-f30f-438d-a30f-6deb6c163de8", "value": "54c478b499829a41f57edf93753b9842ab67dc13cff2cc1326ad7ced2f3dc0b9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c864f4c3-26f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774298967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298967, "uuid": "9220e2cc-3e19-4bb2-a81d-0b7c8e9919e7", "comment": "Malware payload (Mirai)", "value": "ef49779bce7ff97d4613d48f153d8d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298967, "uuid": "bd32b0b0-5ba2-4449-bd1f-6771f6c078bd", "comment": "Malware payload (Mirai)", "value": "54df22fd90c45f9e5969ee574aeb4ca6c7aacd394309d7e919d8d3655c61dd38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298967, "uuid": "33bac67d-07e7-4a01-8cf1-f2fe46967313", "comment": "Malware payload (Mirai)", "value": "8ab999e7bab8d987c9f26390981ce14705324a41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774298967, "uuid": "2fd94592-bf12-4d48-98aa-77497b46bc9c", "comment": "Malware payload (Mirai)", "value": "e2669f4837aa8bce6c564443ca0c2dc2b2f46ceaf4a13746ff565299dca4c553058ebdde038b37b75356658b1724461f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298967, "uuid": "5b4dc6b1-eabb-43ad-a277-08f483c8a966", "value": "T1CC736DC6A643E5B1E8274131813BE7268271EB791029DF8BD7F49B776C32904B2177AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298967, "uuid": "0f232aca-a388-4569-a774-861b4cd52e64", "value": "1536:bb+UPOO/R14cFYqeWc49k7y0F/3u0CdGmr91bL9KWedpe:2UH/RycFYqeH49T01fcr/dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774298967, "uuid": "2eabab2d-fec9-4132-a633-997557ebcba3", "value": 79880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774298967, "uuid": "7c6956fd-8b22-4db8-9a0c-b5610a109129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774298967, "uuid": "d443ef88-42df-4d98-b803-4a53abbb5356", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d2030b-26f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774297616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297616, "uuid": "6ed114aa-6f6e-4894-8f85-1dd42daeac69", "comment": "Malware payload (Mirai)", "value": "41eeae6afcade06adc78d2c0fda08578", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297616, "uuid": "5795b0eb-a6e0-4951-907c-70a9f679a9a6", "comment": "Malware payload (Mirai)", "value": "5676739d342c9927c7159da02e50c9061e5fdbe7068a07f21b87d60dce42bd9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297616, "uuid": "7f762350-b28c-4e6f-b2f8-ddb8beaf6335", "comment": "Malware payload (Mirai)", "value": "92b289bd5c18ed03fda44e1d5b54476f2f1e6f4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297616, "uuid": "bb86a3d1-e335-4f56-b749-f32796ed26e8", "comment": "Malware payload (Mirai)", "value": "d70265511dd2cd54136f07a03e203418ab750eeab6a8e71c7bd19d9ea2503ad2289d5cc805005b0aac7e443eda1e448d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297616, "uuid": "49cb49f5-be77-4508-852a-ba9f6d2b9369", "value": "T1E0930946B9829F12D4D621BAFBAF414933137FBCE3E97102D9206F5027C69DB0E76612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297616, "uuid": "a1358fe2-f2ab-4ee6-b8d7-876606f8091b", "value": "1536:C4n8wBdyGAQ+r+ieRgUvta/BdF31TK+WTiSNlYyiagGX7tY7NObHl:DBdp12+ieRgUvtapdF31TKUegGX7tCOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297616, "uuid": "6599422b-b876-46fa-a741-d857465dc00f", "value": 89568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297616, "uuid": "c5f042ad-77b5-4ddf-a08c-1b4d4e187e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297616, "uuid": "0a854a98-be5f-466c-97ef-9be21a17830f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb5b1d4-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282922, "uuid": "f08babd4-d1d9-4623-814b-05c82fdb363a", "comment": "Malware payload", "value": "09587b0c67d0c9e7211c8b2edb6037ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282922, "uuid": "af8c8ec3-a50e-4eb2-a493-9f71cd7b9cc5", "comment": "Malware payload", "value": "569ef3c50d8c1bb48729c04fc334f26f644ff799c7ba3a514610e85f53cca3d5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282922, "uuid": "7f93c358-df82-4bfa-b6c5-ea1807c38bf3", "comment": "Malware payload", "value": "6a5c857e36a6246d4c8812fe33d16dc986526e89", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282922, "uuid": "10838b6e-7397-4c6e-b7b6-a7d32ea8cc68", "comment": "Malware payload", "value": "121f3ec3a4ae28e045583cbc841d18aaa0a2f396fafbddec605b8c9076d6fe1f3efe0b9adc30a04a7ef86fba9e423538", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282922, "uuid": "0b858043-01a5-46b8-ab91-7933c4f7e3cb", "value": "T19405BE42F709F82FC4B3C3358A75C6AA94055C618B43D367A925B27C8DBB7C08A85FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282922, "uuid": "7f175460-fcca-469c-a788-5007e4145496", "value": "24576:hIYYh5fuF8V8gBW9IRNQ3wv7ySRhXjfCuNN0tV3FH9:qYY+F8WgHRNSwjywhXzT0tVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282922, "uuid": "9b51caff-c3d1-4211-8099-b14ced9fb1c3", "value": 816790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282922, "uuid": "9ddd02b7-ddd1-4159-bbf1-cb4309b14ac8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282922, "uuid": "94c5bd77-b2c7-4f83-ae70-13a173a6fa7d", "value": "569ef3c50d8c1bb48729c04fc334f26f644ff799c7ba3a514610e85f53cca3d5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604e4aa1-26be-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774273452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774273452, "uuid": "7eda5c13-e77b-468c-a7a4-baaefac2d665", "comment": "Malware payload", "value": "02e909b64cc3492199e4e59894284c5d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774273452, "uuid": "8632d813-4202-43d0-8935-4f2e8335a62b", "comment": "Malware payload", "value": "57dba146c98e5b2cb2b9574aa48340d16d2b50eacc4cab7e6c2e75e8d98a95e0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774273452, "uuid": "2206f595-5e0e-45ec-b0bc-75a4bc1cc20e", "comment": "Malware payload", "value": "8a57d386b351e29f1bcced8248ece8d1659f5341", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774273452, "uuid": "e7ac78c3-7346-4ca8-bbeb-37b94ca1ccca", "comment": "Malware payload", "value": "45fa1ba12cf0fb03d921f1c4100302741b4f20eadacad94eb187d4d7025c84c3fb912665d669e0940beb774f34f4576a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774273452, "uuid": "039745f1-6512-4e98-a069-cc0531e46bb8", "value": "T1155733EBE8A243BAEC3D9034ADF45A5CB5A43D180DB2052672B8775568F77E0323914F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774273452, "uuid": "db46efac-a52a-4e10-86c5-a4e3185a660b", "value": "786432:AQ91P96N5L5V8lipyCI8zvckmjKL99P+:Z91l6LdV8li2lBj0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774273452, "uuid": "d4d26a78-4a92-48db-b61e-e77db334ac01", "value": 29376512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774273452, "uuid": "92fd3164-65d0-4787-a8bd-354e9b92a0d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774273452, "uuid": "aa82eec2-d847-4415-a00b-66b313ae3606", "value": "GaIa\u0445is.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c839aa1e-26fc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774300255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300255, "uuid": "4ed2ddd2-9f3f-4522-a3d2-ae271abaf776", "comment": "Malware payload (Mirai)", "value": "44504c350b4b73997d24070b3c44dfb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300255, "uuid": "3ae15d63-9a3e-467b-be23-6b3129a5def1", "comment": "Malware payload (Mirai)", "value": "580519f9509f23a5749fca828c8cd0b62aebb0ce384a22e8acb251e1b71f49d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300255, "uuid": "efbdda75-6f36-452f-8581-8bbe00dbb446", "comment": "Malware payload (Mirai)", "value": "181c42bcfd7fd1d6dacaab4ef297962c4249760c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300255, "uuid": "e7013053-3083-497a-85c7-c9238a218895", "comment": "Malware payload (Mirai)", "value": "5284cac151a7a7585e0555d1a43c6449ea87d7c7d8b743d407aa9187354d7b41ef7d57324cb5d9f33025239984921c10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300255, "uuid": "b13f108a-3646-4fe0-b80d-8c0ed20e58b7", "value": "T166932951B8819613C9C566B3FB5E4299371603A8D3FB3203AD348F75338E89B4F7A895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300255, "uuid": "f97c5814-38fc-4397-927e-d593f14bc1b4", "value": "1536:tkesi3BIGSK7Z+RK1bVP6CPdwNbGU61B/9eAJV2Reb8uOEMTWe74:1Vfh7Z+RK1bVP6CVwNIUAOyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300255, "uuid": "cf00a5c0-0335-4efa-8123-f949b74e1b1c", "value": 95564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300255, "uuid": "d0e39222-482d-49eb-9d74-d5d59e28f9e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300255, "uuid": "ea5f9be7-d537-4c56-b00b-d825ff26d77d", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dfe5ef-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242316, "uuid": "ebc76e28-ae6d-4080-af9a-fde7aef5b940", "comment": "Malware payload (Mirai)", "value": "760402c27085d03f3ce35dde15bb4f94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242316, "uuid": "a50d24d2-e8e8-4c5b-89fe-4fe042bca816", "comment": "Malware payload (Mirai)", "value": "583de6a7260791059d03c84bf58b6f01f614b2220e42c278ef3117457dc4a11e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242316, "uuid": "059ad89f-9f72-46a0-bfd5-60648a6c85f8", "comment": "Malware payload (Mirai)", "value": "fd1446b2fe5ee2c470070d34cd2b0152076f5c13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242316, "uuid": "c8f0de51-c5c1-4a10-b6ac-37ae0fbf82b3", "comment": "Malware payload (Mirai)", "value": "dbd50bcf53bd117c791386f20c73f537e182466e627f969daa6884f68fe5ac33b7913563c47c49dbad9d2afc0ae779d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242316, "uuid": "5633e3e5-21f8-4d08-95e0-07b0e414b3ef", "value": "T12EC30956F8819B11D5D151BAFF0E124E77131B3CE2DE7312AD24AB307B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242316, "uuid": "f32ab4b6-df00-4e88-b336-d7c861abfc55", "value": "3072:f2D7YhjFMX+maR8TcDeRqQV3tNQYciYTG1z:f2D76aX9aKTcRQVnoiYq1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242316, "uuid": "f4ec76bf-b363-4812-949f-f964db52c403", "value": 129244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242316, "uuid": "36c5d8be-c0e1-4c6b-88b6-4eb27fc69160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242316, "uuid": "78d56cb8-cc5e-43ae-ae5c-52c5c21ca01e", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6555ad-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774251894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251894, "uuid": "99f26103-5ac8-416b-a64a-fec20ab54b63", "comment": "Malware payload", "value": "51c7a1496c2337f3ff24f450bec95868", "object_relation": "md5", "Tag": [ { "name": "718e33d", "colour": "#22F153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251894, "uuid": "f1edc67f-cb56-4b43-829d-9949f11928c7", "comment": "Malware payload", "value": "59303dc6a1373c398230c97aedc6f81b80b67fe702c1603631fbe84e0fc6a21e", "object_relation": "sha256", "Tag": [ { "name": "718e33d", "colour": "#22F153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251894, "uuid": "96fa29de-9a75-4f24-9464-df3d4cb5621e", "comment": "Malware payload", "value": "ab1cfd792aca63babca23974a66a0ea05c9bf06f", "object_relation": "sha1", "Tag": [ { "name": "718e33d", "colour": "#22F153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251894, "uuid": "36d59c2b-f599-4263-830f-8bd1adda2324", "comment": "Malware payload", "value": "4d1f1b1d6a179775ba416b6ad3be61f839ba063b635e033e71b0f8e87f0a50dfae28b2af4a37cccb838971f20a43c70b", "object_relation": "sha3-384", "Tag": [ { "name": "718e33d", "colour": "#22F153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251894, "uuid": "154bc989-a46b-42bb-a5b9-a4904011b220", "value": "T1E55362D57AD48C9AEA14823C41EAD232757DB6E0C7534B0366307A321B12FE53DDB26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251894, "uuid": "e75c60f6-6a95-420e-93ec-132da1aecfea", "value": "555c3476734c03d8e4895b10ce9d2516", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251894, "uuid": "ffef6ace-69ab-4a0b-8f1f-fae69314502a", "value": "768:ApcdquCbAJ+81pkVZeuefEqTIYv4gKNwFPvvipGcUPa3gOlr+X:xdMEHnkVIEqTIm4gKN2PvvipN1wIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774251894, "uuid": "5c3936e4-19c4-44bc-93fc-68462615006b", "value": 62974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774251894, "uuid": "ff209007-c3f8-4215-9122-468107e45ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251894, "uuid": "14a1fc48-da49-48fa-aa88-168f98634378", "value": "cookie-graber_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5127b22-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1774250079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250079, "uuid": "7f809e90-c39d-4eae-8394-b93c024c581e", "comment": "Malware payload (CryptOne)", "value": "e33c2134e461d091b9b044095316ee26", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250079, "uuid": "34e53c7f-9e2e-43cc-982a-64910ad9abd9", "comment": "Malware payload (CryptOne)", "value": "5a322e9854e668d65fb1a36e36ed60f44f8f45524ec6301879cd82c24f8b90e5", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250079, "uuid": "a990dad7-aba5-45d9-a7f0-11d6bd77affb", "comment": "Malware payload (CryptOne)", "value": "1f0f818f9ed8d583783f191192d964d45bdb55b6", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250079, "uuid": "950ae12a-9b07-4c81-a281-e783d2580ac8", "comment": "Malware payload (CryptOne)", "value": "482b08211877f00f7224833a14e03fd527d23d2c1ef78650d2a50e1ea07a73d7a60e5ff7baec44a9f8390fe79d70a6ed", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250079, "uuid": "5c0f010e-ae86-4af8-9b10-ba78b6694d77", "value": "T199A58D077C9114FAC46A973689B762A27A75FC0C4B3323D32E91AB782F767D06A74704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250079, "uuid": "47cb375b-3e1d-4c2e-b175-912e25ce35ad", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250079, "uuid": "9caac586-0c3d-406c-b468-ca93491656e0", "value": "24576:McnEy9lNcfuXg15vU+O3vWT3CeujKZY1lE6g5vJpuGiWPKy/ZUey:Mcn1nNcR5vUTv03tCExPJdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250079, "uuid": "c9c861a8-9c71-42f7-8917-b28bcf3bb3fc", "value": 2193584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250079, "uuid": "7431524b-ea76-4932-8ae5-dc41ae47008b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250079, "uuid": "a7c2ce24-a7e3-473a-96f3-96cdc17369ce", "value": "e33c2134e461d091b9b044095316ee26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72fe0231-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252009, "uuid": "0ed15b72-544e-437e-b5b6-f0db4bacd108", "comment": "Malware payload", "value": "ca3f60b39811efdc943a2ccf2c11ae0c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "d4c3c55", "colour": "#B9E75A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sudokiller", "colour": "#AF5D12", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252009, "uuid": "f2a929ca-b12c-4c82-9037-0ae4c6a1c99b", "comment": "Malware payload", "value": "5a5a0657dcf5e52fce7ff6ad331b4e655cbaada15029f2eb4b3abca066d0682c", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "d4c3c55", "colour": "#B9E75A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sudokiller", "colour": "#AF5D12", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252009, "uuid": "76923014-7ff0-4aaf-a56b-50c5a435f861", "comment": "Malware payload", "value": "56a1d2a146bbed1651ec271a8f509989c994a53c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "d4c3c55", "colour": "#B9E75A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sudokiller", "colour": "#AF5D12", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252009, "uuid": "984cdfdf-6f9d-4932-9743-7c1974d031f7", "comment": "Malware payload", "value": "1a9ec1976ac5d91f7b6bd0722d59c9272f16f3e8746b68a765ab9ea341b338cdbeee50445bc1ac872fe8ce0a10e23f2d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "d4c3c55", "colour": "#B9E75A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sudokiller", "colour": "#AF5D12", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252009, "uuid": "3e66401e-e0c1-4c2b-9790-1d5004a99267", "value": "T10093612A3C19E9B9265CC175018B5100E726415BCB666D2DB01FE0BC3F51EE932FE9FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252009, "uuid": "26230607-92d9-4c4d-86b7-14bf344694fe", "value": "768:iAKsIOA0shuvbVHGM3sZmlU5L66f/clFZGBGdvgmfsd5H9TR:iASLTkGM3sbL66mYBOLfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252009, "uuid": "e4d63ab0-3247-433e-964f-d633185ac2cf", "value": 93274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252009, "uuid": "7a492e98-9926-4aa3-8e4d-be89303c3f79", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252009, "uuid": "de5444ca-aec8-4f21-a297-039ea142bc5b", "value": "SUDO_KILLERv3.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736fe507-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282933, "uuid": "da8206c1-9e90-4b20-a2b2-498d52d0789b", "comment": "Malware payload", "value": "bae209115dc34b8c0c9240c525c0cdae", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282933, "uuid": "1b55d442-819c-4abc-881f-6e6686fd49d7", "comment": "Malware payload", "value": "5b2475d4915c5aecbeb66f52fb4e5b5c342144830cc32cc039a6573b5b6cb2ff", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282933, "uuid": "78278aca-7f99-4630-9c99-8013281e46d6", "comment": "Malware payload", "value": "c9f8a5d64026206c82f3071515853b44ec81ee08", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282933, "uuid": "83bdaa82-c7d2-4d2b-b378-94c5f24a9396", "comment": "Malware payload", "value": "4bce08209adb6914338cc4672a5227dfdc7a2d3c416048584ab203bc825cae3878c4686e70af6b47bc5e4c239350805b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282933, "uuid": "6fa09a1e-d6e9-4e8c-abf3-bc060709a1f7", "value": "T1031523FA2266BBD391E3E1386E7856001E770280F1C72DBB4BAEC7615663A09D55C1CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282933, "uuid": "964acf2b-ca9f-40f8-8e00-be77570d6d60", "value": "24576:tPgTtbzDOrlqB9q6FOfGGLG2LEKQuYsiy4rs0HAF8zWc:toxS2AfbayEKLugVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282933, "uuid": "f3cf0cd4-e065-436a-8aef-447b8ae5244f", "value": 884580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282933, "uuid": "9d2ce52f-2fce-4941-a244-1ddbb51a4f69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282933, "uuid": "87baed4f-47c4-495b-8d77-677df0d84f41", "value": "5b2475d4915c5aecbeb66f52fb4e5b5c342144830cc32cc039a6573b5b6cb2ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71cb6eb7-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239981, "uuid": "a05dacbf-636b-46f3-a0ed-eb1aa68a1365", "comment": "Malware payload (Chisel)", "value": "cd024126040b045cf6060d442e1107eb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239981, "uuid": "1fa70a79-d4bc-497b-ae6d-0334e18cc2fe", "comment": "Malware payload (Chisel)", "value": "5c2257ba51c49fa49d52d1f0b5be0b389ca47a94c2e88a00bb9b823339d55e19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239981, "uuid": "8e9aa418-799d-4bbe-b72a-36453b173882", "comment": "Malware payload (Chisel)", "value": "0b6b688668f280bab07282d13b61115c6004f13e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239981, "uuid": "960f2a27-8b67-445c-b9df-8b9d48579c09", "comment": "Malware payload (Chisel)", "value": "b5768355a868e781323bbfd314d74228c8ea16ea174be4c8438a2954025b90e7aed4afbed1081d84ac122bb7bef14d76", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239981, "uuid": "71da38ad-1710-4f7f-85c3-f085e39c5e00", "value": "T1B3163308F7425FF7726A95718CA9151CA0D668C37CBF4828510BC2D1798FB422B5FBBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239981, "uuid": "a4363190-fcb3-4ed3-a65e-5aaa254a4cef", "value": "98304:RcoWuLVQjwPmULjT95c31+Grupxt80ILEYMEe:RmINPhLjTjogGruXtjIL3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239981, "uuid": "325b5803-e813-42ef-9ccb-457720322046", "value": 4053152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239981, "uuid": "a35e11bf-e035-4ed0-abd8-6310fe685e85", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239981, "uuid": "79f841f9-e23f-4539-abaa-930e53e140a7", "value": "chisel_1.11.5_linux_mipsle_softfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ec8078-265e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774232396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232396, "uuid": "f6af6b67-a39c-4104-8737-433e1846487d", "comment": "Malware payload", "value": "d7e2a4d208cd69d4fc1a59e9060b7c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232396, "uuid": "ec998a9a-7623-4bc4-be9e-1788b1618c23", "comment": "Malware payload", "value": "5c74cff374a21ab8ca8c767c583141f2312530f869a8689e4c85975aa4b73cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232396, "uuid": "a7a6c8e2-173f-496c-af99-336607959cca", "comment": "Malware payload", "value": "723efb0a7c4cce4855252aa8de635a81c1935bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232396, "uuid": "a353b264-8fd6-406b-98e4-89dad5bfc345", "comment": "Malware payload", "value": "dfbdacc5e24fd776c0650116e060a43010f7d77b687928bd12bc59eb78f1608c19226320989946147110e68a8670294c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232396, "uuid": "48d25dff-9a53-4c9b-9784-94cd46056b22", "value": "T1FED49E86E1E444E9D07FE07896967537EA363854172056DF33E048692FE2BE0AFBE311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232396, "uuid": "00bd5e00-50ab-4ab3-a653-95cef80ed04b", "value": "a934e79966f071c6dfe4b6534b96ae7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232396, "uuid": "cc3cac84-1dcb-46f2-9427-aa8f30ee99c3", "value": "6144:WYqaALES+W6r96xX9ksZErdDV62q7E6bLWV4+thReOT/JemWluqOne6GQZlwH:Hqj9pW94662aEnG+nRXT/IDEqOnVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232396, "uuid": "8ebd48d6-3dc8-46de-a5b3-4db269ad19df", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232396, "uuid": "d4e774b9-450f-4f35-9327-6e6886bf2baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232396, "uuid": "7aabb859-89f9-4b31-9950-2c6dcad864fe", "value": "5c74cff374a21ab8ca8c767c583141f2312530f869a8689e4c85975aa4b73cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905a75e2-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240032, "uuid": "a762debc-e4ef-416c-8d8f-836a4df08da6", "comment": "Malware payload (Chisel)", "value": "63657b025709468b6b4120ae7bb2bffe", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240032, "uuid": "b6c75164-dce6-421c-b2bf-f8008e3b9806", "comment": "Malware payload (Chisel)", "value": "5db5e7f655c4ee94411df8110d1b6d02bb15574ac199fa7a553ce6c3cb25bf03", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240032, "uuid": "dde21867-2c1d-4482-baa5-79eea2541102", "comment": "Malware payload (Chisel)", "value": "0e67a6c1ae3944d5cdd9dd4b6798ad313da6db92", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240032, "uuid": "4f934190-77e4-432c-8bd7-7eba991910f1", "comment": "Malware payload (Chisel)", "value": "3b742b3e2724111513665adaccaeb91230b35d6b85257acd5c2207251bc490882dcb06f49dab549b31d6966c751f5ca2", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240032, "uuid": "5997360d-2250-480f-8f8d-68d108bce88a", "value": "T1EEB63A43ECA555E8C1AED1748A7296237B727C494B3123D32B60B6342F77BD0AEB9344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240032, "uuid": "8ea485a0-dfc3-4651-ab12-997476bb6311", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240032, "uuid": "18f6d695-17ba-4dad-9759-68ffeda27a77", "value": "98304:IIYFn6q3als/dz9D0dqFp+CAdOmpM5dEu:t293alkfFtdmUOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240032, "uuid": "f97673c9-10e9-4645-9f9a-2a059aaf0ac4", "value": 10931712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240032, "uuid": "71b9d1fd-ec39-4a44-be0d-86fb3dc9b342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240032, "uuid": "979bc421-ec39-4567-b4ad-7ac1fd0b5c08", "value": "chisel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc778c1-26cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774279166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279166, "uuid": "602b4697-8fa2-4f87-88bf-dd5c1a770db1", "comment": "Malware payload", "value": "776b18bde195167e876c75985df06836", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279166, "uuid": "ac5ad7eb-a9b7-4836-be25-80f02052ae03", "comment": "Malware payload", "value": "5e4d891279ef3acb912235aa4e4f937a2f721c26b88bcb56a8b77ba8ccf8e623", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279166, "uuid": "0c8dd2b6-0566-4aa7-92df-d7af2581f710", "comment": "Malware payload", "value": "5a51866a2f133c1ff70b16156fe509b4d4cfe2e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279166, "uuid": "b5473fc2-9d87-4264-8384-b33ae9543b34", "comment": "Malware payload", "value": "f09f90f53c6e3363be1b4c817182afa6d90068130ed6a676e8dd6e7ce874330b887e56e6640bccb1fd29c16915fa04ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279166, "uuid": "fada65df-bcbc-4d00-80be-97d32f82b15b", "value": "T127E733D3B04AABD310F18D3AE179C6E4B25672581B46C9EB06C44F57F1B2371E1AE983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279166, "uuid": "739479ff-f208-41f2-96a5-97596be63f73", "value": "1572864:rmd6g+KdmpziLlZ+dX1DhlN8Pmg3ICIiHawWeab48qqSap4:SOKdwmLlQlVIz3ICIixWe/8qqSQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279166, "uuid": "4cfb8df6-7c22-4206-83d7-34c4bf5e2739", "value": 67300330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279166, "uuid": "04700b3e-cf68-4bdf-b62b-d96757b31190", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279166, "uuid": "14bde2d1-aa37-4f17-bed1-8d77483c87be", "value": "EasyCore.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166e11ea-2688-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774250135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250135, "uuid": "c4a52f6e-1294-450d-bc33-6c6d5200171c", "comment": "Malware payload (a310Logger)", "value": "b4a01c871ec00f0c339383ce1faac861", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250135, "uuid": "5cb1967e-0f6b-4af5-b6f3-96eebba17e58", "comment": "Malware payload (a310Logger)", "value": "5f421afcb8a7912be6b41e2100d600082171be78af8bfaf0cfcb1d652d607118", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250135, "uuid": "630c4ab6-b1d2-43c6-8257-24fdd1bab38d", "comment": "Malware payload (a310Logger)", "value": "e6307241466c1d90b7e022fdd5a23ba1d4dca693", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250135, "uuid": "2c6915c7-5c0a-4867-9c89-4bbc52568e73", "comment": "Malware payload (a310Logger)", "value": "64baca3ed8384ed7be4804f188ffead5c20a30557e3760884a113089255f1019afffbbaf898a18dc695e2f35e11e3fc1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250135, "uuid": "015e7c0f-755c-40c8-9623-43218f95c93b", "value": "T1A6C5AF08A3895EF9B64A185DE27E1EDE93F11FBE5FD2F24D1B22A5063A3B70003D5542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250135, "uuid": "8bdf7ed3-6620-4158-9d21-9fd3664ea33d", "value": "24576:MpVJrhYjIWPj3KOs6CQrnl7wtXsnDStF1OwTGYRGrQUg0IOlYCuu7Y7z239Dt8AF:OJ6nxwqRg0KZkbfDJNwF2Md7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250135, "uuid": "8f4050a4-d948-4013-9b94-db0bde285446", "value": 2684333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250135, "uuid": "52e77780-95e2-4dbf-85f5-afc97d8a9cf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250135, "uuid": "1411a6ea-613d-473f-bb50-215a51ef0584", "value": "IMG_20260320_6789765467.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bbc588-2705-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774304004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304004, "uuid": "1aa53709-9338-4d61-b592-68a55d9b347c", "comment": "Malware payload (Mirai)", "value": "e0d2f8e864220bc038d08bbdf13675d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304004, "uuid": "ef9d15e6-009b-494f-a744-194b99388ece", "comment": "Malware payload (Mirai)", "value": "60a02337b2671c408f5e8292840fae2380ca7189ada6c461c6aaf9fff8322074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304004, "uuid": "dfb01f20-9ab4-41f7-8df3-7046a88b7fab", "comment": "Malware payload (Mirai)", "value": "e1d9357d515ebf8591fe92b55e34315ae0f0ac2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304004, "uuid": "9cff0e07-5429-4d8f-9fc0-96a409de425d", "comment": "Malware payload (Mirai)", "value": "27e5d7d970d59418169f24d1e12b34e763572a8ddfa1bb996922ffa9e0d1c911f854c581ed3de6b08b03f8d47936411a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304004, "uuid": "1faf3f9b-1f54-4d97-9647-ab16357cea08", "value": "T12E734AAAF400DCBDF80BD7BA4453090AB67063511B970F37735BFD67AC322A56826E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304004, "uuid": "2368289d-a2de-4220-9529-6c0dd41f8415", "value": "1536:AZzHMJIdDB7FfekjkrXK83OBHn789W1xizrAdLT2YFy6:AZjMyXFWkjkrXCZ8k1oaqYFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774304004, "uuid": "727a9d52-713d-4334-adc4-1cb85560cdf9", "value": 75988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774304004, "uuid": "3aef1e7b-37c9-40d5-998a-caad2592da85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304004, "uuid": "a6be5252-e1f6-4669-9404-6cea624b7726", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd503bfb-265e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774232430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232430, "uuid": "e66a7c95-7347-443a-9448-26e8d0832e70", "comment": "Malware payload", "value": "7b08a8975c8b764231b3c339f6cd835e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232430, "uuid": "ff49b84c-85d9-47ae-aeab-d891b0b6a233", "comment": "Malware payload", "value": "60fa0d7ed3c6c048fb6e0e6498bed488de110d985f2a262f8282dc576061dcb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232430, "uuid": "1afafe0a-bb1d-4475-81c4-c42c30dee3fc", "comment": "Malware payload", "value": "c487a3a253ef55302a89e350201adb01053c1cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232430, "uuid": "bf92e7ba-9237-44c6-b35b-9fd3f33cd8eb", "comment": "Malware payload", "value": "88be7f19b60c739bc7bf0ab2aee1580cfef03b8b90483da899977eaaaa32ff25758b9a01dc841fe8331d86daca0a72cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232430, "uuid": "fa64806b-20bb-477c-8b1e-a284c275a659", "value": "T160E73310277A9A4EE874DCBA1C4B2901470C11B13AE9D67387D266F9F44FE0D77A8B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232430, "uuid": "f4b5c6e2-05f6-48f2-8a43-fa606c9dad7f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232430, "uuid": "c855d3eb-4560-431a-afca-469c70cef040", "value": "1572864:9te6nrLoxXJLTyxitn3ZilYBmkyxRo1N8ebW+hnMPB7:9FrcdJLTyun3ZilYBmBgzDW+lU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232430, "uuid": "ef264ea0-c3d3-47be-89e4-2c4d5f74ba71", "value": 63889286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232430, "uuid": "68effc46-9796-49c5-8711-fe2d6237eab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232430, "uuid": "87dfcba4-b807-48f5-ac68-e36a3662e7a0", "value": "60fa0d7ed3c6c048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8702c513-26c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774278242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278242, "uuid": "1f1e57cc-fb52-4123-a8bb-efac7a7eba72", "comment": "Malware payload", "value": "4f7fc884cf04c1ab23905687c7f57c52", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278242, "uuid": "7a7a691c-5698-4e1a-85b3-49ecbd6d09c0", "comment": "Malware payload", "value": "61468a87e978ebefe9ac3ddf266d019385f82a71f00d207230f4d1378e9c9a7b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278242, "uuid": "ec92f844-3d4f-47ee-8e16-b2d732bc4225", "comment": "Malware payload", "value": "3bb785a0ffd71ef12231cebbedc7be631a031330", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278242, "uuid": "920f201a-8341-4455-b0c2-1a849260c0fa", "comment": "Malware payload", "value": "21217fc87f9df050865fd35f264a9a331b28f55a871370d48cccb47d1b1994ac94da0b26e24c4df0199c66da504524c4", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278242, "uuid": "1175f0ee-2eaa-47ed-a0d7-cac5310eb6af", "value": "T1CA545DE467F02CF4F826113BF841912DF7E27C1A8B50D56B8366E55A2F235D128BAB07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278242, "uuid": "dd9f15ae-2b2d-43ab-a8e7-fd438d48287e", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278242, "uuid": "d9986533-5623-4b28-9c2e-d6a86756bc92", "value": "6144:YBfaB/yttqQ0XWhGF9HIkHyUVdA31Wla:UfwKttq5XWhGF9HIkH33s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278242, "uuid": "22f435c9-f174-424c-a3b6-d9efc809c5b1", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278242, "uuid": "812da11d-a3e7-4729-b17e-b378070d33c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278242, "uuid": "8de292eb-c868-47cb-8b5c-b6febaa6ed55", "value": "0d74156089292eee308017c8e8a7550739ecb6149ff379810f7c54b1dbaabc91(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83005988-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240010, "uuid": "d94208a6-d24b-4047-813c-793b2571b79f", "comment": "Malware payload (Chisel)", "value": "3dc3b17a988febc4ae8e077d66705dce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240010, "uuid": "2f447e43-516f-4bf5-a604-f44296f86a22", "comment": "Malware payload (Chisel)", "value": "62c3dfec6821fbccdc446fa61324413b4cd9f2823e5dedee269df2f5b31faaf1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240010, "uuid": "9c3784cd-71dd-47fe-a67d-b1ba395c67f9", "comment": "Malware payload (Chisel)", "value": "9783157f55bcd96282d239e129925c424821258d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240010, "uuid": "22b471f1-f5fd-4247-bf20-67e6193bd931", "comment": "Malware payload (Chisel)", "value": "717583d82f35671833a480c58a96c18435bc3ad128acb0d156dc1af83fa295e9b1f50e5d6b347c5af22136dd38edf20d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240010, "uuid": "30c4f281-d9f7-418c-bf8c-766b48a389e7", "value": "T1EB16333F0D566357E2AF666E6C581FDA933F6C3F5A66242AF5C30BC120493A0D25E01B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240010, "uuid": "5f5d7e3e-9197-4de0-9a1d-8d9aca38def9", "value": "98304:7dKhvDOQOAyQyh7Ua0GGIbq2YOeNz1DcW57fu3UEN:7EhvFOdQyh7Ua6Ibq2Ybzzju9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240010, "uuid": "d3763d37-904a-472e-a73c-05508218e208", "value": 4067357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240010, "uuid": "22dec4c2-68f6-43b1-b23c-db79ca3e85a7", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240010, "uuid": "13fda1d4-d1c2-47df-8362-6ad2aeba1d61", "value": "chisel_1.11.5_linux_ppc64le.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "114bb138-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774229081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229081, "uuid": "aac6d826-e7e6-4533-a9ca-305a4a98952b", "comment": "Malware payload (Mirai)", "value": "c45f2086725baea315dc6b007f24a42d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229081, "uuid": "dbb7586c-e3a5-4d8d-83c9-6afa4fea91a7", "comment": "Malware payload (Mirai)", "value": "633bae92c8365891c82218fc20121816daf8616e45c700ab668bcacd6914f0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229081, "uuid": "ded43c6b-54bb-40d8-a60d-e1e48333b91b", "comment": "Malware payload (Mirai)", "value": "147bee0633eabafed5a233f6740edea81263c355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229081, "uuid": "eda866ff-c378-4ac8-a8f8-d5559a4b1495", "comment": "Malware payload (Mirai)", "value": "a8286e2ffaae168546f3ca9d06f4c25d7747bf65b7a2559f988bf6b0dbd0d659c1dc0f96746f25fc5d59b23e28b33125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229081, "uuid": "2eee37c6-863c-4418-a9b0-ac5cbb1ea0a1", "value": "T10D7339EAB801DD7CF88EDA7B84630D09B130729406930F367757FD93BE321A49962E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229081, "uuid": "a4034046-d036-4a82-98c8-9f75fd1e63b9", "value": "1536:l/crqIbbOuAICFFp1lVyKq3yn3tchhV1hA8yEXii+cEoo9:lUrVbqz7XyKq3y2hz1hgm3o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229081, "uuid": "fe16b491-8c33-4d1b-9a7a-5619fa02d5ab", "value": 75052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229081, "uuid": "93061fab-2885-496b-ba17-b0c292ebfe1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229081, "uuid": "2d5f4dd3-0252-4a41-8dc1-c7acaf4a989f", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c918e069-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249576, "uuid": "b404586e-0096-4041-9f0a-56103bc5b492", "comment": "Malware payload", "value": "39a70715fa9d1e47808b6129d81d9645", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249576, "uuid": "4be1fcc1-de75-4e30-b705-cbbf0233cdc8", "comment": "Malware payload", "value": "64370225bae8988721205442d1b9bd566a5ddcab8eefeade52f141f657ba3daf", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249576, "uuid": "3d3a43d9-351d-4d19-868c-29fd5f0a77db", "comment": "Malware payload", "value": "a70a6ad3d87cc1bb88a9efbd289cd384ccd3544a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249576, "uuid": "f85311d5-bfbf-4c36-8e0f-83936c75c55a", "comment": "Malware payload", "value": "ab06a509c908000482d1c49c7cf13ef62bdea7b1b47e13c50c36db9116a5a3c0675ccec29ef72d21191426d54b396f62", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249576, "uuid": "ea37f6d2-a51a-4eb8-88cb-0d31fb598e20", "value": "T1E0663367F06C59C1D87AC83EE0A326D4CBC6221EE043A076E5A17BD8B1E178F18DD15A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249576, "uuid": "44cf386d-d77c-48e6-8538-04fc3b6341d0", "value": "196608:CXU8YYlbHXUZZftUTNJ20uU+HB/OGUElHF:cU8YYlbEZB+TOrU+h/PUEll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249576, "uuid": "c77c420c-93b0-435c-ad5d-873f53db29b2", "value": 6527151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249576, "uuid": "08e191b9-7e6d-4194-b732-deaa24c584d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249576, "uuid": "4de3307d-5c9d-4bf1-b4cd-688d0bf4f352", "value": "surionimyeaqa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0436cb05-2712-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774309375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309375, "uuid": "b9f8c4fa-3a2b-41dc-80c1-617d9d8d9a7f", "comment": "Malware payload", "value": "2534d8d7458fe88b3d361f9de7cb9a66", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309375, "uuid": "df7a99b3-9501-4b52-9258-eafaf7110d5a", "comment": "Malware payload", "value": "6469b020b69eda0df62411166d292141053219c4beaff2a9c4a62cf53d8c7ddc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309375, "uuid": "02b6bbf3-9df5-4b00-9b1f-804673e5537b", "comment": "Malware payload", "value": "6434844e78c497ae3b7e52eacb35f06806c4aad4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309375, "uuid": "1c2d4523-9bff-4281-aef0-dde357a3cf9a", "comment": "Malware payload", "value": "5ce8c79ee67783ba4fe91e0c7847703af55a60a25491eedc78896de3fb521cc73a43df9562bf4b325dc94741c7f4d8d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309375, "uuid": "872c9998-65c8-4074-8c06-d3d8b2a505b6", "value": "T1F3252716B7B5EA21D1BD073AE1F6490047F4E487A633E76F7AC826A90C233539D42367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309375, "uuid": "be7bcf62-110d-4274-bc4e-77046b203e3b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309375, "uuid": "44b585aa-728f-4fe1-9bbd-945ac4c98a12", "value": "12288:6/8qKiSygGyGjuVG7v3mPI26mv5c2B4aHG1mp0:6/VKikTISv5lqsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774309375, "uuid": "dbea16fe-4612-4c1a-96df-be8be72d6886", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774309375, "uuid": "1c4f1738-ae4b-46e7-b1da-d2968244ccb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309375, "uuid": "e228bd8e-cd3e-4cdc-b990-d20a272c695f", "value": "6469b020b69eda0df62411166d292141053219c4beaff2a9c4a62cf53d8c7ddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09aed06-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774232328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232328, "uuid": "e2376141-6b45-4f9d-81d2-e494430be12e", "comment": "Malware payload (Viking)", "value": "94a8a02963dbbfd5fc8c693428fef7ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232328, "uuid": "3341c219-c6a3-4eb5-9813-8012351fe718", "comment": "Malware payload (Viking)", "value": "65b41899d33eecb1f8f117753a71a0a3328251b6f9426bf56781134557036249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232328, "uuid": "7acd71bb-eaa4-49e8-843b-a06b9f3270d4", "comment": "Malware payload (Viking)", "value": "3ebb6c8ece58b262e89be784ac6e52aeeb822a97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232328, "uuid": "f16af005-d401-44b2-8a76-79b2ea5c7c39", "comment": "Malware payload (Viking)", "value": "504960f816e0a63a96487d2eafd1050a4c7ef8aabd55599b7fa33fd9a3750a1d2b03e3cf3f78f2400c6785fb2c88f18a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232328, "uuid": "d94700ec-1aab-4227-be39-e061523c920d", "value": "T10215AD1B6FFE48E1E486413554A70FE2A5F4AC21BA21C74AC3B0356EEDF4790F90CA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232328, "uuid": "0a03366f-fefa-4ac3-b6c8-cf5c7f73dfe5", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232328, "uuid": "851a622a-a48e-4451-9035-0987100fb204", "value": "12288:SjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiv:JuuuuuuuuuuuuuuuuuuuuuuuuQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232328, "uuid": "ecc90979-3c31-40df-beb9-717b4788350b", "value": 913595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232328, "uuid": "b09a2729-8f8e-49b6-85bf-e00d0f0ef642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232328, "uuid": "a74ed965-66cc-43a8-b77e-c32a764218cf", "value": "65b41899d33eecb1f8f117753a71a0a3328251b6f9426bf56781134557036249", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b2c159-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1774250086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250086, "uuid": "67c34519-06ac-40e0-963b-f427c1e16d90", "comment": "Malware payload (CryptOne)", "value": "9da14189ecd0dca7e3b175d7d01c713d", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250086, "uuid": "c2ca7499-a635-4164-939e-49f3ed68ebe1", "comment": "Malware payload (CryptOne)", "value": "66c6f956821785481b773c3dee7d7e1863dc427acb216f14555c1105aaceb16f", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250086, "uuid": "bc58ef2d-3dc3-4fb4-a5b8-4ad9bd748f52", "comment": "Malware payload (CryptOne)", "value": "172af9495d6c22dfb59328aa5575a9e605f89e6f", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250086, "uuid": "36daaa74-b453-464c-b7a5-4a278e782af0", "comment": "Malware payload (CryptOne)", "value": "d17971223d3754e097f4304c077d3ffc5ed90db959ab863e3100c2583175dc3586c9f4ecd3f21ede9c3e05676f22d9b2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250086, "uuid": "33037775-93f4-4c28-9b36-9689a9f809e9", "value": "T14E66F122F38A403FDAAE07B55C07EB8564257F013CD8948979D89ECC5A3FD897106DBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250086, "uuid": "c9313b9d-d33a-418a-8659-c4bf379b7c68", "value": "d4e959c1090e225a59ae091d94757acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250086, "uuid": "b7446e18-fefb-4ab6-b52f-fddcdefce2a6", "value": "196608:jfJ2lQG99yN/RbUu5LWCE5OFfyNUMpCggk+8h+:jh2lQN/R3M8g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250086, "uuid": "81c4c09f-9e81-49fd-9637-bf6d2d0baef3", "value": 6760960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250086, "uuid": "5f0a0283-3070-4b77-8df7-452d2f991fcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250086, "uuid": "098a0cef-3ca7-434e-b68d-1a77c011dbbf", "value": "9da14189ecd0dca7e3b175d7d01c713d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067fc018-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237224, "uuid": "74612b39-f3e0-467b-a481-c7af02609361", "comment": "Malware payload (Chisel)", "value": "b54347da755dad0df0228d14279fe054", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237224, "uuid": "1004922e-ec72-4a23-b271-510991385659", "comment": "Malware payload (Chisel)", "value": "67242cfda91c4071bafc65332fabab03ece58813bdc73506d5e9609fbd668670", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237224, "uuid": "7b3fc20a-d66f-44f2-bc9a-58a4162e1486", "comment": "Malware payload (Chisel)", "value": "612d3b01d75a01312ad4c9fd3c051ce7652e4bdb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237224, "uuid": "e4a01d30-4e19-4d18-8739-9063cb9a7373", "comment": "Malware payload (Chisel)", "value": "6e45d6d9f39ba1640a297a76f17495984f02350117a027e3fd940d1ac9bff1bf8b0310d2125d9ec5d5bf1f96876e302a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237224, "uuid": "85bb2734-890c-437a-9459-a16974e8b903", "value": "T13E1633B06DC462D8E56C5A3F02F2F790676590B87B8C6AF6F051CF68B79B3A2410C5C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237224, "uuid": "3ee68882-ed7f-45d7-a1c7-4df5bd234de4", "value": "98304:UQiH/QSN6ATEkql0IqYIpgKPhTynBI6R+8H:UQifQOEkql0OIlTynBI688H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237224, "uuid": "a6b33e21-f439-4728-a255-b844511b2530", "value": 4291848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237224, "uuid": "21f9aab3-1e27-49d6-8ccc-a7286c8d87f4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237224, "uuid": "0d10bed4-ee3a-4563-bbe3-71cd1963bbc1", "value": "chisel_1.11.5_linux_386.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac166a0d-265f-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774232777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232777, "uuid": "bc5304ce-4e7a-410d-adb6-7fe3d3048dec", "comment": "Malware payload (njrat)", "value": "05a89970fb855e6df8b50c25469b591f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232777, "uuid": "064379ef-f4e7-406e-b142-987a5a9bf97e", "comment": "Malware payload (njrat)", "value": "679e5732eabf7d38ade383b543dbeca330503d26d40609132e34706ff4dcb3ef", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232777, "uuid": "49d38125-9b28-4413-a012-a21d0f61e095", "comment": "Malware payload (njrat)", "value": "56239c1b1905d7c9a83b85d2878ed65021901203", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232777, "uuid": "a33ecf5c-12d5-400a-926d-faf86513ea50", "comment": "Malware payload (njrat)", "value": "c1adefa5cd715394e8fa41c2c0ca10c3b5bc2f0090a4a077be43302edfcd4a5f95bf1c8c02944e0dd8a86e55fefbd7b7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232777, "uuid": "8aad0e18-8f5d-4acf-b441-aa79962db46f", "value": "T1CDF3E76B7584CF05EA542875C4EBA43013D1ADCB1B32E38A3F4827AE2E513E75D46BC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232777, "uuid": "5c47272a-0d39-4e39-9f21-b832f4752aff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232777, "uuid": "35148389-3a0b-4c3b-8ae0-a9d91f00461d", "value": "3072:Wo+0YrMzY2KCSS5/nawdye8HoRXAthCLv1umiAqcC2K28TD+it:5Y2JSAnLDchiu5TcJKpTFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232777, "uuid": "0570a866-a59d-42d1-b2b9-48ce62c0dfa7", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232777, "uuid": "21848b9b-14eb-433d-94e2-63b773b0e710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232777, "uuid": "3948fae7-e817-48a8-81b4-ae467e1d684b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeaa740-2694-11f1-a769-42010a9c0008", "comment": "Malware payload (JuicyPotato)", "timestamp": 1774255565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255565, "uuid": "70546c36-945c-4808-9dd9-f999864a68a1", "comment": "Malware payload (JuicyPotato)", "value": "c35b7d7d78ba2d2445ea426571e4ec7a", "object_relation": "md5", "Tag": [ { "name": "33cdc9a", "colour": "#CAB0FC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JuicyPotato", "colour": "#EFCBF1", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255565, "uuid": "2ed34529-5efd-46fb-8597-858a66fe1165", "comment": "Malware payload (JuicyPotato)", "value": "67e077d1d01362f7d830910aa88b6e94049eb32d3c2668827582f05ee75657c3", "object_relation": "sha256", "Tag": [ { "name": "33cdc9a", "colour": "#CAB0FC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JuicyPotato", "colour": "#EFCBF1", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255565, "uuid": "0d84eb31-ecd2-43ff-bb20-f9ab6bf6896b", "comment": "Malware payload (JuicyPotato)", "value": "9784223a13a890eaeb9353299515d2c54d93c8bf", "object_relation": "sha1", "Tag": [ { "name": "33cdc9a", "colour": "#CAB0FC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JuicyPotato", "colour": "#EFCBF1", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255565, "uuid": "f435b356-0fea-4377-b4ac-a175d064acd8", "comment": "Malware payload (JuicyPotato)", "value": "8bc8adf92325af403128b733d261ceea86b5281edd64257c36d390686b74826e94bbdd53af3dbed736840d08321e5992", "object_relation": "sha3-384", "Tag": [ { "name": "33cdc9a", "colour": "#CAB0FC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "JuicyPotato", "colour": "#EFCBF1", "exportable": true, "hide_tag": false }, { "name": "lovely-potato", "colour": "#AEF1CA", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255565, "uuid": "bd6994b9-7049-449b-b5ce-3e995926b65a", "value": "T1AF746C5AF72458F6E977853DC941894BE3B2B8050B70D78F13A4439E7F232A19D2EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255565, "uuid": "4ec71af1-5d7e-40bd-995f-8dace1eda3d9", "value": "23867a89c2b8fc733be6cf5ef902f2d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255565, "uuid": "e8b7b759-76d9-491e-8f68-f5f7f3163f7b", "value": "6144:qoaETf/AuATMg4+yeMJxyST3GaKTgcElUM2JERpsgBO3C:HdHCT35MVGvTXhkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255565, "uuid": "755df797-7fad-487f-acd2-949b3bf42a23", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255565, "uuid": "1bb390fa-2597-48aa-9998-26f947705984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255565, "uuid": "5d69222e-ad2b-4fca-8bbd-8d9636ee4033", "value": "JuicyPotato-Static.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf69bc2f-2712-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774309689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309689, "uuid": "903d417f-8a29-4954-88c9-cc9b1bb8bb5a", "comment": "Malware payload (Mirai)", "value": "6f563337ab4f0d2b3f5b32cfd5d33423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309689, "uuid": "8ea94888-a8a8-4894-b74d-d93fc6adf23a", "comment": "Malware payload (Mirai)", "value": "683602b792415612d9d3e60a899c0b8634d52180c1509f27c3ccfb318aa58580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309689, "uuid": "bfb98f7e-3796-4827-a5b7-a960c65e3ce7", "comment": "Malware payload (Mirai)", "value": "06cb8598fe3ee95903f2a4b431203dfb2441af8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774309689, "uuid": "02bb4fd6-405a-45bb-8ac4-7b6f251e4630", "comment": "Malware payload (Mirai)", "value": "0a83a9c05e57b7cd92381eacd63b657ae41cfcf8bdea3c8c54b62de527073c596f0d4a03e79f8cdef3087dca278dc9c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309689, "uuid": "2d27d3e4-1dfb-4d7b-8943-9c7cf1c8831b", "value": "T112734AAAF400DCBDF80BD7BA4453090AB67063511B970F37635BFD67AC322A56826F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309689, "uuid": "8b1392e2-6a39-41ce-abfe-b2412ce6864f", "value": "1536:AZzH8JIdDB7FfekjkrXK83OBHn789W1xizrAdLT2YFy6:AZj8yXFWkjkrXCZ8k1oaqYFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774309689, "uuid": "e2a7738d-45f5-4d62-9d0e-2132e67c5eaf", "value": 75988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774309689, "uuid": "5c084b2e-9d10-4e5b-8be8-2909c45fed11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774309689, "uuid": "c3daa4e3-e98e-4b98-a36c-aee344d869f9", "value": "tux.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b4aa00-2682-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774247550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247550, "uuid": "747a2b50-f818-46f2-bdba-5a2f9378d2e9", "comment": "Malware payload (RustyStealer)", "value": "7ac578ae999fc1bed5d94c31246dc76d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247550, "uuid": "84f0defd-e19c-4d07-9a3b-03e33b235ff5", "comment": "Malware payload (RustyStealer)", "value": "691c051d878de73423b43e45c09d5935879cb9c5234d9ec9ebfcd2b091a6c387", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247550, "uuid": "ade10e59-8b5f-4712-96a9-2267fb2e5395", "comment": "Malware payload (RustyStealer)", "value": "1752979eba7f038596cd00a2d48a9715ef500bbb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247550, "uuid": "98cc99e7-7083-4454-9c6b-3a1872635c94", "comment": "Malware payload (RustyStealer)", "value": "50a4dd6db35a8c8f846e9fa8918df7245bcbf8605aa3f73e9416ea0497d3a13d1de98e95fcff9dadd2b0693348db25a9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247550, "uuid": "b011dec9-253b-4158-9f13-c7f0f04e8709", "value": "T199D66B1020D86607FD7ADFBE89DC76540F7AB2913723FE389B4109ED4ED1B59CA025A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247550, "uuid": "cb5e48f4-debc-412e-af57-fc50a29e8a3a", "value": "196608:CpPycoOmcjp+5c+O05ZRpP04tvyxNY/B+dr:SmqIc+OMZUOvyxNYZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774247550, "uuid": "d838bf1c-9292-446a-9a7a-60ef9e4d6e37", "value": 13598720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774247550, "uuid": "6d4d1792-3caa-4e1f-838f-f39f298e87f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247550, "uuid": "b667ac82-4e00-4240-8d1b-3e855d0828ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67ed4dd-26a5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774262967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262967, "uuid": "bb1cc5c2-acc2-407e-b5cf-47ff6d17337d", "comment": "Malware payload (ValleyRAT)", "value": "c7c6e7e7ddc5b5650981eaee80d1f652", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262967, "uuid": "9b012f1a-1292-44bc-8a01-4536b879f7ac", "comment": "Malware payload (ValleyRAT)", "value": "6b4038f0a5e9a245e0cfadcf3c92da10b84129841b5ce007b056206e79af08b0", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262967, "uuid": "28daa7db-4c41-4881-9d18-551b3af6819a", "comment": "Malware payload (ValleyRAT)", "value": "a7e5129ff53a6d21519e12989068ac5f918172d9", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262967, "uuid": "55f70a92-29ef-4ac0-a7bc-d6570779bdea", "comment": "Malware payload (ValleyRAT)", "value": "04ba2c2da3aefa08d50ac5fee852989b1a6b61fca253fa14a4e6d58ab74d81eeea7045f3a9bfbf3f4400cdf0efbb1233", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262967, "uuid": "5a3b29b1-1d8d-4f14-b286-4beb586cef9f", "value": "T1EA4502818F43A0F6EFC1517122935B7B5E3A534A32169B83D3A8DDB16D36221F23939D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262967, "uuid": "a4d82ff0-4d92-4f78-b98c-9678b487d12a", "value": "1d451bab9f2456b1754024b2c402e5c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262967, "uuid": "a83cd570-c69c-4c95-831f-48211e348f4b", "value": "24576:IfdZKkSlG40eMPTH5s6DiOOiId7qx5vuCwS8vKEN9RBXmRBkGyGRWwxfF:tlG40RHvDiO4766CsoRryGAwxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774262967, "uuid": "6ad22bfa-1d31-4fb6-8c3a-3ed0765e81f2", "value": 1280344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774262967, "uuid": "afe74834-81c1-4080-8ca7-60a77f703d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262967, "uuid": "57b736de-47ed-4e5f-952f-6a821be321c0", "value": "\u63a5\u7801\u7528\u6237\u7aef2.0\u7248s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dc3c57-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282944, "uuid": "6a708be4-d6a7-4526-9bf5-6bc6a5fb338e", "comment": "Malware payload (Mirai)", "value": "474a5445862638e0dfdf6543a11803f7", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282944, "uuid": "3fd21f8d-de73-486d-9ff3-50cd5625bb03", "comment": "Malware payload (Mirai)", "value": "6cc3fc0284dfe57881f5ea01dcd3cecb6c667dc8d1147b049c3d6bd661d9c906", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282944, "uuid": "8df79c69-1093-4e2d-9038-fc380ab7f72e", "comment": "Malware payload (Mirai)", "value": "143c7fd6a2297d8b0d91d7a12a5db901988ea2b3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282944, "uuid": "e9eb8cc1-7aa5-421d-8575-0c41a0db1338", "comment": "Malware payload (Mirai)", "value": "807e8c72a8f771ed819b8ffeade5698156377a9f9f02101ce22c81d36a8e0020633aae515d4fa184ae76d779a71c1208", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282944, "uuid": "828a1cf2-2579-4260-b5cb-6e597a424287", "value": "T18EC36B02FAC088FCC49AC27857AFA175D462F91C1131765B5FD4EE223D4EE217B2EA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282944, "uuid": "ab9c10d7-88a5-4594-8ba1-36c6c08ea784", "value": "3072:hWdmwuSdhhGpk4wiuGfnAllVQu49DkEGugK0:xwuMhaaMu5K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282944, "uuid": "80f22413-e7b9-46a7-a7ab-317c8d75dd31", "value": 124680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282944, "uuid": "d15e8f96-f66c-455c-97d3-9ea37bc16db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282944, "uuid": "0661131a-4f41-4a0f-be45-62439141affe", "value": "x86_64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d58f800-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239973, "uuid": "ca7f35ef-69b0-4ad0-ac36-ee0a3ec07eaa", "comment": "Malware payload (Chisel)", "value": "8516fb22f928f57ad82c006e78f794b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239973, "uuid": "22bcf530-0023-4c8c-8ad6-8129f692309b", "comment": "Malware payload (Chisel)", "value": "6d4ab0327588f0a9b695615cb013aa629cd33ec837274e19aae15206c3e66418", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239973, "uuid": "18122fec-2a78-4113-9db6-fbffcb4dea5e", "comment": "Malware payload (Chisel)", "value": "71c365c9c2cb1e33ecbf885963a9a511781b0ec5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239973, "uuid": "a3c126b6-b632-4350-af8b-3c6578fdc307", "comment": "Malware payload (Chisel)", "value": "f913c16daf3edcbea2fdea8a85002cf4c845ec433036d8945bb2570a4d559e8049bd243b3c470f3d7433180730232b02", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mipsle", "colour": "#0DC0C2", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239973, "uuid": "3e971c0b-9479-495d-98cc-5d2fa01b65e4", "value": "T1AE1633C9EA5FBBF47BA548C7DC8410723140661BF9B325A9240526E23ED3B9107DBB4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239973, "uuid": "6789ad1e-2d72-41fa-9ec8-0caa58c3d9e7", "value": "98304:88dT93G0ewaaZ4BsUxndmRY9q/Vagfab/DnqiTTVnBvjiMEXN2:8EDOXdmAq/UtvnrZpkd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239973, "uuid": "691b0c48-a8c7-40c9-ada4-c7ffe64a229c", "value": 4046697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239973, "uuid": "d4e71ddc-373f-4ab8-bdf5-862461694647", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239973, "uuid": "82a6e3f7-32cb-4cde-a946-f17cb0dc0c69", "value": "chisel_1.11.5_linux_mipsle_hardfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8724e2b5-26da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285543, "uuid": "90f19af7-6d72-4aad-ac4c-a4bbd6036995", "comment": "Malware payload", "value": "74440f85aff02cb207f24b160fe49934", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285543, "uuid": "1f9f4971-5829-4333-bb88-6be85384f182", "comment": "Malware payload", "value": "70c0d462f5633f9c3f850f8418d74691856887a98b55ae0c70734799bb92bb95", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285543, "uuid": "cdd4bdb2-e949-4296-85b4-775502ca77aa", "comment": "Malware payload", "value": "17fe8a50b08c3ab25a185ae84dbec5e18abba193", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285543, "uuid": "5f7a20a2-edda-46d7-a7f1-df8c288cbb2d", "comment": "Malware payload", "value": "b1a4ab5ea2a6a3095d8f9a1eab80ffd6b8e17b5c3beef6ad7b18ea863c6cbd1d3c194a7d3068a98088286829b8074514", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285543, "uuid": "d6d6c41d-e7b0-42c9-8897-7e4859c78f04", "value": "T1D786339FD8032F58C616D56F4A8DD9603D66427F8E82EF1734A6B05B9FC0AC9B03584B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285543, "uuid": "c00d0a9e-3b57-46d6-b612-10e5103771f5", "value": "196608:VvPmpPScdAU9lKsDEEVHjNjz7MN6yWNKV1x0:V3iSifbHSai0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285543, "uuid": "6f5a5003-915e-4555-9467-90cf3b6d69b8", "value": 7849210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285543, "uuid": "6e461322-83a7-40e8-a61f-bb00baa3319e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285543, "uuid": "517da1c3-f93c-4132-8db3-8ffa8df5ca8e", "value": "smqdservice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf10f7f-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282949, "uuid": "a4f9cd95-5560-4225-8154-c860f64adb70", "comment": "Malware payload", "value": "9045ae1a8fb01a36bd219819e4cbf6d9", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282949, "uuid": "92e1602f-47f4-4377-9306-35accefff125", "comment": "Malware payload", "value": "72142e7a704e2b5f7da279af349c5490eaa8b5cac83015e7115b10796f1af641", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282949, "uuid": "da9d6bf0-407e-4349-82e7-a341ed099133", "comment": "Malware payload", "value": "8db92f92db433059ec497920645666a4e2474519", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282949, "uuid": "28c18e8f-97b7-4412-b254-790e20470840", "comment": "Malware payload", "value": "19c51577fcf31e47360657ab81c9d9dbbf12fc128a3a26fcc58d17ff5b943337841ebf8399fb2626aae18342499236e5", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282949, "uuid": "6701919a-2fc7-4484-a50d-16b57e05dfe5", "value": "T19ED423106A1ADDB3A71EEF8D95CC8D8FEC1A85EC4A3B30621E9D81BD7061B4BE54507C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282949, "uuid": "f1b4fcc0-a8a9-4afa-a171-832d504d7cce", "value": "12288:+d+5oOBDEWbum+Bb6FkQGG0VqxMibj/UIXVZxdb:+dUJDEWDoG0CTj8wZxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282949, "uuid": "967bae72-b790-41f6-94d3-5b69331bb631", "value": 626480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282949, "uuid": "c2fa4df2-68fa-4628-ac14-fc14e39da125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282949, "uuid": "d6d4b2f3-fdf7-4ba0-b3fd-7c1449d9a1d3", "value": "72142e7a704e2b5f7da279af349c5490eaa8b5cac83015e7115b10796f1af641.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84882bb7-26fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774299283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299283, "uuid": "8cca5c79-e50d-4f55-b757-72a451432531", "comment": "Malware payload", "value": "65e29bcfdcbe32223ef0e526ae235cba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299283, "uuid": "68f9e47d-cd71-40a4-b591-b995ca4b127c", "comment": "Malware payload", "value": "734cd28532e60b6cb62afe863512d7c3ba414df8f51b06d79436c05ce25e4ab5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299283, "uuid": "b5c77585-225e-4411-bbb8-dc5a004a1106", "comment": "Malware payload", "value": "cccd3ad155038dcad51fd8802ef466181e3ee039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299283, "uuid": "0d70dec1-a0b7-4bfc-aa57-16fce0c25167", "comment": "Malware payload", "value": "f6eb18e7890c2e7ee1b43cefd1da8c70414e1c261b44009f3f4135da1beea2222afd5a6c0c0f7783e7128d5608ea7b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299283, "uuid": "5bb589ba-42d2-43aa-9f08-5bee020b8493", "value": "T1310418457E419E33CBD0667ABBEE42CD732223FCD3EA7112EE014B16369652A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299283, "uuid": "ad3aa1aa-073f-4f06-9646-410e226f5c72", "value": "3072:HnIsZbAWMJmhqIVB+6RW7wyEfKklRZak0nihOQ6yYFH1d2zFeqGDSzWNndp/bl2s:HIsZbAWMshqIVB+LdClRZcnihOQ6yYFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774299283, "uuid": "f33b1c6e-626c-409a-af67-b3808a353efb", "value": 187448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774299283, "uuid": "f5755dbd-9b0b-48de-8633-b9d146be34f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299283, "uuid": "f663e4ae-bf04-4ce6-98c8-71ca1634b310", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc486cd-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (SpyNote)", "timestamp": 1774300907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300907, "uuid": "b4660833-9c73-4e3c-ba47-8ee937835035", "comment": "Malware payload (SpyNote)", "value": "73d260a09b1a4a6848bc9d296364e2ba", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300907, "uuid": "3490545e-475e-4476-9bd6-ca16a5d4dbf6", "comment": "Malware payload (SpyNote)", "value": "73d01b435acb23edf723047c868d3b6e94559d59bdc2478089e9b3528492fc8a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300907, "uuid": "3373ca8a-eedf-4e9f-9516-ce61a034787c", "comment": "Malware payload (SpyNote)", "value": "8976e11c47e9a82aee0f115d5b2cfd6d6e96b14e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300907, "uuid": "88b4259f-8abe-41ea-936c-33d488884a57", "comment": "Malware payload (SpyNote)", "value": "679358ad6fcf06bf26d4d089cf59ec6fa70a941a91e5c0c0b6a46ba7cf0b031fd8b8fe513f5775333ec5e1903d513f7d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Spynote", "colour": "#027108", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300907, "uuid": "04de1c99-d8cc-40d7-aaa1-f161363070f2", "value": "T1AB76F186F748E92FC877B136457A923556474C128E83D7836A453E2C2DBBAC44F4AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300907, "uuid": "426b7322-040a-470a-a340-12e1f015fc7d", "value": "98304:cUy1YO8ftRr6iCMdQKIbgD9yeVy11PfuIb1lGis4vmhLRVlpemsPPu9qIBTsxg:QotKKYrbb3mhlVE3+qI5se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300907, "uuid": "d38a456c-d12c-4950-b4f0-e0f8bb1c3b75", "value": 7332628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300907, "uuid": "6c72e9ac-522a-46ed-8feb-e4741a39eded", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300907, "uuid": "db2e21d8-b5cb-40ea-aca6-f30c0784dda8", "value": "@SoftsFiles.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e852c19-268e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774252780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252780, "uuid": "b392e414-22f4-4103-be9c-420c084a0475", "comment": "Malware payload (Mirai)", "value": "f1d6107c322fdda55effc268820baf18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252780, "uuid": "b7ba19b5-da9e-4bf4-990f-a6e2ecd2f156", "comment": "Malware payload (Mirai)", "value": "745c3a6bc9b5ee526a5aff7e2ffc4856c729de5b733860e7e9f1c585c51885c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252780, "uuid": "cbe85f28-2940-43d8-80ac-c812d845976f", "comment": "Malware payload (Mirai)", "value": "5d52974984550b8a585c81f863d234181c99fb4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252780, "uuid": "ab601396-04b8-4fe9-b429-75c7297f72eb", "comment": "Malware payload (Mirai)", "value": "22aefd65f883a8b355439d7fb8661c49ff7be49e7cd92aa83d3fde1bbc3d62eece1bf2253e6ef32cd6f1af38fbb15453", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252780, "uuid": "c4f9ef4d-0284-41e5-9858-4963c74d1441", "value": "T1B5F34CA3A703DEAFF5AB47B10EE78D3466E126E226B68152E2357F411B711C00D19FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252780, "uuid": "a83977bc-07bc-45ff-b93c-9d0fa6f4cd16", "value": "1536:mNA7dksRK75rmVqmonkXNcqq3L6EgYKAphMAR/D1optLzi2UkJuBWuA38EiagPTG:K75rmCkX4wSuW2UjVs4ryehMRZgDpBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252780, "uuid": "077ad7ab-20bb-4d0c-b7ca-1052ccf7dc88", "value": 170655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252780, "uuid": "e4c7b0af-ec6e-4cb2-92f7-521e11154cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252780, "uuid": "0c7d3e38-f9fb-4b6e-9b01-e0c64221ded1", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f85b27-2656-11f1-a769-42010a9c0008", "comment": "Malware payload (Floxif)", "timestamp": 1774229031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229031, "uuid": "14a577f3-438a-44cb-b419-6341b95b76da", "comment": "Malware payload (Floxif)", "value": "2c020f40cae7c4426a5a7c921c0fc8d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229031, "uuid": "b053d462-5733-4abe-b273-5e3845bcddbe", "comment": "Malware payload (Floxif)", "value": "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229031, "uuid": "c5228503-302b-4caa-9c15-52cb5b7bdac9", "comment": "Malware payload (Floxif)", "value": "908eb7d17edb703e318d974a254b467cd17bd0d7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229031, "uuid": "46fc9559-d318-4416-a60b-5c90cfb74e18", "comment": "Malware payload (Floxif)", "value": "9bd18e91afb2ced57dc2f265067c17847d6d84030a310741a6349c560ce0e657ce4a3d7dcc5883a1706fe327e793730f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229031, "uuid": "819a2dc5-4be2-45c4-a4ba-e4daaf2bf4f8", "value": "T149B58D2136E84077E4F242B18BE8A916A5B9FC3517308CDB43A1564E3A72DC25977F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229031, "uuid": "3d15cc53-07c7-468a-abaf-50c9c2ba2791", "value": "f488c196831b4696983c5a865aea58c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229031, "uuid": "5cab40fd-3f1d-45fa-82c5-9a1e10c730fa", "value": "49152:W1O2/l6TOXUVPOg3hmGS79fhmjj5ho1bJys4aNFpE:W4oITOXUVxmMhoVJyeFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229031, "uuid": "3a636035-b7c9-4875-ad23-fd59eadc3ef0", "value": 2407975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229031, "uuid": "623ec3b5-02c5-4471-872a-5206a52178fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229031, "uuid": "a8c44dab-84e4-4efb-96fc-341ce7ba7661", "value": "74e50e20c15b4d09920aba894c24dcbb92e491ef659eeb0a30e5f899894ea59c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8211a63c-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1774266207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266207, "uuid": "04af3ac7-6f9d-406e-b7aa-8d15ab80b512", "comment": "Malware payload (DarkTortilla)", "value": "664e7f8444cc35647d72ddaaef468549", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266207, "uuid": "21b1d02b-eb37-4ce2-af4e-e2babf1c1271", "comment": "Malware payload (DarkTortilla)", "value": "754e785fcce05e768bf7637efa9b2ed9f83fb8fda0202634d0b123430ccf6d05", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266207, "uuid": "9c9d4430-034e-44ad-a9d8-ae9bb86ca5f0", "comment": "Malware payload (DarkTortilla)", "value": "3bffad9c1f0d4603e6eda499448970ab6b4bccd0", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266207, "uuid": "0a3a12d5-65b9-41be-b551-1bf868a672b1", "comment": "Malware payload (DarkTortilla)", "value": "2844cdee211386e119b08ef4d67736a04f88efdf084015943d6e2b3f58f9c8d10a80b412864403d09749845888fc5851", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266207, "uuid": "01d0795f-ef9c-41b8-8678-aa8a3c7c1fca", "value": "T179C4BD612E56AF55D17E1BB8C023058973F0C817A393E76AAFFD01F65A63BC0CA17492", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266207, "uuid": "ccd77164-f184-4789-a0f7-694445fc22f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266207, "uuid": "4a804288-972c-41d8-bcc9-794bce161c96", "value": "12288:C97wy30Ma4U9NUeC2ZszzBsdXGSQtTjJq/pV14J5cvTBg11EQ5rXH986U:CzEMalNUeC/K2uxb4STBa5rXH9PU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266207, "uuid": "b7abbb38-42e3-4f43-89d0-a4d925227df1", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266207, "uuid": "87ea00c1-b5e0-4d5c-9c2a-1ba67a76b563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266207, "uuid": "cc6734dd-7b6c-4c26-a441-9ae508c811d6", "value": "TWS INTL QUOTATION_#PO150034 #SGSA420 \u00a0TW23032026.pdf(105KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fec66cb-2681-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774247145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247145, "uuid": "d40855eb-0dcd-451d-a787-b4cdb02ad077", "comment": "Malware payload (Formbook)", "value": "527b432b70eb9099bd86b1e6b5385865", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247145, "uuid": "fa520869-e417-4226-96ad-67038589a9bb", "comment": "Malware payload (Formbook)", "value": "759388bf61a6134039a3bc1577bf1650b2f0f7d65cd43c49b3b8010f642a67fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247145, "uuid": "52436d4d-b39f-4849-a04f-9c400686ea07", "comment": "Malware payload (Formbook)", "value": "8fa16f7725b5fc53792d05d6359b217e878037f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774247145, "uuid": "54fe4110-39f3-4d99-aafe-bd317734b31a", "comment": "Malware payload (Formbook)", "value": "4f9ddf079859ffcf27bfe38fe705a4d4d50851483b6314d00f99c4e97d565c1cf4f4a2b57d1e954776e8816e0e001e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247145, "uuid": "a4b7e66e-09cb-45c9-b93a-5e4019501f8d", "value": "T185350111A7ABDC03C5BA1BB556D1E03403F49E4EE41AC38B4FDE2EE73A2A7851985353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247145, "uuid": "9d84c3f7-c9f4-4b89-b0a8-72b57f64b738", "value": "12288:Ijn+iLVFHCxMhvOsdXF5RS4uOaF700CG3wixIzKdygt5vaUq9RqYb5LdqxA4l9vL:6+wF4MJlbReCG3Byc/jvapnqYb5msq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774247145, "uuid": "2093ba99-9a74-4112-9728-30d6f8a7096d", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774247145, "uuid": "8ee03cfb-bc37-4d95-bd69-0987a9160c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774247145, "uuid": "a90d203f-b721-47f2-bde2-0472ec49d93e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.69955482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36880ca5-26b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774269517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269517, "uuid": "896a6ede-4fa8-49c5-a133-d4b2a20e9f6a", "comment": "Malware payload (Stealc)", "value": "784d3aa6149e9ba784fd4d50905a3d33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269517, "uuid": "48628c6a-013f-4081-a85a-fab52ac46814", "comment": "Malware payload (Stealc)", "value": "764936d39ec0d9e3e00e04db2d6d3acc61b6bf77412ddc67ce180d6fbf665f58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269517, "uuid": "93bed5aa-c2ee-46cb-b466-b19779307046", "comment": "Malware payload (Stealc)", "value": "a0d4b7cd36ac98343feea0b93665fcb4ac971a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269517, "uuid": "27c2e6b5-07fd-4460-aa0b-0dbb89c40340", "comment": "Malware payload (Stealc)", "value": "3e0e9efdb53d273c6115279d3769b069a174309615865d87b633a7199a75b33fbaf6b235bdf72045bc932b9039128a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269517, "uuid": "b24ac1f7-e02a-49a2-bd08-1a0517bf1bad", "value": "T168F48D1BE7A602F9D1B7C274CA524957E77278065370978F03E14AA61F3B2909F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269517, "uuid": "2e8d7f1f-76a4-4656-8054-e922cfe4f20f", "value": "f456face36cfa724bf01290dd8927512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269517, "uuid": "3e3eb1e4-4e2e-480b-995e-3babfefa4cc5", "value": "12288:yzvOznjd7Dkqya3OJXJyZzNP8GTop8mW6F88yxBlDetAqxSva:bXOqyzJXIPkEWRjFvybS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774269517, "uuid": "9eb28b10-6e49-40b4-b3e2-668b4aba8f91", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774269517, "uuid": "a63c7dec-be1e-4557-9730-3a17dbae19d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269517, "uuid": "d7338306-2b22-41b0-b76c-4c9293ad0427", "value": "764936d39ec0d9e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ab9a9d-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774249993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249993, "uuid": "8bc21680-f71a-4227-9bf3-20d29e3148c4", "comment": "Malware payload (Vidar)", "value": "c5a4d95919d049a03efbd1f7edb7d0d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249993, "uuid": "69f9b1ad-2332-403f-9477-d471cadd386a", "comment": "Malware payload (Vidar)", "value": "76e86f8a5478760abe6510b6cd8aa3717ffcb89a8a23c19c8f5404d9bdd1ca2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249993, "uuid": "47ff3831-0be7-49b9-b348-a62e54ea774d", "comment": "Malware payload (Vidar)", "value": "6aae256e475eb60740d88603434bbd78b86353e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249993, "uuid": "415ba9c5-382c-40d9-9500-b3663f2cedb1", "comment": "Malware payload (Vidar)", "value": "844ca17ca839114026d9c37fd3ce6eaa2b08feb3726a567502d8697fb5fd22a4e177631156e4336d2aa4089ba626a671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249993, "uuid": "4ddaaa7a-956a-4391-8ccc-6c3708cba69d", "value": "T1AEA57B1ABC9018FAC46E93728CB762917B70BC290B3263D72F9076782F726D86D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249993, "uuid": "d9cbe465-8783-4b08-8a95-8f2ee11b0761", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249993, "uuid": "03d1104c-804a-4af7-b8a3-dfcca0d21855", "value": "49152:RmzNCYXIDE4QyYjS095Cm6B+JsLrSSKU6:RmsS3a/B1Lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249993, "uuid": "24ad8c22-f9c6-4e0c-87ac-549456433ee6", "value": 2265088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249993, "uuid": "b9e247ec-9f89-4b18-95fd-ef2b7c7ee07a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249993, "uuid": "6135b63d-5c24-45b3-9bee-aed86154340f", "value": "c5a4d95919d049a03efbd1f7edb7d0d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ddcc4b-2677-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242806, "uuid": "6123d2dd-6ce4-4efe-857e-380b1808dda3", "comment": "Malware payload (Mirai)", "value": "73b4f325308760eed8851abf53cf736a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242806, "uuid": "1b4f2428-d0e5-4ffc-b04e-ff27a6ddac7b", "comment": "Malware payload (Mirai)", "value": "77f0469ede50251f686e0e3ad993d1da833d4a41f4ef1df783bfa30451d52509", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242806, "uuid": "360f59d8-e7f4-4d5b-afab-b049306ec73b", "comment": "Malware payload (Mirai)", "value": "9fa41c1588d51028279dd35839c3b9c6f158d6f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242806, "uuid": "a2db08f6-6a48-4c60-a165-d043c58282e4", "comment": "Malware payload (Mirai)", "value": "a33a01807c4c71abce3e05d19eb29f4a6b29ee1199070df9438116d3eeb17700e2e05b498601cfca7dc4fb3d712713af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242806, "uuid": "773f83d7-e039-4d48-a06b-2a5a6670a74e", "value": "T1481429457E409E37CBC0A67BFFFE42CD331213F8D2EA7212EE054B253A9A5590E26552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242806, "uuid": "3b2cc108-44c4-4fd0-aab7-f5a96e151773", "value": "3072:GgfzmIOg9quz+kGtvsBklRZakdto73O4ooP4TrgaTcmgC+rOdjRbhfx6PE7viFU2:GwmFg9quikWxlRZ1to73O4ooP4TrgaTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242806, "uuid": "de6a5f58-34d4-47c3-a18d-e7e9c065f3de", "value": 194320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242806, "uuid": "9210d97f-7f45-4a42-b323-98e562130441", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242806, "uuid": "4c95451f-5f8c-49e2-ad28-86f0af1e4777", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b80e153-2657-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774229152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229152, "uuid": "5a434a77-8896-4251-80b8-677849353fc2", "comment": "Malware payload", "value": "c5c7b296fd9d391a6c990fa5e4692fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229152, "uuid": "84e08d63-c7d8-4614-b5ad-112a1e1f953b", "comment": "Malware payload", "value": "7902dd40e04c43ebcb24381fae341e6ba6f46f410df1b1de50d6fa0ba4735d04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229152, "uuid": "4d5a5565-84d3-4479-988a-4ab91d02b8b2", "comment": "Malware payload", "value": "7d656ca95d30906afc8910f7c4b55aaf7c4b524a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229152, "uuid": "b49efd76-d1dd-4d1a-9687-c3af5c53bd54", "comment": "Malware payload", "value": "b3a96a33626c9723a242a1121eeeed5c8f2e02fe26fc5b0ecd1f26b32aa98c7331f94429d0deb67399f1ca531f220806", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229152, "uuid": "83806101-a536-4e03-b775-e77cd6b00405", "value": "T116547B5A73A40CF8E9B7923DC9564902E772BC160760EBDF03A046572F23AD19E3EB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229152, "uuid": "c435a99b-675b-4c8f-8762-fa0c80cf144f", "value": "64fabd9655e120dbee63eb5f3910b2d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229152, "uuid": "ef11bb9e-8598-41ed-b868-f578361e948a", "value": "6144:mL0/8IAiofFh13oMnIWB28mnEBlUq3nuAjv6krdYviqKS8ld:mwYFh13oMnIWBNLBlUqdjvPrdYU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229152, "uuid": "26cc9a21-cb7c-4608-a41f-fc629899d713", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229152, "uuid": "979eb02e-a8bb-49d7-830e-c454a460b702", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229152, "uuid": "7c017162-7b18-474b-a2dd-17e6d5f58bb0", "value": "7902dd40e04c43eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e689229-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774277717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277717, "uuid": "9adcf9c3-5d04-421c-aa8c-ae7c7204b914", "comment": "Malware payload (RedLineStealer)", "value": "8774cff91697da1e09b410653fcb7a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277717, "uuid": "3b58eb2e-8113-4977-bc85-323d83138c30", "comment": "Malware payload (RedLineStealer)", "value": "796b5d63c93d71012e8a8e8a7bd9e1290ca3963b7f6c78c3cdd0023cfebe9eab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277717, "uuid": "5a6ea54f-796c-48d0-bf3a-0e7cae45698d", "comment": "Malware payload (RedLineStealer)", "value": "fdb82136904fe55808f88a2bc7eba86676ecc598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277717, "uuid": "902f0011-28e5-494b-ac66-894542b1b56e", "comment": "Malware payload (RedLineStealer)", "value": "973d176a009cebd7ed9962188531096616379f02937b3edb50b1afcf63b4e58ce4e8319d5f2d38541a4f0c27dac9bb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277717, "uuid": "3e7a6287-1290-463a-a0f0-edf29c950575", "value": "T143445B5817C89A2BDFEE0FFCD411341952F0D056E95BEB9EED87A0F02E1939371168A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277717, "uuid": "a14ef422-72ab-46ea-bd1a-2098d57fc981", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277717, "uuid": "7c7fb889-8b97-45c4-a708-c9d3f410bebb", "value": "6144:a1DiqVKFP17FSRbbpktN6neYQV8HeJDZbsVsxSbWl8:a1DcF97ybbe82V3yaIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277717, "uuid": "937b7182-7d9b-4e8b-b44a-b29b72a320d3", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277717, "uuid": "b5960bfd-a2c8-4a31-afac-fa81f8035eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277717, "uuid": "3f0409e0-b4df-4937-bf2e-7a54751c1f25", "value": "8774CFF91697DA1E09B410653FCB7A2A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5e158b-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252128, "uuid": "b8dd29ea-a1df-4052-9a34-25dbf63a8965", "comment": "Malware payload", "value": "84e15650787fad842df900527dcf105a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252128, "uuid": "783d1f46-c2e0-41fd-af60-df459022da58", "comment": "Malware payload", "value": "799fc0bc3e8759695094c2f37880184e98db3377b49cfd3603f1cc26fb9807d6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252128, "uuid": "ab0ade9f-7afc-4b0e-b45e-89a46e2a806a", "comment": "Malware payload", "value": "0c36b90120d4253a1ca75b1aeb41e8adaa7dc46b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252128, "uuid": "e656c01a-c356-42fd-bf24-c41313803734", "comment": "Malware payload", "value": "034010768b0790a09df735c1f08544bb808d6b87902a9d0421aeef8adf7bf6173fe4cf5c86b3984df327a6f01c1db2e0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252128, "uuid": "ac29e38f-4328-4ebf-a05b-33bb5774521b", "value": "T17C46A3D97AC457F0A529ABDC8247B4CD0394A17E6FBB580C02E458BD3C1AE1766E0CBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252128, "uuid": "5ccc6b73-b0df-400b-96cb-6a4b768d4b1a", "value": "24576:erpP8gGo3PgxRHjkN9Euz6B0KYGmo+SYxg0mFTwzpsSQ3zq6Z/pxDZASqZ+ZeeYn:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252128, "uuid": "7267309d-c014-4a96-8560-fc778457b61f", "value": 5508534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252128, "uuid": "5ed1d582-9a66-4314-80f3-17ad0da57ee9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252128, "uuid": "d82aa739-4b7c-4f53-a393-249c33b12b19", "value": "trans.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c6ef1d-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282964, "uuid": "1e21a596-2dfc-4f44-95a0-96eb27f0e6de", "comment": "Malware payload", "value": "8f72e87e3e4615f8ae25e664d5e03e33", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282964, "uuid": "89241727-5189-4462-89d2-f049e3bcc135", "comment": "Malware payload", "value": "7aeadb6df75f0cee965d43c9d1eb469e689722c9844a445f6574161fd3a31893", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282964, "uuid": "2ad8ba82-17be-4285-8fcf-6dce23a7be24", "comment": "Malware payload", "value": "7b3719027c40f760fff26142b19e484bd9757822", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282964, "uuid": "4bc810af-0629-4e72-b415-389684e5d339", "comment": "Malware payload", "value": "404b0435344799d3158c5fd037bcf03bae03d5b9fa952ca2379abb22e056f295d8d9497817c40034913ec90e90d91a52", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282964, "uuid": "e451e3d1-eaf6-40df-bebb-ebafca65d04e", "value": "T17F015054218B0E43CE6005759C550B552233C4576276A3CF1555D97A6C476BD2CFC348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282964, "uuid": "4f2d59d5-2bd6-4f04-8a9e-36a219aba6fa", "value": "12:BNdAnI+NygR3ywTuLS/fLRsPdiK6AhcQKW7iQ/j+8Pn:tzZgURIds1iEGQJ7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282964, "uuid": "3e0186d3-ccaf-4173-b4f7-deca4e9699cc", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282964, "uuid": "14dcfd18-b5df-4867-ae1d-64649972d9c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282964, "uuid": "13f89f64-9a67-4cdb-aca4-18be132cb256", "value": "stager.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573f3b47-266a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774237359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237359, "uuid": "1ab8d095-7a14-4b74-96bb-0e66ec0bb736", "comment": "Malware payload", "value": "2dec34b44e04f15403f5571dbef95dd0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237359, "uuid": "148b4a1b-c70b-4b39-840e-d9198a518e89", "comment": "Malware payload", "value": "7b1df6cd0d85f16f74a915276b7e140e5466cd40f371234cb90ce9bac1f0e54d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237359, "uuid": "917295e2-6712-40ce-a2fa-7f3f66131df2", "comment": "Malware payload", "value": "cf1ca84c0ceb4e28e09852b4d38d06a1c9871d6e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237359, "uuid": "91ce6be2-9d39-46d6-8fad-a8f74a3a4de0", "comment": "Malware payload", "value": "e8f99e6fcccca757c66de35b0293a167796924a6332cec11478146e360a93844db788f20517c1d0d006a1659a0233dec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237359, "uuid": "a9bf68a2-2351-4667-8ece-14164c82ca8c", "value": "T120925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237359, "uuid": "ba4a7a4f-2a84-4056-9530-63437c2ee507", "value": "384:HFcuQpWx+BL0SWL0g3zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:HF8i+BL0SI0EzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237359, "uuid": "b5f63469-d181-4ef6-a16d-9380386d227e", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237359, "uuid": "e00cd7df-b7c6-4f96-b950-954f66fcf5b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237359, "uuid": "1e8c2ac9-2993-483b-b3a7-43e2b607aceb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aff52d-2660-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774232919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232919, "uuid": "9772ec0b-9fc1-45d9-a92c-809cc9a6516f", "comment": "Malware payload (AsyncRAT)", "value": "7e8bc4116a6c3087bb35a855651c8b22", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232919, "uuid": "38c2279a-4394-4b6a-8497-1085b24fed08", "comment": "Malware payload (AsyncRAT)", "value": "7bf56502f24cdfe91ba12b6b1c713b269a4864d130159826848c18ab746706a4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232919, "uuid": "ea20d5ed-decf-4394-a961-5fbe21006293", "comment": "Malware payload (AsyncRAT)", "value": "c2c14d8717a72aac9a96261cad910815bb7df55b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232919, "uuid": "dfcef026-8352-4c95-8dcc-5d95fd1958ef", "comment": "Malware payload (AsyncRAT)", "value": "368d86c24b8a2b9497001962dd1ba1fda51b9cfc9d0b1d94b09a6c0b4c36ab971dbf074e9f0b36626c70e82ab621337b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232919, "uuid": "ee32d79c-5524-4b7c-b2ff-78b819794afa", "value": "T145232B103BE9C22BE2BE4F789CF23245467AE2633603D54A1CC451D74653BC69A52AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232919, "uuid": "92675cf7-a2b4-4701-9fa8-be93db80023e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232919, "uuid": "016e2b3d-420c-4214-b891-057820fef06b", "value": "768:fuPfZTg4pYiWUU9jjmo2qrHZYsYNiOPhAPIOCz+D5FgYJo/0bb+qjFqjhDQNE6hk:fuPfZTgKa2FbiqnOCKFFgHcbb+20jhDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232919, "uuid": "67d455b4-bd93-480f-b96f-11718c618c09", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232919, "uuid": "7c1af107-02c3-4d5d-8ac5-1150a6eceef0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232919, "uuid": "6072a730-c913-482c-acda-896470070c0a", "value": "AsyncRAT_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a1144c-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242341, "uuid": "32f430b5-f965-45e3-9676-3689da580593", "comment": "Malware payload (Mirai)", "value": "ba5144e2bfbfd61a05496e8c0f3a19c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242341, "uuid": "35eea32a-0287-42fe-a3fc-9642d9649969", "comment": "Malware payload (Mirai)", "value": "7c67514d253f5d83bdbb7085c157b1c0d4accd3a9c27231a92999a5259938741", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242341, "uuid": "d64d4626-9ea5-44c1-92bc-d79a63868f68", "comment": "Malware payload (Mirai)", "value": "745ffbc335c5a7cac594ad721755c805916897ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242341, "uuid": "8a61ca85-11ec-4a84-b38a-bf19c2302407", "comment": "Malware payload (Mirai)", "value": "3120cde6531908dbe9854352c7769785a220491ae961c7a6729ab3210610a89e0c43225e38cb830eac0b948f2294e5d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242341, "uuid": "d91276c5-f7ac-4015-a044-92710a06d5b9", "value": "T1D1C35C1775D180FDC8DAC1B49FEAE226EA33B42D5138B21E27C86A671F4DE205F5D620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242341, "uuid": "f60a7349-1ffc-4b27-9f2c-c46a338205ef", "value": "1536:ULAFmGO0Ng7K+9CIiqDG11Bs0+Ndm1/lAqK3dtNI/xSeabK32:UkFmSmviqS1Bs0+Nd6lAqktNMxSNbm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242341, "uuid": "0ff409ef-ffc9-4c33-a2eb-6b4e8da9ff34", "value": 123464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242341, "uuid": "93ead39e-5a12-405e-806d-5c002f8839ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242341, "uuid": "a6051455-164c-400f-8dd3-b780c3a859fe", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fee9112-2706-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774304295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304295, "uuid": "18f249b8-fe92-4eb8-bd40-4db503cb25f6", "comment": "Malware payload (LummaStealer)", "value": "b87c5dccf4755736684e83e5e4b6661b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304295, "uuid": "860d1608-a679-4c2b-9619-b843c4d04ab7", "comment": "Malware payload (LummaStealer)", "value": "7c9e18b92bb581391c40950e5ca1e567d939a9a3e548ff5dc46820709c7e6826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304295, "uuid": "b0e5138f-7ef5-4ee8-8186-2bd7191dbc69", "comment": "Malware payload (LummaStealer)", "value": "c853e96eec3dff1edd6184091d53e7b19134c20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304295, "uuid": "c38d3aa6-d9f1-46e7-b773-99307bb15c6b", "comment": "Malware payload (LummaStealer)", "value": "ddf85c7b6a187f8f5f426b593b561b106a79ff8ad19d4c366662bc03c0e4efd2d1ce9c50482589ee65067fa14e08d99e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304295, "uuid": "318564ce-2e8d-4af0-b675-2a5aa3b05e6b", "value": "T133B49E20B8D180F1D862117101F6FB7A9E787A3089718DCBFBD41D79EA3A2C1976D25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304295, "uuid": "4c4c87e1-9fcf-4238-9ec4-40cdef37fd05", "value": "ccd192e661dce782d39767d3abc044ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304295, "uuid": "097c57c3-957d-441d-a504-af06c0295da0", "value": "6144:f82NJSrLFWylL8IuJD0Xo+Ewn+V7xeZosuApS5FNQOgqjMhlJMAxl1hL8XHg/O08:fzSrRWyZSVt/sZS5EOgq4hlJMAgB08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774304295, "uuid": "d19dcf02-65f0-4675-bf39-8287b6de5e2b", "value": 504152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774304295, "uuid": "f1cf7302-47de-4741-a293-0beaac20dc46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304295, "uuid": "9ef189c7-940a-4160-b4dc-0aee8846e587", "value": "7c9e18b92bb581391c40950e5ca1e567d939a9a3e548ff5dc46820709c7e6826.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0feedbb-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252086, "uuid": "2869904c-ad5e-4006-863b-7b3636226939", "comment": "Malware payload", "value": "e10953ad94f7b9882a85765ce68877b9", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252086, "uuid": "b4ec252c-56c5-4088-9856-dd9105e3abdc", "comment": "Malware payload", "value": "7e09bdf9c8dcc77397c1eb4511e17d2a5dab4eb83489b241c263b550aa65463d", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252086, "uuid": "9aa4cbe1-b647-40cd-88f5-faeda0591901", "comment": "Malware payload", "value": "3a542d18d9bb2ac6d31ff76d79845e962b6157cc", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252086, "uuid": "11029e44-b192-452a-95d9-fb280a20c3d5", "comment": "Malware payload", "value": "52837b36ce647bb9daaf5a19d9c0acabb8fa293f5c70c8b5fb4758bc933b9e9f73ca32bd53463b93d33caf0f1475a13e", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252086, "uuid": "4062ff93-690f-4619-ae78-e4d058d9d03d", "value": "T11A23D1029699D49BD13E00325323DB2859A9DC610B8B0F5FBA543DAFBCB9378AC13374", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252086, "uuid": "27682722-3809-49f5-b5ab-2610cdfcf9d7", "value": "3bb9985def70b1d56ba27b5948fc84d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252086, "uuid": "51e22a6b-b8d8-408b-9a09-e1df6a23e5da", "value": "768:ep/Z6yE/0dTHw37hzrn5CO6FUNDBjrSD1cCnVpuqk7WhnVifOX8XaI:epQyE/YHw9n5COoCDBs1cyayh0fUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252086, "uuid": "5a680e60-a570-4647-9253-ab8a65537ee2", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252086, "uuid": "ad62a226-ee7c-4ccd-a6be-6d7aeb6aea86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252086, "uuid": "f7f386dd-162f-43d4-af48-d2b680fbee20", "value": "exe1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ebbdcb-2676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774242424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242424, "uuid": "e7ced51c-1029-4254-b115-5581817010f0", "comment": "Malware payload", "value": "6a0d28a440ee91d7e63d575c0d2ca65f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242424, "uuid": "ffc8deac-8089-4699-b778-8cb3cc04861f", "comment": "Malware payload", "value": "7e0d4190bd97ebc5e49418f60324d5cb942d25d281c3335defb32e753bb4919f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242424, "uuid": "f5026001-aa1f-4190-9294-68a4eee13187", "comment": "Malware payload", "value": "b78dab56693edb3d90db56fe8cb51abac180a5e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242424, "uuid": "d03d0afe-0bfe-4bf2-9791-8188b9e72004", "comment": "Malware payload", "value": "bbb44b1761742f815f34b0043e685ed6394cf6d298dfd9bfc180b8b68aa3eaebca4a4862f5d4fafd508fa91a27d27baa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242424, "uuid": "552f12ce-f0e5-4ede-94f4-bfcc87f66556", "value": "T1C6B1D4C812A364707DFA8E6771698924B9C9B182DEC58F84D0EDF4F5598CF08BC41AB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242424, "uuid": "3d51ee3c-691a-4894-a6e5-8e363cee9288", "value": "96:IKhEcfEnsTE1OCx/CxNSus0g46mIQq2wo8U:dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242424, "uuid": "27dc53b2-2fb9-4204-9bd8-25dcdf4f697d", "value": 5194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242424, "uuid": "d66e8740-fedb-49c5-a600-051eb661a0b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242424, "uuid": "85ce70dc-1ad6-4fa7-ad72-22a8be60cf5c", "value": "sin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb0c792-26e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774290465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290465, "uuid": "113ca064-d152-494b-b1f1-f169902c6ddf", "comment": "Malware payload", "value": "69aff493ccfb49411ee4aa76286fefc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290465, "uuid": "ad93409a-27a8-4d8e-8ab4-8d0691f40b60", "comment": "Malware payload", "value": "7ffb2ecf73b536a4fc3b529363347aa5752bf32838a46ecf71c2f00c75cc284a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290465, "uuid": "ac2ada01-5e8f-4945-903d-cf12f461b97b", "comment": "Malware payload", "value": "46184476adf265676eaf2bea60226168fa5e0244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290465, "uuid": "a9437fce-c45b-4e7c-a482-c49419133e5c", "comment": "Malware payload", "value": "e28f2f73b63b58c014ac478bb03ce60238e57feb98f89a2bc39fff363cfd22db844dbee4b1b851e43b3b994debd9fde7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290465, "uuid": "25db3f25-243e-41c1-bdfc-657aa6ce9c44", "value": "T193C55B07FCA519F9C1AEA13585339556BA71BC442F3223DB2B90B3682FB3BE09974714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290465, "uuid": "484dbb94-d570-41c6-b776-765c1dd124b0", "value": "534141bbeafb0cfa024f8b6830c176a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290465, "uuid": "54dace0d-1a56-4d65-8bcd-534bfbdcc1ee", "value": "49152:ckY8xj9AN3mCIgRprMm+nEgNj5F9Qc3NCP:ckY4CxpAjcSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774290465, "uuid": "8e04a99a-07e9-40aa-9028-b694dbb4d8ed", "value": 2555392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774290465, "uuid": "48e5c342-1d07-4224-907e-24c9339f59bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290465, "uuid": "84597d16-4496-48da-b4ef-f011561d9749", "value": "SecuriteInfo.com.Win64.MalwareX-gen.76812889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e882ca-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774282969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282969, "uuid": "9ef3432f-0648-4617-8a53-532554f567e4", "comment": "Malware payload", "value": "a69f58ef082bcf84ed9b196d42585718", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282969, "uuid": "3efc93e5-a6a2-412f-aab8-a9c55e3e392e", "comment": "Malware payload", "value": "809d433de87e5435b185ea908ea244cc5a070cbad23bc11c53dd214528d9bbce", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282969, "uuid": "fdd106a1-5b76-4399-9720-284bf3dee6c0", "comment": "Malware payload", "value": "de75e11f6cd162555213303ada82a4e62e90bfbf", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282969, "uuid": "4a7f99bc-9fa7-4b1a-89a2-65afc745af03", "comment": "Malware payload", "value": "a1bbaa0ea16aa82ac376a5e7eb839fdd08e703c0f4a6e66e936c67c02dceffb57538586ab0f1208b5f82f40f19f7dd80", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282969, "uuid": "e23ce6b4-f573-47bf-91e1-4917111e9444", "value": "T15134194AF8809B16C5C226BFFB5E534933171B79E3EE7101ED195B64278A89B0F3B601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282969, "uuid": "0420166f-8e5b-4a5c-b197-5cff15067c15", "value": "6144:T/maj8x9h38lrV++nkdfoLi/23aYvIXMYy2gi:T/maoxf3Ar+dfoLiO3aYvrf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282969, "uuid": "9406b7c0-6db7-44b9-879d-5a9ce967f7db", "value": 252784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282969, "uuid": "4b5394fc-a7e5-4eb6-b339-908bb4a8fe1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282969, "uuid": "30c40b59-a291-4a91-84d0-a02d477e8e30", "value": "tcc_arm7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40886e9b-268e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774252783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252783, "uuid": "48900f57-d0ac-4d32-908d-af230f626cc7", "comment": "Malware payload (Mirai)", "value": "3bec75f4363a7da73bd02fb694d704b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252783, "uuid": "aef6325d-2a8a-4894-976d-8ca914e7ae31", "comment": "Malware payload (Mirai)", "value": "80f56f169af8757719409071ce7a965ef054e01cf641641e9f43de876debdb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252783, "uuid": "9676cd2a-dd8e-4024-9785-7b1ee7e2243a", "comment": "Malware payload (Mirai)", "value": "bbcf4eeb6b4c38b56cc35b0e9ae513a74e43af7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252783, "uuid": "c2d30c99-4709-4a24-bd3f-88688d1c5d08", "comment": "Malware payload (Mirai)", "value": "11904fa775134e21b3b75b3caa9aef3ed9220bd2373fe1fba3c1ac54a44b8e5e777b5f35ea21822e8b82d0eb68ec4c71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252783, "uuid": "8a9c6154-eacd-4140-bc77-79ceac61512b", "value": "T16344085B2E358F5DF671C63682B759A1E39833D712D2C685C5ACFA201E2024F681FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252783, "uuid": "ab9f5dcc-b083-441f-8590-7022b8831da3", "value": "6144:oqtD/beTlwDJd7bb2aiQIwB11ZFGBrfeoqKqP9j:HV+azkr5qP9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252783, "uuid": "48dc1514-7c6d-4e41-a888-e0d65f667482", "value": 259508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252783, "uuid": "24e48224-512a-4b1e-92b1-4ee2e34f438f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252783, "uuid": "32495e56-47c7-4401-9fd4-82c285a34893", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec1a0fc-2696-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774256162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256162, "uuid": "cc9ad1f5-5624-49bd-be79-ad0e03e39500", "comment": "Malware payload (OffLoader)", "value": "ea15e8adb529ffb437bd08b4893a88e1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256162, "uuid": "7835e29f-6ba6-4c2e-ae0a-8d45ff81abb0", "comment": "Malware payload (OffLoader)", "value": "8100da6f9b544d639eb857d99bf33ceadb31fad65c2e9c33aa8536d77f937230", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256162, "uuid": "a16ef3f7-ae07-4f85-adb7-0bf5830c771f", "comment": "Malware payload (OffLoader)", "value": "27744f65e4bc13555d0a13851fd747c283c53242", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256162, "uuid": "9da996e3-2ad5-465a-a0ac-d5cd4fa872cb", "comment": "Malware payload (OffLoader)", "value": "a8cb2a3daa6db5a8ebb9ba7be400dedd6df3d325b0b518348366e9a3226c374bf710eec99a7d6eb77b6a596bf36012ff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256162, "uuid": "488e3669-f247-4247-94b2-73e549662fce", "value": "T151A61223B28F633EF06A5A374AF29110593B6A51B51E8C5696E40C4CCFEA3601E7F753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256162, "uuid": "0785f984-985e-42ba-90f4-5501b3d5785b", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256162, "uuid": "0700cdfd-fc4c-416f-9d54-454003c8de3c", "value": "98304:nN66IaqLrWP5qlu3ZMXx4bs3MAS3apQYwIB1Rw0uFCJaCQi6bRdkgguvqP6N1:fIak6CdcAS3GQYvk0uFqoRnNbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774256162, "uuid": "68798aa1-7313-4144-bca6-84ee44d068cf", "value": 9663513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774256162, "uuid": "a46a6751-d823-471b-84af-dc44249ca68f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256162, "uuid": "5a756e8a-dc31-4fa3-97d9-22ef0a913d2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcf228d-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282974, "uuid": "7149e137-496a-4044-ae3b-983e980dff56", "comment": "Malware payload (Mirai)", "value": "e0a9f51b5a9cfc8852bad454cf8c65f9", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282974, "uuid": "fcdec744-e95c-4e88-8d3c-ba8b46884754", "comment": "Malware payload (Mirai)", "value": "826a512d26ccdb6463b5a17f4b6bdfcc82d0dc4e7969f7e4d4973fa501fc237f", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282974, "uuid": "334a4e5b-76de-453d-b01d-e147c28a2c1e", "comment": "Malware payload (Mirai)", "value": "6f467de5bea947e70c2db102c79575757ebd203c", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282974, "uuid": "b9bf6130-d821-42c0-895d-673ac1704ac9", "comment": "Malware payload (Mirai)", "value": "99008aeca75f8ab8fd3a31421235a26a47c26e44d8058b008d3963f0381dd028dd60ca31a33abce4c188995851ad133b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282974, "uuid": "6c515295-3d54-4414-b019-fe338913402c", "value": "T121833A99B952C942C1E421BAA94E86C8331313ECC3EB7352DE10CB7639DF59D0E3AB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282974, "uuid": "91f15b2f-acca-4117-bae7-8effd2caa955", "value": "1536:4g5OVV2MERPRvM/LAnseKIMHUJQ6imaEAf1q8RpILT20c7/fecCKL:4FYTRPRQUnx5+XmMdq8nIL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282974, "uuid": "99e2a2d6-071f-4f3a-84b3-bd97f19f6626", "value": 85940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282974, "uuid": "eb10a949-9373-4b9c-b648-fc0ea91ddb4f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282974, "uuid": "14bd37fc-6e48-4265-8938-5ee9618ae626", "value": "dotw.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9364273-26ab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774265441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265441, "uuid": "bbcbf1e5-9661-4065-9720-7bbf96a50dd0", "comment": "Malware payload", "value": "ae89ec5929991a4a9cfc06208e6c985a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265441, "uuid": "112b399f-e2fc-487a-850a-366ab970ae73", "comment": "Malware payload", "value": "8558676255b31a3cab152fcbf4bb07e799f61ebfcd1323dd1a14cd95a33281e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265441, "uuid": "5b9c14a4-3b93-4e3a-b8e2-b9dc73f8f6e3", "comment": "Malware payload", "value": "cf2b496e0e0bbff4313f266f2cfa5d1385eb6e24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265441, "uuid": "95c4c22d-f625-4fcd-9859-e36fb87a20c3", "comment": "Malware payload", "value": "fc65bccaa845862d00387f7d2f9026c724636a79fcaa2429da0f8bd09c730d0bde18bc259d47e3d1194d420d5aed5ea0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265441, "uuid": "c0956986-2826-4846-b6d0-fbf0c02f430f", "value": "T129925CB512896C79FBD1CE39AF3C6F4CADE882C42124E3ACBA0F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265441, "uuid": "54162bb6-4c47-4e94-84a5-b063f0d0b8f2", "value": "384:hFcuQpWx+BL0SWL0gvzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:hF8i+BL0SI0QzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774265441, "uuid": "f822c313-0dbe-4968-97ea-7d753658d63e", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774265441, "uuid": "eb249d0f-8a55-4b8b-81e3-16c066674d61", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265441, "uuid": "d26e2922-9e9f-40ed-be92-c91c77da6b53", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ada49e-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774251901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251901, "uuid": "a2f19b95-c272-41c1-86bb-eaba936c1be9", "comment": "Malware payload", "value": "cabf25ea0d78fc304b58831c6839e505", "object_relation": "md5", "Tag": [ { "name": "2e49999", "colour": "#1CE665", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251901, "uuid": "05935fbd-a352-444a-b717-92b0c7a9936d", "comment": "Malware payload", "value": "856e0b47dca643b150d938d76d1bbe5cb1d8c8f42c3419b698dd1193af71eed5", "object_relation": "sha256", "Tag": [ { "name": "2e49999", "colour": "#1CE665", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251901, "uuid": "b519cb78-3366-4448-beab-2ec819ca6309", "comment": "Malware payload", "value": "77b49524ff681a09ff99a6847b6d3b16c4431d22", "object_relation": "sha1", "Tag": [ { "name": "2e49999", "colour": "#1CE665", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774251901, "uuid": "89c03639-9a7e-4964-b37b-fd8a347c0de1", "comment": "Malware payload", "value": "f4be7b08e5934bf5f25901e5e3df7a9b1ce99018e78447f128e769bce23614716333ae9b68b66ffe7749695c51f1312e", "object_relation": "sha3-384", "Tag": [ { "name": "2e49999", "colour": "#1CE665", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "cookie-and-handle-stealer", "colour": "#4D2871", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251901, "uuid": "2c0ba566-af62-4bd2-8a18-88ea437aa129", "value": "T1D35351D57AD89C9AEA14423C41EAD332367DB9E0C7534B0326307A321B12FE579D726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251901, "uuid": "79ece4a8-3cf7-4355-b041-4251a324db5f", "value": "f8d1148e168ccf0a1575eaa6c0fc0fab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251901, "uuid": "b17e28a5-e311-4446-82c2-aaf61433bc52", "value": "768:dMHT+0/fis4CYtfefsRfEqTIYv4gKNwFPoup2VUAi4rOwru5PY:dUa0/fisp2mqEqTIm4gKN2PoupCfBpuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774251901, "uuid": "8fd14eef-cf66-49b2-90ca-bdd978c9a336", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774251901, "uuid": "d05eeba0-e126-420a-aadf-e752af797a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774251901, "uuid": "dce1c9cb-ff42-464a-a9aa-d587090e6ddc", "value": "handle-stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcaeb24-26e2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774288937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774288937, "uuid": "3b79a11b-5b94-47a8-92b7-3690c4a02a08", "comment": "Malware payload (PhantomStealer)", "value": "dba7c882d3d99527a62d602b23ce4e89", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774288937, "uuid": "0a71397e-37ff-47fe-a065-b2cc13f6a56e", "comment": "Malware payload (PhantomStealer)", "value": "8606c084446472d6e383d2ec2279858474fa807bcfc3380b7e5a939da23dd5a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774288937, "uuid": "fdac27c8-75dd-433e-88c8-3723d5248920", "comment": "Malware payload (PhantomStealer)", "value": "5ebf0af367fdb5127d12764c8fbe35044e2eecc2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774288937, "uuid": "0bc04a01-95fa-41dc-80ba-45cd78f6d723", "comment": "Malware payload (PhantomStealer)", "value": "bebf349d012416c772dd28736b07feeecc5bd8124e7f6c8d0e7e7ecfe637bddadc7df8edde639516b5e5c75c0c5efec0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774288937, "uuid": "8e025b24-8be3-484d-87eb-dea9dddac6d0", "value": "T1540352CE72D6B5A1436264A73D2B705BF2AE68C0B64C4008D6E8FC5CBC74368D0B5DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774288937, "uuid": "22875991-c3e2-493c-9ec4-7ada3a6d45b4", "value": "768:4SfWnJtnJDO5QRk4ldGCegIFcpGLZQc/v8CAVwFEAieiyv2v1Pw75UuwqK:4SUpDOiRzldGCegacMLec/vlAm9ieiae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774288937, "uuid": "a0e18167-d76e-4ca3-a3b2-6fd85fcee318", "value": 38574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774288937, "uuid": "e133c363-308b-40b3-87f8-83da77070030", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774288937, "uuid": "077795c1-ae92-4b6b-9110-1e9c482894fd", "value": "specification_03902_091034_01212 {-125kb}.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ea7358-26cc-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774279347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279347, "uuid": "d1b80e71-a755-418e-a40e-02a173e89452", "comment": "Malware payload (njrat)", "value": "ffe7703d80e6cc1a8d8801c03bd0b2cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279347, "uuid": "866d9d73-4919-4be1-a540-1d3bbef42d6c", "comment": "Malware payload (njrat)", "value": "87e4d0e94f94dd01a4c6e30f6ee7b612bc6dad0581075bf43fef6f24053e6676", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279347, "uuid": "bd445c74-7796-4e20-96d8-8901b5440fde", "comment": "Malware payload (njrat)", "value": "2888d875e497dce6c1849a450f19a07ae6cc901d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279347, "uuid": "b1372e17-0c9a-4409-944c-bb63ddb101c0", "comment": "Malware payload (njrat)", "value": "adf7160a177b2d313408a6a3e619634978f727dcbfbf32693197cf7c46cc9f49c858d86b74350d31ec9f31281dd4340a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279347, "uuid": "205bfd32-180b-429a-bbc3-fab0f28a9851", "value": "T1E9F3E62B79888F15DB543871C0DBA43003E5AECB1B33E28A7F59375D1D423E76D4AA89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279347, "uuid": "aa57827d-6dbb-4f8e-9b3d-e5fcdb24c835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279347, "uuid": "e17564b7-3b37-4fa6-9418-391631b60acf", "value": "3072:3KgiqYSzV3MvQJbmVO0TVkeV84QuzuLj1JuA4VThqfc7x:l3MvQ1QO0qeV8kzmJuxFqk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279347, "uuid": "b22b1c86-9546-497e-9373-502c5a37fd78", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279347, "uuid": "f546db15-27ff-4768-be85-d30e52ca47a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279347, "uuid": "88ac4baf-ea5c-4dcc-ac28-d883d06b2bbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec389ff-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282979, "uuid": "a40ac6ef-37ab-46ce-ad1e-2e7cf906c449", "comment": "Malware payload (Mirai)", "value": "b37b8e308f0d49c7b5f34e87e18a67ef", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282979, "uuid": "c9d3da0f-f43c-4eaf-9380-6bba8e79270f", "comment": "Malware payload (Mirai)", "value": "87ec57bd8e639d5f96a17dfb73af5cc63cc528f45d4a3231e70f287e9ad38601", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282979, "uuid": "5d7ac69b-050c-49a5-92b9-0fc556e919c8", "comment": "Malware payload (Mirai)", "value": "fcab81d4763064c1aa561048e67cd9a452db6f41", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282979, "uuid": "7d6102dd-7911-41e7-b5c1-0f5bd530df78", "comment": "Malware payload (Mirai)", "value": "1b031d82df193516a26933573bf7ca77f32fdd3c0bcfd7a830847be3fc9c16dc9b3a566f07abb2e26e62893547014cfa", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282979, "uuid": "414387a0-e5c7-4b79-bc15-5afda6ed5fa7", "value": "T1A3D37D85E783D4F0D95606F0101BE73A9970DD325025DE5BEBA0FE76AC7AB02E21A71C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282979, "uuid": "37c28e77-fde3-4eaf-85d1-69978681cc92", "value": "3072:AjnZRFSHY4TNSIcMBpytPU6iy8iaKfydAq:AjnTFWY4s9MBp6UUtVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282979, "uuid": "e6b37c2f-1037-4796-bc9e-7df47d3e4993", "value": 135940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282979, "uuid": "54ffb38d-a8a0-4364-b723-e6da5c9f77f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282979, "uuid": "4e12530d-086c-4a00-974f-2c21aef882ba", "value": "x86_32.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef5d5f8-26f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774296401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296401, "uuid": "8b783cbf-82de-4e48-98ae-a94358471164", "comment": "Malware payload (Mirai)", "value": "717dcf5271f168d03fb044b343e2d25e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296401, "uuid": "f0d2a59e-4993-47a7-8897-f1ab9c259020", "comment": "Malware payload (Mirai)", "value": "883e894ce8945707837017ce3dd49e62e3db79f8cb52423e17a19f1bab81e5c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296401, "uuid": "933d26e5-f7b0-48b3-96a8-795053dd5c5b", "comment": "Malware payload (Mirai)", "value": "3272e0ef0157bc5de68d0cfe30602599267f2d58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296401, "uuid": "c5dc2fff-cee5-4b5e-a31b-a8addf265cd3", "comment": "Malware payload (Mirai)", "value": "c6d639517775c9b35438224a51ef8fa0e3199b5188b6a97a144ce04696fc5b91dd59debe2322ab9bfc01aeda79698b66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296401, "uuid": "c2971178-9b01-440d-9342-377320d05d2a", "value": "T170A34A33BE328C3BC5C0657671E74326E5F6439A51A8952ABD701E8CBF7960032177AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296401, "uuid": "c9da30d8-e98d-495d-a64a-fd0461be8a9d", "value": "1536:ZE4IulQF2qd7PjkH1xO6Owxx43qBt+5o75d1jouHitjUHGe7yH:ZyljIxtRY5oVLkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774296401, "uuid": "872161d2-a725-4c02-9540-d8287eda9b31", "value": 99996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774296401, "uuid": "4e22adcc-3fac-4330-b099-f11041ec01b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296401, "uuid": "2bd74738-d83f-4934-abf8-03af94d0b875", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c342ff-26c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277082, "uuid": "36d23b1a-1894-4d0a-864c-9edff2ec8ed8", "comment": "Malware payload", "value": "42215c1fb55d945b4d2a0bb188ca4dcf", "object_relation": "md5", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277082, "uuid": "812306a8-47db-4831-b164-6b0ad240e02b", "comment": "Malware payload", "value": "886d04b78017f721ed458158e3c31300cb7f9d512481a50f21461711438e1c5e", "object_relation": "sha256", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277082, "uuid": "55cb9b94-0828-4e4e-ac3b-456ce6a3680f", "comment": "Malware payload", "value": "ac5939a17ec6455b6b7ae0f04c5b71b1db0d00c5", "object_relation": "sha1", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277082, "uuid": "b458a605-0c5f-4e24-8afd-efc60638a45e", "comment": "Malware payload", "value": "ce7fc479c6db4ba78096226b9a37d39f2600206052f8efe032efefcdc5fbeda2ea12f31697489fbbe01e09eb6a9b08dc", "object_relation": "sha3-384", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277082, "uuid": "4e82a982-b0b7-4f5d-a8bf-685dee080848", "value": "T146F3D0E26538D627D11706F2CB776ED2CE93A68532D3B82F867CF52A581D41824893FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277082, "uuid": "67a9d56d-2445-4f31-9ce2-fcbbf519f849", "value": "3072:hDYdSMPQDYdSMPZDYdSMP6DYdSMP+DYdSMPmDYdSMPhDYdSMPSDYdSMP5DYdSMPR:h2PQ2PZ2P62P+2Pm2Ph2PS2P52PR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277082, "uuid": "8c481bef-40a0-4156-b14e-08f7cc2fea3d", "value": 169882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277082, "uuid": "6c45a612-e0f5-4d43-8d1d-04c0d5b97260", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277082, "uuid": "b93235c1-bc1c-4762-a682-282fb01e31e2", "value": "886d04b78017f721ed458158e3c31300cb7f9d512481a50f21461711438e1c5e.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c042d9-264c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774224369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774224369, "uuid": "71cf093d-dd16-462a-ab27-01366bba12c1", "comment": "Malware payload (Gh0stRAT)", "value": "7476e4cff87212624d36017a9dd43639", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774224369, "uuid": "9ebf921f-85b9-48c3-8490-f231c6a75c3b", "comment": "Malware payload (Gh0stRAT)", "value": "88ec0aa0210d9dfb6ad524bd46e2386a535bd139a459d7add3e6f51b5c2debea", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774224369, "uuid": "fa4c1b78-c174-488b-a38b-a6b90dbccf11", "comment": "Malware payload (Gh0stRAT)", "value": "9d182d073a426ebcbfc424b27c838b9c85093e64", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774224369, "uuid": "4b6bd199-e5bb-4977-900a-ccd967306d9d", "comment": "Malware payload (Gh0stRAT)", "value": "e0ce22d710f5b88d426b5cd790cbe6a3516063dcdc44d9d8c95513d4c8952a5205959aac61a694f58daa8cf0bbbfe683", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774224369, "uuid": "35d70de9-9fa2-453c-831a-cb85e13000d1", "value": "T17AF73321358EC132FB6F15B19A29EA2AE53C7DE20B7004DB93E4FD5A66314C35235F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774224369, "uuid": "deaa24e4-9810-4d71-9646-d481fec39065", "value": "1572864:Yxssmhi1QeEWzgSDhOIFkEIf3MFZgm9GKtZq7q7K8KeB:Yqs1lEl1Ek3MFZgmYsZqkK4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774224369, "uuid": "4d892763-be34-4cca-93c7-80a17c45fdd6", "value": 75429376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774224369, "uuid": "a74937b7-96f7-4829-a09c-6094b95555fe", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774224369, "uuid": "1705b143-b8db-4d08-873a-94c14260439a", "value": "ToDsored-sreuir-x6.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff7b48b-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252138, "uuid": "7761ef0a-ec75-4b16-b3c8-07b9ab7066ff", "comment": "Malware payload", "value": "6022e777a1fcad9e5827e5987b060fab", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252138, "uuid": "615dc911-b316-4754-8a98-fbbd33da0596", "comment": "Malware payload", "value": "88f71ad0fd37c7b18b286f12d629c53b2748bf74fec92ccab22c4cb461a20000", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252138, "uuid": "4c340268-b051-4b11-a252-032cd4a43bbf", "comment": "Malware payload", "value": "42bd7e96966b8ff601b2a0dcb5d78cea664ec1b2", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252138, "uuid": "a2a6a214-6e9b-46dc-a2ae-9e7f6ba1d391", "comment": "Malware payload", "value": "b368c5f6e527400910ea8ee527e90484fa59bcc7013e99e1e81ad9eebb7392a0d15c79c5b181ac5841fcfb72d9480eb8", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252138, "uuid": "9c3d4cd5-1634-405a-8b57-38c31e676d3e", "value": "T1E5137C337DC10137CA81827558F89E0B6B3FA266027446D7DB1059CE2E72AE16D3BB83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252138, "uuid": "dcd07f41-754d-4fa5-8245-55e1cc1d2731", "value": "9f5fe7218364f54914389105df0acf9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252138, "uuid": "82f73ca8-5b7a-47e5-afdb-62769ae097bd", "value": "384:HR2UQks7gCd7DA/CQjnra9cD7yMKS9E3lbG:HR2UQj7fECti75Fu3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252138, "uuid": "522c9c22-a3c4-44ee-b3a1-14c4572264ec", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252138, "uuid": "d55c0463-784c-47ca-b512-54428e88ba91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252138, "uuid": "53b89d1b-8183-48de-a24b-53a9063bbbfb", "value": "ShllCodeDec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd52c45-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774257448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257448, "uuid": "cf7c778b-95a8-4647-a470-a911d24d0496", "comment": "Malware payload (NirCmd)", "value": "6b8fab67329a23290a7c69319ce20742", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257448, "uuid": "5dd58c59-c291-4348-853d-7f461e0381bd", "comment": "Malware payload (NirCmd)", "value": "8973953da22ae576d3391b47b7b117c8cb833a34970699561594cca7e8b2797a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257448, "uuid": "aad22a04-e4d6-4e07-8eae-940c1ff268d6", "comment": "Malware payload (NirCmd)", "value": "3e734f1a64fc88bb40de378849035d4ab4fc76f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257448, "uuid": "bfb2f3df-38cc-43cf-a2fd-936a43181934", "comment": "Malware payload (NirCmd)", "value": "5c351fcfb9b1a9ce397e38a9b2d0ee96df0175094f31bcc6ca8a1b60c241d8ab1e267d5afea6b369c0d7134b7c0a6d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257448, "uuid": "7d72d582-f28e-48b2-8d87-78767392f738", "value": "T163A52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257448, "uuid": "cceb960f-a130-4afd-ad52-7ffb9664ce20", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257448, "uuid": "d15d3b5d-cbe7-407a-905b-8e26f1915591", "value": "49152:ABRxTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:aXTFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257448, "uuid": "c12bb859-f9bf-4d74-9d65-d19ee1dc09f5", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257448, "uuid": "7097f3ca-259d-47bb-9a47-edbbf30fa4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257448, "uuid": "6f80b183-3405-4b5a-a176-f2c12c47cba7", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c912de6e-26b6-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1774270192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270192, "uuid": "767df5da-7038-4902-b01e-32b823b47ce9", "comment": "Malware payload (VIPKeylogger)", "value": "f799944a789f651c4c80f5c7fe3d66f0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270192, "uuid": "17f59e77-c02c-4f52-90b3-2b57fd7aa2f0", "comment": "Malware payload (VIPKeylogger)", "value": "8a6d0b989aaa6d4242defc58eeb7d2e5a13d888cedf5bb46294ad5b7de4c92b4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270192, "uuid": "7610ab46-763b-4429-8bed-fac6e258368c", "comment": "Malware payload (VIPKeylogger)", "value": "df56229a214e9a083d9fe6fde8565f1e1c96b5d4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270192, "uuid": "cf8711de-0630-4138-a44a-24692415c796", "comment": "Malware payload (VIPKeylogger)", "value": "bc7b6c940c5c79ecdf27a770dd7f22b709cc56d96fca12be24d1018111587430497fb592d0d3ac26f760ecada43d819d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270192, "uuid": "f09c7e37-30ff-40c4-a70e-45c722d37c0f", "value": "T125C4022189C87F75DFB85A1850FE161E63F1868E4567698AFF23BE0AEFE750442070C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270192, "uuid": "dff47707-4b25-4fec-a5c6-ac4dbc0d1b7c", "value": "12288:Fnpnq1bxZAvdrDJ4nEjK7Qggcg9lqtfw/gvSgOX:FIOJmnEKgCfUg6gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270192, "uuid": "da988fb9-e69b-4f8a-a556-2c613cf4c40b", "value": 556490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270192, "uuid": "e7a003d3-b7bd-4112-a177-6a7e3c1a9933", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270192, "uuid": "6a84e418-73cc-44ef-aede-f754d3a08cf8", "value": "ENQ PO_S23BK-ABPROCESS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af5bfec-2657-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774229232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229232, "uuid": "7fefa7c8-3b0a-4597-b5cb-16d84caf50ed", "comment": "Malware payload", "value": "4eddeb4b09d8ca4a318f5008cfede172", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229232, "uuid": "f42169d6-15d8-4700-adad-e362863a46c7", "comment": "Malware payload", "value": "8b30072fc73583017c9f3cd908e0f82b9fb877650cff1599a70adb6d2f3eb852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229232, "uuid": "04bdcc08-77b4-497e-a83b-fef314c85dba", "comment": "Malware payload", "value": "9f05d06540aeaa3eda7fd7c36499211793b55a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229232, "uuid": "db24606c-e1a3-41c8-8c1f-b3053f0f9d5e", "comment": "Malware payload", "value": "5b678568930c1f299f4457e8a999b6e0a46902e16cbfd689ce206d13bca9676d4ffce07511ba22780f145fdec4ee0893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229232, "uuid": "e45bf3f4-2d7d-4889-8d1f-1e18149973eb", "value": "T1B2157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229232, "uuid": "70692f05-ee13-49c8-8a71-b5146df08f78", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229232, "uuid": "12ea711d-0e67-41eb-af11-d375129c0adf", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6rG:d/QMnl5YL7WzZyQRdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229232, "uuid": "ffa0119e-85e9-4a51-a99b-a495d0db8d1a", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229232, "uuid": "961181a4-ce65-4844-a440-0ef9273a0e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229232, "uuid": "48c89fe0-bd97-4553-a377-aa38e9ef265f", "value": "8b30072fc7358301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106f0972-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237240, "uuid": "0deff44a-21b7-4f18-a68a-7df7bc04d660", "comment": "Malware payload (Chisel)", "value": "efea147bb5b4b35b3260e99c6ed8e51e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237240, "uuid": "90b97c8b-f8aa-4d4e-84f1-2d0178ba072e", "comment": "Malware payload (Chisel)", "value": "8c0aa92c31ec950bcd8d8b714b2ef80ae7b35d55964e92088ba81095f132fb81", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237240, "uuid": "491d02fa-7d99-4f04-8a28-dbef997e6b50", "comment": "Malware payload (Chisel)", "value": "963d0309ef798719ba39edb1177a15632a1402e2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237240, "uuid": "0b47b8b0-f82a-4496-997c-c1c6f202f59b", "comment": "Malware payload (Chisel)", "value": "ce8aeed4323aa05b3f15da86e968bff9a4306e44e4e657b655da417049dcecff36b38e7c9e22cb409c941900661feec8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237240, "uuid": "aa956297-393a-43a3-a7eb-ecf4563f1eeb", "value": "T16B16334F6C764C6CA30FA7B00E31A9C6CE884E3DB57AFE1E9257695185CEEC74293016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237240, "uuid": "547ee748-7d6a-4df1-8672-0022a54d7472", "value": "98304:rFME08j0VbZScMQlIwNARuKzguI6XWbpa8hH1SluTK4oEvnX:ZBxYweb3n9JVSluxBvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237240, "uuid": "1b8ba160-d9f0-4769-bbad-e1e28620a02a", "value": 4033092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237240, "uuid": "696f8a3b-1c81-4a3e-90b3-40765aac8bc5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237240, "uuid": "1c3a9fa4-49bf-466b-bc2d-7a5ef530cb54", "value": "chisel_1.11.5_linux_arm64.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954a782b-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282990, "uuid": "8887514e-c1d1-4b42-9c45-11b6ab0788ab", "comment": "Malware payload (Mirai)", "value": "94455101841c70681c7e7c40b9548285", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282990, "uuid": "19577624-bef9-4e06-b470-4a3fd4a4ee22", "comment": "Malware payload (Mirai)", "value": "8c635726b827b0b2ae8f683638995a6eb74606a09f529e6eaa0b0a0f1a79413f", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282990, "uuid": "10f26aaf-e746-482b-a01e-2c4ec76b261e", "comment": "Malware payload (Mirai)", "value": "47877ad2f19f32cb47c0aba7f004e7e078a05ef3", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282990, "uuid": "621c0342-e517-4dcb-ac23-6ace2d1c3c9e", "comment": "Malware payload (Mirai)", "value": "d2f79881c16350d58c259f877db535a6066c167d897139c189b753a86825aaef53c87bd6fbd70c974e84ce97d5da6210", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282990, "uuid": "7f898ec0-8c73-400e-8af9-99661c3fa099", "value": "T10654238A660607C08A7DA79C64CFECCB43815B6BB73CFE3209697CB896D5B7D1508095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282990, "uuid": "69bd51e2-6549-4fcb-8b32-2548bf6718e8", "value": "6144:VaZpOwIumsJMZWPjn8ZFZOywHIv0en8zo84w2tTurXi0iA:Q44KZq8pwo58N4v4TiXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282990, "uuid": "b46cd572-39ad-4913-b6e6-7bc3fdbd03d0", "value": 279688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282990, "uuid": "0210266d-2796-4f81-be28-7e9e5a849c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282990, "uuid": "fe8b4e5e-3f48-4a0d-ad50-c98d6d896913", "value": "103_77_175_243_21874_mar13_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9872e458-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774282995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282995, "uuid": "6de8c738-9991-48c8-bc79-1ee9ddf44719", "comment": "Malware payload (Mirai)", "value": "2ac890172419fc7ca067052f3d491444", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282995, "uuid": "52556302-7b3e-4bca-b418-cdb01c9827b5", "comment": "Malware payload (Mirai)", "value": "8c9ff5d82f986b9c86ff8d1a26f83a9c41e50a5f0671e2b79e13c663afb1ba20", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282995, "uuid": "e7cf7351-bb80-4574-be08-22a952b709ae", "comment": "Malware payload (Mirai)", "value": "3449d93b111cf479c79fc021cdfca79a9d99a9c2", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774282995, "uuid": "258f3085-aac1-4d14-93e9-70a8df32b887", "comment": "Malware payload (Mirai)", "value": "3848bcd4b4009736f7d4b1f33cbc3f495a5e7880ce33869a4a1d1775c879400df3d43f1fc28d3e37ec8e4114fdb29318", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282995, "uuid": "6a225dfe-f4c3-45c9-b5f5-2cf3a21261be", "value": "T19903E846BE419F03C1C331F6FBAF46587B16AB2DD5FB7242AA35BFA023474D60A16211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282995, "uuid": "54235d66-e8f3-44ec-9610-f5983e1aed45", "value": "768:Zx7mJPlOmMMFjYKyvGHo7Gf1iJewdzPTtRTiIIG:Lud1FjOeHoCfMTHefG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774282995, "uuid": "dc219050-4a63-46d9-9c08-a0c59af9d0cc", "value": 38772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774282995, "uuid": "aef02577-ae34-4c9c-ac1f-2d4e1a4c6e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774282995, "uuid": "149c9b82-4037-4e2c-b40a-586c02987439", "value": "rkloader_arm5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8906654-269b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774258595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258595, "uuid": "2bc04c94-3a80-4428-94a8-8a104626505b", "comment": "Malware payload", "value": "5f42bc67974b4b21b999aad8fcc72858", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-36884", "colour": "#D6C321", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258595, "uuid": "5674b2f0-7313-4a22-9cf3-03ed76d9c2a9", "comment": "Malware payload", "value": "8d099d5c69391c0a9ed95e1b1a971a599770d395c68ced9c890ecf4946b8eb9d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-36884", "colour": "#D6C321", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258595, "uuid": "90914f8f-8ffa-43ac-be8b-7068b6af08c6", "comment": "Malware payload", "value": "956a2f20672d1a7b5ad0a807eca40b4d34efa81c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-36884", "colour": "#D6C321", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258595, "uuid": "8d7a7b99-1771-4c31-b85a-13095a14fb98", "comment": "Malware payload", "value": "949e0983494d799043cfc753ff7e9672745620157404c2880a82827b60b870d9fe64f06713c5daf0ce3d575b720394d6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-36884", "colour": "#D6C321", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258595, "uuid": "54eb6f85-4332-436a-9938-e2475c60f773", "value": "T15E427E36FD0E1839D9AA6735E0D008F3FA1D58D6AB1435CD340E5ECAC8499DB1B61DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258595, "uuid": "0319bf6f-80e9-46aa-a1e3-e110c63efc8d", "value": "384:/diGtmiQtDCHoZFg5DO/W8hZweCoDFGpvJ45:1iZVtDCsh/W8hZRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258595, "uuid": "bdf31b39-ba59-424b-92b9-ae977f0edc9c", "value": 13160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258595, "uuid": "e2f7c54f-0293-4345-9ae1-2c81674b2aec", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258595, "uuid": "be4c8dcb-4c9f-4662-8f4e-cfd527d2e135", "value": "Purchase Order# 920526.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fae297f-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774229213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229213, "uuid": "489de6b4-6b8e-4756-a7f1-9b5a5af17566", "comment": "Malware payload (Snojan)", "value": "67c5dec35459fa66b3d380b3b30e661e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229213, "uuid": "47c9e2d2-fee4-4159-a614-5bc7f217971f", "comment": "Malware payload (Snojan)", "value": "8de505a3e8fb9f45b0d003a47fed80878d928a0c5e6cf34122d6a285ade07e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229213, "uuid": "df786aab-3226-49c4-8544-ad4979232079", "comment": "Malware payload (Snojan)", "value": "81d8ea8d66270a7374c2ceab3668667fe5c92a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229213, "uuid": "75a919e1-4415-4505-add5-30e73689215d", "comment": "Malware payload (Snojan)", "value": "45218aa5304824c1dbbbabafb21ccbacc44ebc52d0d0652965a075b04cabc27fb78da3e848a4971a9e4734865a0acd95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229213, "uuid": "b0b896af-d3c3-41e2-9f7d-4ed1420523fa", "value": "T116345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229213, "uuid": "f661bdd8-b287-411e-b713-43ce86765842", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229213, "uuid": "19e42ed4-1128-4c87-802c-cd23e810ea33", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/9/FnncroP9:wwDeM7iNEkgiOb31k1ECZJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229213, "uuid": "d8b046de-0635-446d-a1d4-65d80473a8bb", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229213, "uuid": "266e10ae-eb2d-4125-8639-3b44f7e8e514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229213, "uuid": "32a33152-d066-453a-b93a-3df63a587c26", "value": "8de505a3e8fb9f45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e58f09-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1774250596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250596, "uuid": "e078a4b1-085a-4d5b-b0fb-f507eea552ea", "comment": "Malware payload (NetSupport)", "value": "2ef491cb476066ee57d74ec8f6ed01f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250596, "uuid": "40c22f3f-3bf4-4bb1-9a98-e28bee84e0f5", "comment": "Malware payload (NetSupport)", "value": "8e2f63960ffe5e9fddf3e01085991c422625972e24397f81dfc9c39f8fd6f771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250596, "uuid": "ae85cb30-a69b-4fb2-8520-bda57af3d8fd", "comment": "Malware payload (NetSupport)", "value": "5c7fd6d574675245841c868c34db904c40548cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250596, "uuid": "76f3c735-5d79-4aec-84d4-ff12f99d8476", "comment": "Malware payload (NetSupport)", "value": "1b08d0bd89ac5bcdfed27ee5401aab153d16be9c615a03d5d0e73944bdfa6735b7cec2aeda0649c285c8201b33918e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250596, "uuid": "bb9f709e-e3c6-4693-86d0-ad50ea5ad07e", "value": "T1BCC57D0BFCA014F6D0AAA2318523A3527A71FC452F3153CB2A91B7782F73BE49975B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250596, "uuid": "a7aa7e62-aa25-42ad-b061-922c232a42fa", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250596, "uuid": "9b5d212f-b8e9-41b6-adbf-61202f1b76e3", "value": "49152:Iv6zDN1FEaWb8AXEaH+K9ixX1Akb6j2SQc3u:IvQw86gxbbHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250596, "uuid": "9fb758d5-56d7-4722-a217-2fe16698f7e7", "value": 2533888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250596, "uuid": "38ee400e-2915-41ba-9e4e-67420891b1d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250596, "uuid": "4e82f7fa-e47d-49f0-b711-7f6ba50fe150", "value": "WtCPTu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5a84f2-26ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774301630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301630, "uuid": "e011c9cd-4f47-4ae2-9e56-c02427d0b3b2", "comment": "Malware payload", "value": "1447cbb56b3992598f5c9616b986acbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301630, "uuid": "ae577a7b-1bdb-4a27-b197-2ace00142b13", "comment": "Malware payload", "value": "8f731f941252cd966c385776c45d39b8de8e855a661bde42dd09af784dc48624", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301630, "uuid": "2e08cfa4-54e2-4814-9129-cded62067215", "comment": "Malware payload", "value": "5ec2208fe3d5febe42bd32f5e5dd79cc2e6b8136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301630, "uuid": "f5221b3d-41e3-46ee-bd04-bae54a1ace45", "comment": "Malware payload", "value": "5103b24c78b76a2c46db0171b75f2a5680e068b89b15205f406d794c9b761f2f5cbe538ae9f52c37c297934e63e2f14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301630, "uuid": "79b1710c-5338-4c2b-8693-87521ffdd04a", "value": "T1C1F34A17B89484FDC496C23C4BEEA626DA25F84DA034B12F2B957F267D9CF209B1D701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301630, "uuid": "c74299b1-e6f1-434b-8e5e-6266d21a04e6", "value": "3072:KutjvRZUqT6TdI21T5Fo+620gTmLcIoWqhiqBKaPJYpyXjq28:9tjMWW5Fo+62zTksBhPdzqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301630, "uuid": "b01c97df-0558-4ce0-b525-57eb87854da3", "value": 159808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301630, "uuid": "d9069051-7f79-44d1-b21a-157423128191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301630, "uuid": "7c1da2ab-b12f-4516-b2fa-375f00ab5652", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be4d79e-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240025, "uuid": "b8ff2ab9-a288-421d-ab2f-2b9e93f0c487", "comment": "Malware payload (Chisel)", "value": "afb6b5b1bd7b5a5ce7c21f9f88ce11b4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240025, "uuid": "1c5e9f6d-8a4a-4796-84d5-8f982175c289", "comment": "Malware payload (Chisel)", "value": "8fd085641ece4f8870394cf4936bbf6cca01014b7428be6472b294669ac95ae1", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240025, "uuid": "802d1bfa-4928-4e68-865c-e897d96ba7d6", "comment": "Malware payload (Chisel)", "value": "3dfdeda8d3e6c404c12ae00eec59628aaa85698b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240025, "uuid": "2bfb305d-4681-4d80-8cf0-a877216173ac", "comment": "Malware payload (Chisel)", "value": "fd025285d27158a9f17f1c3bbf63db7f17db3204ba190624da53fae79321e08708a7fb961da2e9608167e59ada3d8d0c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240025, "uuid": "1ea444f7-1339-4fe2-8d27-a886face7669", "value": "T1BBA64841FE8B45F6E903183006ABB23F67309D098B25DBD7EB547E6AF8373A54932245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240025, "uuid": "5afc1a4e-8c8d-4fe4-9b32-9e9798ce7ece", "value": "c6fb30ad4dce883317a7260ffcbc1a17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240025, "uuid": "f25ebfb1-18b1-459d-8ba2-e1a234c19bdc", "value": "98304:klWwB+nQfd4yKeA67P/7I8Zz5pUsUdG5D3b0vxRAVprJEOnOATxOgHy9esuhKvyB:kp+nQdAGfz5pUJdGmty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240025, "uuid": "d567f48f-5fef-4715-b932-bcce66f8d809", "value": 10399744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240025, "uuid": "bf68a597-b00e-4c2d-819b-c19caf5fce48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240025, "uuid": "6c1cec49-1eda-46e8-b7b9-a007de4d8e7c", "value": "chisel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691a2d84-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239966, "uuid": "8c0a5664-438d-4e65-9567-e5874ab4253d", "comment": "Malware payload (Chisel)", "value": "20deff5abfd3bfc11aab4b90b734e39b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239966, "uuid": "58db10c1-c330-4a5a-85fa-c80b444a58ac", "comment": "Malware payload (Chisel)", "value": "90bca77796a5b5c287012d6fa07d4b6d0046fcf87f67948ff54a869cc2f77421", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239966, "uuid": "1fd4ef13-a180-4476-a1dc-a5d93e0f9a8f", "comment": "Malware payload (Chisel)", "value": "986f96134b9dcb2ec55d1df250e77b95ba7f270e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239966, "uuid": "d847e02e-07da-4867-871e-fde2fe54e401", "comment": "Malware payload (Chisel)", "value": "bbec39bd79e339acccd6deef1c4e7ccc6319ef6c2942682092cae2e386f881ff47a75c82c124b20a75552b284b225c76", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239966, "uuid": "b51e1737-9184-439f-b8e6-b50c835e6d2d", "value": "T1A60633E81F23F7318D88291B92A4060C77ABD76675FF1831F4AAD3C953FA8154B85362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239966, "uuid": "a6c23e2b-4fc3-47a6-9e66-6778ae351fad", "value": "98304:nbxU2Y0eO/qlN/nu9A54T2LhI9k6hOMhbnG5hsNbXefM93B2P4D0jEJ:bC2X/qlNfu7T9zIqnGkBOdPOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239966, "uuid": "243b2e20-4bec-4a61-996b-c8c72aa1aa15", "value": 3955932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239966, "uuid": "101f8ab8-7002-450b-9908-83831a568eb0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239966, "uuid": "ecb7de5c-dc6f-495f-a19a-421bbb3958ae", "value": "chisel_1.11.5_linux_mips64_softfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e366df-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252123, "uuid": "35351329-5290-4f16-9663-c0126c0f6941", "comment": "Malware payload", "value": "5847fd24e8fd4e592fac161d8ee925ac", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252123, "uuid": "3623b2c5-6a04-4dd0-b328-b443311092e5", "comment": "Malware payload", "value": "90fede5b58a0beb3e9dfddd5f36a5add1fe215b817705675ea452c718564f82d", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252123, "uuid": "2c50e27c-0cd3-47d3-9878-08e601293b29", "comment": "Malware payload", "value": "f0b791b5f2f63e885ba8e7d19453af2899f15323", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252123, "uuid": "1ff3cdc4-e11a-43e7-9dc1-514d1831a0a0", "comment": "Malware payload", "value": "2275ab882b8424af0eade2952844e9c398b8bd2f559fd842ce9646ce0a8029708e2af71db6ed3b6ba1329e1126f8138f", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252123, "uuid": "1dfe3af2-aa76-4bce-9ea8-7e5527199b98", "value": "T1D292A407DA664CA6D861D970166F1ABDCC317C970B608B871B2AFE8D9C31B40AD3778D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252123, "uuid": "7c0b1c12-b625-4130-bd4b-ab5680aa3477", "value": "9f75be0d84082fb7a798e43620ec0a73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252123, "uuid": "1b4a06c6-bd2f-4640-8b00-a9785c398e40", "value": "192:QbOFuT40+L4jxfe6arlC9r04pyP1oynVQBx:+T4RLeKoZm138", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252123, "uuid": "e87df9cb-0a24-4500-babf-4f597c4d6ceb", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252123, "uuid": "6e9783ae-4029-430a-96e4-6ef67e3ee228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252123, "uuid": "f46aabab-938d-4f96-863e-031a9b3f01bd", "value": "Dataencrypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b8bf7f-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Viking)", "timestamp": 1774232290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232290, "uuid": "8cf951b0-4c06-4f71-939b-03f2cb0f9514", "comment": "Malware payload (Viking)", "value": "5c0d5eb441b6438cbc8aed27d6257031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232290, "uuid": "432160e8-929e-4130-8027-61daebb1563d", "comment": "Malware payload (Viking)", "value": "91df2df66969e6571357d524413397df37ac1cb33f67cb30eacd139c6ad9d053", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232290, "uuid": "438e5b8f-e62b-4f1a-b38e-a2e5cab34d20", "comment": "Malware payload (Viking)", "value": "032510555f5e86fb58b74ac655367576073eabdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232290, "uuid": "40fea651-072c-41d0-bc01-d36e452f48e1", "comment": "Malware payload (Viking)", "value": "81c133f46e89634676438b10626e8ac8d27219a4da1b17e316943d021addd277d02014465f5e9c77ba3042fb9cbe5b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Viking", "colour": "#E42F22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232290, "uuid": "8fc3fd84-cf4b-4b4a-a0c3-54ba09081b7b", "value": "T18E15AD1B6FFE48E1E486413554A70FE2A5F4AC21BA21C74AC3B0356EEDF4790F90CA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232290, "uuid": "156e7b8c-e9f9-4aad-95c9-b45797035880", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232290, "uuid": "2f042f44-98f0-438e-a556-e0c6c4ec7b1a", "value": "12288:SjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjiSkjie:JuuuuuuuuuuuuuuuuuuuuuuuuuQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232290, "uuid": "9cce0863-cf8f-4c51-91a6-4e49d1cc6002", "value": 946862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232290, "uuid": "72c6d7e9-9e4f-4c66-98c8-929961f075ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232290, "uuid": "a19e1b37-0101-4ea1-b502-cf88a145fad3", "value": "91df2df66969e6571357d524413397df37ac1cb33f67cb30eacd139c6ad9d053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767512d8-2657-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774229251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229251, "uuid": "1fc88b1f-99e6-4b89-b18d-bd2d981a728a", "comment": "Malware payload", "value": "95eb06f4eed31f6d238bc49136025e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229251, "uuid": "f1264c23-68bf-4d7f-806b-f5012ca223d5", "comment": "Malware payload", "value": "92168406b8de6f8c967b071a9eec741aacc35be3003c9c8a15c3bc4f78570a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229251, "uuid": "74cc005c-380a-4e76-aacd-040f17eef9ad", "comment": "Malware payload", "value": "36a86c9a3b06ed2459980e8b989a1baebea27f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229251, "uuid": "43fc09cc-260e-4d56-ab8c-11e58b552d2b", "comment": "Malware payload", "value": "104ff9ac8dbf262c18090814b1591bdf2e6bad44189d82c8e6eebb74c3bd79e393ca66abafa0856fbe4b3a0e6321235a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229251, "uuid": "000208eb-d582-4c0b-ad87-711d1bcdef67", "value": "T110F41AB7ED1578F7E830513489922767B67BB4819362838B1748252E6E53BD02F3BF84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229251, "uuid": "ee40280f-f0f1-4f88-bfd2-ed07e14518f2", "value": "f1f8ed3ba9146753aab1bc8447e80b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229251, "uuid": "6bc962e4-3d8c-4522-84e3-296ab829d511", "value": "6144:Q80j6axS1hwdj+z/vntQQxeWkQwkA6SGgtfXzLiKuZL70dEJAyQnPXBjg/LcMopX:lwZ6/ftQYkQNqtvNuZOIAyQFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229251, "uuid": "2e4030de-0f19-46b5-acea-5b43c9742f5f", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229251, "uuid": "e41989e9-35f1-478d-8122-23097358d9ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229251, "uuid": "6670d8cc-12f3-4eba-ae39-ae4fb66bf03a", "value": "92168406b8de6f8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002e7f13-2676-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242367, "uuid": "6403f79b-480f-4342-9bff-f97e77b7f537", "comment": "Malware payload (Mirai)", "value": "e729f945586de4a4be53ce9c6e88a5b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242367, "uuid": "666b09f6-71ac-436c-a6a1-84de83ddc6c9", "comment": "Malware payload (Mirai)", "value": "9218b616ec5614302f89e59aa9afe0181bcfe3603b499a8a41fc45083525a7d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242367, "uuid": "786bd340-e712-4048-821d-d34fe7348acf", "comment": "Malware payload (Mirai)", "value": "0fb3f8c311d2b0e79ba3e7184ad12f8d3bbb1cca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242367, "uuid": "683da58b-b770-4e1d-bcce-292aee24f335", "comment": "Malware payload (Mirai)", "value": "b45acc3082ed9eb182f6061e050838ac516ccf457870e221a3dea074e06cc1cdc0ee6bf8f1186005808eebabe7e36991", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242367, "uuid": "12e6ef4a-a795-436b-8853-f4f6ea8a4ca5", "value": "T1BEB30945F8445B17C6C666B7FF8E438D7B2A1758E3EE720399256F30378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242367, "uuid": "fabee9eb-0abe-484c-b830-d40feaf242a4", "value": "1536:p7jnPq8azP4V8YOTIBRvyNOzIuSIwYeFWd/lk68wywlQ3Ym3Tb/V1oEakCxQ:lzPqF41OUBljSIxecUtCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242367, "uuid": "f59a4a90-26b6-4902-a762-68a3657e5845", "value": 113184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242367, "uuid": "52db5adc-6613-49dc-a7b1-ac9c8a9c3d4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242367, "uuid": "10f2fad2-3601-4be8-9bba-32f6899fd112", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fee3c9-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "f6ee0538-8917-4760-a7e6-8e7ed7875388", "comment": "Malware payload", "value": "28c743836998f7d60b400841bd4eb784", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "00947778-e3ea-4d16-be2d-5c4ca1e1aec3", "comment": "Malware payload", "value": "923d1bdc5d94357042c49919ff4041f89f46015bd979836f39dd63d89c9eff70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "340dc140-f886-4ade-8449-d3ad81ff0b6c", "comment": "Malware payload", "value": "0f33ff3926bc29a855c4817ecbd3ef0d35ae1146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "1e5d5e61-ded0-4bf2-b8b6-6a2bc6b7df3f", "comment": "Malware payload", "value": "73e38b309d2565f44da4ed0b0c2b6b866478e30aae1a0ade28ea1a91862b9fb39d2f65998199b37cf3dde3cfd0155032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "bd963ed3-2df2-4e24-b34c-2cacb3304570", "value": "T1A2B30913B98284E5D65C0531086FAB74F665EDAD0F105F9723E4EE2E6C36280AD373AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "6748828e-de4c-4af3-bb55-9aa321817739", "value": "f42369329f8947203291f123f3535dde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "701066b3-6a94-49a2-967a-1fede55715a4", "value": "3072:Shr//Ut3dz5wmYZIouC3Qv57/jnNMFlq5T:ShrYR5wmTjv57/jNMFl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252101, "uuid": "4d1e88b4-6b6b-4d85-9a98-111a7026e4b2", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252101, "uuid": "d45f83bf-3bc5-4a6a-875e-16216bb9b1d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "c8e7bf45-f853-4b66-80fe-22784f2c27f1", "value": "exe1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f43c4-2699-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774257478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257478, "uuid": "d6ce2086-6374-44dc-8847-bf5b99f79bd0", "comment": "Malware payload", "value": "4db34bc2d006ef84c12fb44c12b4a9a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257478, "uuid": "40e29591-2511-45d7-b2db-35c4b5990722", "comment": "Malware payload", "value": "924403dd6074e9fbd71add4248f738912f4b499e271be6c03d759f70f80aae13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257478, "uuid": "d21f7d10-2678-46df-af2a-cc0fdb5ba4c9", "comment": "Malware payload", "value": "509e85d6bfaf484a589eb322e72379d99820f310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257478, "uuid": "75d6fc78-125b-4be5-8e93-e95d719e66b2", "comment": "Malware payload", "value": "88e792a24ac14cf9b49d74f063b4c127430ce7ef51acbae96fe712612cec9724c4123d32bf4c2b291f992fc0cdede45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257478, "uuid": "ebe41e6b-547b-4e72-8045-cb53da2f23b3", "value": "T12194F52772A185BAC12C817FC1D2CE50E43B75790737C9E716C5022EDA48ED16E3AA6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257478, "uuid": "25a5937b-f6b5-45fc-9cd4-1213bb7c5f99", "value": "6144:z6EIXulCiOwO/fr8L8zJT3xxCS8pabd5kEh:zrIXugiOvr68VDgpabd5k+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257478, "uuid": "4ab3184d-76ee-43ea-a41e-3a54500976d9", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257478, "uuid": "7d8e2f78-179b-4d4f-9a2b-43e8a56aa3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257478, "uuid": "9a310df3-9b9c-44a0-ad10-04a33bb86c20", "value": "S6xWuZ1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758d97b5-270a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774306130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774306130, "uuid": "aeebe6d3-ee70-4930-98b6-d1f4941043e7", "comment": "Malware payload", "value": "3ccd7ab36f349ead67533c63574425c5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774306130, "uuid": "423699b1-7776-4744-ad77-1ef76f7b673e", "comment": "Malware payload", "value": "9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774306130, "uuid": "3a55c7fb-4b27-45b5-9bd6-25407ae44efc", "comment": "Malware payload", "value": "4aff0ceb93cbd66546f0428a1f875ec9cc27aa87", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774306130, "uuid": "668b6ab1-01a9-458a-9f78-d215e6e45658", "comment": "Malware payload", "value": "468d42b7f76f6fb38d1464d10d455bd7b02201e40dd22af4de7324b1873d049f7c5379d43d17c205fdb44410de8bcd53", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774306130, "uuid": "993b3b27-24b4-4e3c-9c93-12f12ad71ae0", "value": "T17A11DCAA31453AB2EA40D39D3ED1C23053C8C6D6ED2B55FC11BE40DC47DD0513E65271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774306130, "uuid": "737336fd-e8b5-4c84-8c1c-9f64ae9507c3", "value": "24:ICl3wINj1z3RAYDrJ6aXUtyWMKOhClpClKCl2:IC5wyhznDN6aX+DMRCfC0C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774306130, "uuid": "a48d72fa-044d-4c2a-b267-2cd10a86e0bc", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774306130, "uuid": "856dd392-b146-4c30-b00a-18870a270fdc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774306130, "uuid": "40b8df22-cd66-444a-a7fd-895b97c4cbb9", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ff003d-26a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774261646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774261646, "uuid": "d47d66c7-6425-4c9a-aad5-7c7f9580cf46", "comment": "Malware payload", "value": "86f4e762d441026a88cdb6a3339dc235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774261646, "uuid": "4aa5aa82-93de-4f1c-91c6-bce620c527a1", "comment": "Malware payload", "value": "94826673c7f54435e62ddb5d187cd852cbbadd0ddeab528bb7ccc0def7f65a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774261646, "uuid": "870df546-775b-4c19-aee3-922f209059c3", "comment": "Malware payload", "value": "81dd06ba6aeaf9f6af66727dc05448c699ab0034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774261646, "uuid": "5f0cc45c-e02f-4bf4-b1b8-2d3e93b3fa5d", "comment": "Malware payload", "value": "42a70e22ea54827d68b323f3b5be79c457c1d1ae7b77ecb70bb8dbaf47ebcd0b90d4926959a9aba022d819f280338187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774261646, "uuid": "3c36e179-65a8-4dce-a01d-52aa2d382c1a", "value": "T1C5551216768DCE03E9EA83F52B61D13807B06D9EE459D31A8FDD3CEB3A21B1419053A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774261646, "uuid": "dd111343-4aee-4a46-8a0b-663a43a4426b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774261646, "uuid": "1c98505b-1812-4f82-9f5d-3ef1c80bef26", "value": "24576:rSmpMJzHXIB3w+MCfLjJLB6aWyarzGx/WE4z3Ryvqic25zdlgp4xmm+c4B/HQdS:rSmpMJzHaThfLjJN6aWyarzMeeZ5/44b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774261646, "uuid": "714d67d8-506b-45d5-a293-e618b19ad9f7", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774261646, "uuid": "52b5505d-8011-4747-b3a2-63dd2cc65472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774261646, "uuid": "3d78ce71-bd64-461d-9bc1-df7ef47f36f5", "value": "SecuriteInfo.com.Win32.MalwareX-gen.13914.313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6f6815-26b9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774271214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271214, "uuid": "6667638d-d365-45ca-94da-f18ee7fd069a", "comment": "Malware payload (AgentTesla)", "value": "0bb4bdc6cda844fb1509683b4c577d21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271214, "uuid": "36fbce03-cfb4-466c-9a65-90341de66756", "comment": "Malware payload (AgentTesla)", "value": "950dbae7693938581beaa07a588c393927cd315e981936d85fe32d309cc8dac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271214, "uuid": "d08018e3-d895-495f-87b1-e706018c811e", "comment": "Malware payload (AgentTesla)", "value": "da347865e107bb5c1b56c6da4872092200aa76ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271214, "uuid": "e9c1d7fc-4fa3-4c71-80e1-9a0ea1666473", "comment": "Malware payload (AgentTesla)", "value": "d16ca09135ba11c941377f7737c964a0eaed86df739556f82fc50cd1694d0a0e220a7a5630c2b23d7645d23d0513d619", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271214, "uuid": "9ca9e35e-77a6-4dd6-941d-f70136bd53b0", "value": "T1A435BF0273C1D062FFAB92734B5AF6115ABC79260123E61F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271214, "uuid": "e0ca6088-943c-4003-bb41-89f6916c3f3a", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271214, "uuid": "6dbe02df-311d-4dd4-a62d-c368beda8dcc", "value": "24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXdaq+bfnKUv2:1PVt/LZeJbInQRaqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774271214, "uuid": "dc950254-9e51-4b26-8a11-df505eed8c6c", "value": 1138176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774271214, "uuid": "0da704b3-29c3-476b-ae92-fe2470243c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271214, "uuid": "77ac95d1-ec3c-4c5b-9ea6-bca552589f6e", "value": "PROFORMA INVOICE______________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0206324-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283008, "uuid": "52b8d6af-10bb-441e-9e39-db6985092c2e", "comment": "Malware payload", "value": "c76144616c360a39873344ef0b5efb6e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283008, "uuid": "9eed6939-991d-4869-81e9-c0c7efe7b86c", "comment": "Malware payload", "value": "951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283008, "uuid": "76d26d68-a69f-44d6-9d6e-1885304adfab", "comment": "Malware payload", "value": "4cf441a24a2aa4aacfef8a91285212876f95c11a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283008, "uuid": "ffb3505f-4cd6-45de-9de9-e207366b2cb1", "comment": "Malware payload", "value": "6b293eee7635d86b89ed42ed1b48d7d1e7de466eb599254bcc88c2d0c732098f02740123b55f24defb218ac6552ddab9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283008, "uuid": "4c88fa21-6080-4361-9dd9-fde381c8c1c6", "value": "T168F53335F47407ADF065563224FB63D2E29EA81BE581414AC7666897D00FBFACB4FAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283008, "uuid": "c820ec85-b13e-4402-a603-11b84f1ecfb4", "value": "98304:vEdprKUJtFiWqXMTjoCN22X7Zfz312WmU4IMmhMAUIgODHt5:J0iWqwjNXj1CtIM2BXg2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283008, "uuid": "dbb82284-c5ee-4f64-8a85-f64f97c2e9a9", "value": 3425931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283008, "uuid": "1c177469-3c0c-429d-9cc6-db2bc938c53d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283008, "uuid": "d6ee1e1d-9cc0-4c65-a730-a1880cea8fb8", "value": "sample.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446585ab-2704-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774303470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303470, "uuid": "03a97978-0451-4082-b0d6-ccb37be21a9d", "comment": "Malware payload", "value": "c755bde98ff511a36e7a54d56916173e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303470, "uuid": "532f7576-e0f3-4d35-bafc-754cbaff3683", "comment": "Malware payload", "value": "972e9bb360be09837851e5848a80546ed039e3720c191078ee450d1614d2ba6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303470, "uuid": "27419f2a-3360-462b-8f37-444a3c9dff35", "comment": "Malware payload", "value": "d355a55a429221f7f2f07be15974bbab329048ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303470, "uuid": "c99858e8-2e63-4429-9063-c3b655e8ce6d", "comment": "Malware payload", "value": "827d4e9deca1e99a7a4daee8e8714f28c560b674a842b91bda0b9dee2305b1660910df85adc67916bebaf8ebcfffe456", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303470, "uuid": "c2060f4a-112f-47b3-bd0a-217e823d4c34", "value": "T1F70418457E419E33CBD0667ABBEE42CD732223FCD3EA7112EE014B16369652A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303470, "uuid": "62287557-5349-45f3-818d-e99e60a26f3d", "value": "3072:HnIsZbAWMJmhqIVB+6RW7wyE1KklRZak0nihOQ6yYFH1d2zFeqGDSzWNndp/bl2s:HIsZbAWMshqIVB+LdYlRZcnihOQ6yYFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303470, "uuid": "d07b7e7f-2963-4386-a81d-626b76749c8c", "value": 187448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303470, "uuid": "cfff1191-38a5-4587-bbb2-01c54c27c9ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303470, "uuid": "4985bcae-58de-467e-a400-bbf18c97dc73", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63434edf-26f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774295361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295361, "uuid": "50a96237-d283-430c-80cb-b083bb8972e5", "comment": "Malware payload (Mirai)", "value": "7b573503530da06b092c03d35b47fb7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295361, "uuid": "8ad08148-38f9-4320-8440-c583d89777cf", "comment": "Malware payload (Mirai)", "value": "981de95bf2016a9edaf5c015c722a9fe8be4892052972cd295563956198fb6ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295361, "uuid": "23984f85-bb47-4a08-aca8-928b97b0154c", "comment": "Malware payload (Mirai)", "value": "face4379f0292d0a52cba7dfc77705e50fd025ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774295361, "uuid": "79b47dd3-2194-486e-896d-a1a21902cdd3", "comment": "Malware payload (Mirai)", "value": "7e09481a54b1815af802cf97cf74babb72934bee37e500b8041842a4eb700553c2d57ddfde5aa7da851dd89eaa8c2cd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295361, "uuid": "8bbbd9d5-bc1a-4d8d-9a44-c437160773ba", "value": "T124A30759B8829B12C5C106BAFF0E518D3313176CF3EE73169E248B75378AA6B0F3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295361, "uuid": "71b038e8-1b3a-47e0-95fc-b548c6001f32", "value": "1536:NqnFELRtlcctNVyuSh2nVsHIYQwMN+arK7ONMEigt34uq+q372a5Ecj6We7+1:7RtFzShomouMN+arRt3Hq+0SarX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774295361, "uuid": "89f6a30a-e61e-4cab-b7dc-a0e406100277", "value": 104548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774295361, "uuid": "2007963a-018d-48b8-a32f-16cb35bfa76d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774295361, "uuid": "794bee17-49a1-491b-8ddb-39cc9307a9e3", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e992c1d6-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242329, "uuid": "90c9ee04-757b-42de-8627-b3aaf257447e", "comment": "Malware payload (Mirai)", "value": "a6174f43994ea48c52948224c3865fad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242329, "uuid": "272ea1bb-c321-45ac-944b-8266a0d8b0d5", "comment": "Malware payload (Mirai)", "value": "986e47e6df4137397572fa3d09c84de7e5e51d7085da0d05324a36a66f38eefd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242329, "uuid": "caaa9f93-7f9a-41fc-9c59-bae4999cdd60", "comment": "Malware payload (Mirai)", "value": "b3243266b0bc723bdf659b77420c521042c2485b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242329, "uuid": "588dd997-71b9-4c41-948f-c8cb8b572651", "comment": "Malware payload (Mirai)", "value": "6b47c7d0d6fc55b50d6216613de184fb8b4801d8161fa5311ae5f793676e8ce8c151d262d0f7457ce0323aec38801c83", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242329, "uuid": "b4374a2a-6c02-4351-be9b-cc92e658a719", "value": "T1DAE3885A6E228FAEF67C873147F74A20976D23D623E1D684D2ACC1141F6038E545FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242329, "uuid": "228a097d-7e9b-4e5e-ab3d-a0a4864caf1d", "value": "1536:p+vTcKot8sp2MKypYz8ZOfGQ+v3eB/hub8mXRCTUGk4onuftL4VxKdbK:p4lybKpzEOfGQ+vEubTt4ouftL4edO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242329, "uuid": "b4202af4-5214-438e-9cf8-f0bae3ee0348", "value": 156680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242329, "uuid": "e4fcf15c-ae0e-4673-b46b-8390d5a31000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242329, "uuid": "985fcaf5-decb-4236-b463-96a1735c1476", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ece0c79-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774240003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240003, "uuid": "154e28ad-9b7e-44a1-bcc7-6c1b326d79e6", "comment": "Malware payload (Chisel)", "value": "c91d5420238b3add84a3729aae7661c2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240003, "uuid": "ae772d35-eae4-41f5-8e63-f505ed286541", "comment": "Malware payload (Chisel)", "value": "98702356b96da5bf48e5875a28d76e3b429867e8aa5591940af67087702c87fc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240003, "uuid": "ff01c3b4-8e3b-4af0-95bd-e9070592ccb1", "comment": "Malware payload (Chisel)", "value": "55166ed984876857ad61dadee60e0a5c14acb1dd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240003, "uuid": "5dda7c43-2935-42bc-b111-3f7cba20e87c", "comment": "Malware payload (Chisel)", "value": "8f93faabf07576d18105958d18f696a182289da7b042c6e4c278e21a009cbf61b5f3be934e8e3c5aaabed715fa8b19b0", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240003, "uuid": "1254b2f0-3988-41aa-a56e-922689820661", "value": "T1B71633CFA5198C60E7F79A3D374F6DA079610990C385E30BAC773315AC4A8B5B8E16D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240003, "uuid": "be2d9adb-0781-4be2-812b-bf93e3408106", "value": "98304:nmVdwPcsNNSj3Jk3d4skFU8B86nju2arZklf3HjEz:nwgpNNSzCOskFtBri2a1kFQz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240003, "uuid": "0a4e447f-8c54-4869-99f9-aa38f6567ffd", "value": 4076116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240003, "uuid": "013566af-7fea-4c35-b6c2-10ad822bee7a", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240003, "uuid": "6c573ca7-7ab8-4098-a2d3-950a3bb07df6", "value": "chisel_1.11.5_linux_ppc64.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c15155-2704-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1774303679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303679, "uuid": "447df2c0-0d58-4332-aff6-f386c9da98e9", "comment": "Malware payload (Amadey)", "value": "a025b901a7979bff2a6c6e4e74c7c76a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303679, "uuid": "d10b3475-a3e6-4102-9670-7ac53c8d9f4f", "comment": "Malware payload (Amadey)", "value": "98e504cc7125b79eda5491f40b998605a05f4cd968b961aab4cce7beb074fefe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303679, "uuid": "388edd4d-a505-4426-a6b6-80f3a6e7c4fe", "comment": "Malware payload (Amadey)", "value": "72cab50156ba4e2d5f4de97f672d4635e98ddacc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303679, "uuid": "f43cfd81-fbb7-4f67-b0e6-eda867a110ea", "comment": "Malware payload (Amadey)", "value": "08b00c0e8b61f009eaec29f41bcc02c11c82cdd048a7f7ee44cd85be4a284a6aac7dcaff2cc91085e41d0748becf66d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303679, "uuid": "ff7a5941-bac6-45db-b70e-355ec6ca8248", "value": "T1FB944C213817C032D56091711F7AFFF685AD69269B7149DBBBC40E375A202D2AE31F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303679, "uuid": "4ef9e18b-27e6-4c83-a36a-c356d1683f40", "value": "6d1f0062d3cd177e7836b057a643ab5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303679, "uuid": "3587b324-43fd-491f-88ea-99e4f404f406", "value": "6144:j9n6rEDxy8DR5N2TaxKF+C7YYboMB+qTd0/bkmZKfmWGTiFpM6iAOCpvztp4:j9n6rEDx3DoFJ9gqTdkWBiMtp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303679, "uuid": "07bbb82d-4312-4735-93c5-f390defc89f1", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303679, "uuid": "25cf5e59-fd3e-47a2-aa71-26d368584dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303679, "uuid": "af96187a-fbb0-4ca9-bd68-4a0a3b94c812", "value": "exs9yhm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c69da9-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "7446f412-2dd6-4ab7-97a2-d6698f6e0668", "comment": "Malware payload", "value": "dd95c56f6fb1a3f072eea56a8995bd5e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "d2942a2d-65b0-4390-8add-68ad7576ce23", "comment": "Malware payload", "value": "99443ec987417f05f52cf6e0e4f3d51021b37e24c857ad9ae70b08c060c4d139", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "6467ad83-e739-450f-ba2c-0f29d5042a6b", "comment": "Malware payload", "value": "801dbe5b30bd4b2c5b5fbed8e11335871aa6d69f", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "4ac041ec-034a-4c29-8d93-32a040f1d6db", "comment": "Malware payload", "value": "ebfaf259e362dd3942f9b53a0165c2140beab4c482ebf34a798b99ee0dda7395038cda7aa589776b39ad21f5776a3784", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "8de24619-dd4a-407b-bbe1-974a8c48a366", "value": "T1911533800729A9724703AC3BF778416110BEA73D733978EA5C67E508C3999B866F4ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "4f647f74-70de-4912-a455-856debc2a3e5", "value": "24576:pL0HURpqnHtSt/TecgCpyyOeZ462yWWO6AKM:peHnHQ1gcyyOeZvHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283019, "uuid": "1973c9a5-00a4-42b3-a801-d98f0b1bfe56", "value": 883656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283019, "uuid": "41f0c6e5-c438-48ef-8bc8-7b3af27e59d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "6074acf5-0628-4f22-86bd-f8b7972d3a28", "value": "app0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e3a3e7-26ca-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774278535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278535, "uuid": "d117bf94-5b6e-4f29-8a74-c0509d76314d", "comment": "Malware payload (NirCmd)", "value": "4f5f99133a2446ba692ad6e0fe93a336", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278535, "uuid": "9ae4cda6-d5bf-4cda-ad59-2e823849bec6", "comment": "Malware payload (NirCmd)", "value": "996b220385d327e249fa6d0f7144e4eea6da9cbc06a39da690f208ab2b322701", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278535, "uuid": "a0ab8647-bec8-49a2-9e9e-abe76198bc8c", "comment": "Malware payload (NirCmd)", "value": "f03a24bf9cdec0f03f549d1e03435a3ddce1ac24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278535, "uuid": "f8e42bee-4f2f-4ac6-a801-447fd8ac235a", "comment": "Malware payload (NirCmd)", "value": "ca67a625d37fc9d5c035497f23be9b02ee6f326f087fa5b18bdaf5887aab2b5024f66c1a8f8cf4179ddb6f0c958442fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278535, "uuid": "825b0864-b908-47d1-9ede-a0e94d800a8d", "value": "T16EA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278535, "uuid": "841e9de2-525b-49f3-9bc0-9c0f28e56e86", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278535, "uuid": "25d4c293-9a06-49af-94fd-2cf2409e67b0", "value": "49152:ABRRTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a7TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278535, "uuid": "96c69550-a7d0-4fbd-8b9e-83fad6e34417", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278535, "uuid": "30cc8a52-7648-4b82-b18a-bc343afab3bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278535, "uuid": "4d1c3263-f464-4fbb-9f37-59f5aa4b2d52", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa08679f-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283025, "uuid": "50a2f3a4-4bd4-4014-ba34-c4e9109542b6", "comment": "Malware payload", "value": "4cff805b0b554c64ea54be0bf6dc7cd4", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283025, "uuid": "bc496202-30c2-4be1-a075-76b832540a88", "comment": "Malware payload", "value": "9aa6615bd324eea03f429b9784d67d006f0011fe46d88bf9908798e1552382eb", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283025, "uuid": "120135fd-df3a-4d14-a478-14df93c67869", "comment": "Malware payload", "value": "9d1bf1e3091465b6fa538691a0a32b55f5d016da", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283025, "uuid": "d48d2c66-881a-4626-be17-8eec01a1ae9d", "comment": "Malware payload", "value": "64d242230cbfe92e588f20989d2e7ec45af4eeb1bb04908834b3127aa577d67d74a7e8cf197ff6cf587bb12ee52cfbde", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283025, "uuid": "b50df234-8699-452a-84c0-39c61efe3b77", "value": "T1E94142E0BD5ADD36F80401BCA48A8B131BE1442F109DB54862FF7962460E58EF79B739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283025, "uuid": "b17f60d9-2d86-4319-b89b-81709adf0eac", "value": "24:6msuQgqL1/e+NfLrfxaMdfg2R2+W9purQUBpnoiEGQJ7xP:6mXQgqL1/ecfrd42RYYrQInoiEG4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283025, "uuid": "ea44b5eb-6b92-470b-8e4b-8cd1129c8d8b", "value": 1912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283025, "uuid": "b0c4ac1f-0098-4b5b-909c-333756af6333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283025, "uuid": "2c734d36-579c-410a-b660-08849cedfc17", "value": "mossad_102_8083.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383b6722-269d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774259212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259212, "uuid": "f1784cc5-8563-4fba-b7d1-d97582bbed7d", "comment": "Malware payload (a310Logger)", "value": "3e492d01c5683f3ac765f40bfd9ebb2f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259212, "uuid": "db0d8de8-deee-4b1f-bc00-14edd5378e5b", "comment": "Malware payload (a310Logger)", "value": "9b0ba305e6d75c6c3054d8eea221edc97f6c20db07e12f94fb3de4ab4eaefe6e", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259212, "uuid": "1a7585c0-3d65-401e-a5e3-16c2446601b5", "comment": "Malware payload (a310Logger)", "value": "786995778ee499d427ddaf910722c05682c488be", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259212, "uuid": "e1fb5f50-1b58-42a4-8776-d468e29213b1", "comment": "Malware payload (a310Logger)", "value": "4eede3aa77595aa059cf8a31fcb86f26d69a0b2a14aaa598f481f319e18255898afff6b446e78f0e86b2bf6a665a8ea4", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259212, "uuid": "483b75b4-cd86-4e83-9d7a-cbc05248d2bd", "value": "T1E8C5A006356E3FFC6BE48C2BA4D0604F46A16FF511D67C5EBB72C54204E2A029BDE1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259212, "uuid": "555a501d-7c4d-45bf-8924-de351ad66aad", "value": "24576:vNB+4o5gMpIBMzEOm1kZuAj2tD9YdiCsDfi9m6B2O7nHQBoTWEZhrqzZ91RZC9VS:62+lm1xAj2tRYdinbgBjTcEsZC6T10Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259212, "uuid": "dc5be6c9-507f-4170-a4f2-1e2191480486", "value": 2686101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259212, "uuid": "ae4fc6a2-8cfc-4749-aa7b-a3c39a005e26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259212, "uuid": "a9e1405c-5c31-4691-9bca-72ec9d88c33c", "value": "3e492d01c5683f3ac765f40bfd9ebb2f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8830835-26ba-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774271909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271909, "uuid": "16b5c034-60b1-4f74-ac4a-99e81d1faf56", "comment": "Malware payload (AsyncRAT)", "value": "456fbdd3370f2f4b48de6b0180db55f0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271909, "uuid": "0efbde35-c06b-419a-88f1-9f8655f59ab4", "comment": "Malware payload (AsyncRAT)", "value": "9b83c0732765e63022102b3e590f0aef07d488a0c967433ef38a8d7648b1fcef", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271909, "uuid": "b7509905-7287-41b5-b300-2b9137115977", "comment": "Malware payload (AsyncRAT)", "value": "db2ae4ccc5a0c47bde9b534b0d71dda7cd0d3024", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271909, "uuid": "bcfaebb6-3b8c-489f-bdbf-a9870412e1ee", "comment": "Malware payload (AsyncRAT)", "value": "3158a82b63245fc6a45b5679e164ed45513074f81d802a691234aacb9dc73feae449915898b9b210bc7817f0839c965c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271909, "uuid": "5d58adea-b7b2-4259-a847-6ed76eb7f7d8", "value": "T19435BF0273D1C062FFAB96334B5AF6215BBC79260123A62F13981D79BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271909, "uuid": "321bded8-aa8d-4e12-9a29-eef8823b87aa", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271909, "uuid": "c788f0da-c5a3-4aed-9924-5dce1aabfe82", "value": "24576:K5EmXFtKaL4/oFe5T9yyXYfP1ijXdaBGUHjDiO9DE7CcMmK+:KPVt/LZeJbInQRaBGqjGCc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774271909, "uuid": "952124c3-dfdf-414b-adc9-eeaa809ee915", "value": 1163264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774271909, "uuid": "416df3f2-8285-49ba-8428-328f6283ebb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271909, "uuid": "5edd296d-abc0-4fc1-83b7-872eebc36ed6", "value": "PURCHASE ORDER .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cb63b9-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1774250775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250775, "uuid": "031d4abf-bdb3-4903-ae36-d05db9061334", "comment": "Malware payload (DiscordTokenStealer)", "value": "d956b015e9131c9a6a7be638cd8cc238", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250775, "uuid": "b83e438d-b385-451e-bdf5-e4062e8edcbb", "comment": "Malware payload (DiscordTokenStealer)", "value": "9e883142122abcb78a591452c58a1f8b840f8195824ce5243ce38e7ccc418f15", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250775, "uuid": "7d770df6-d96b-489e-8f8d-f81ecff39cd8", "comment": "Malware payload (DiscordTokenStealer)", "value": "26816c1996c6e47e4ad0972ad18ae857a681a306", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250775, "uuid": "863d5816-29f8-4f42-bc6f-36be12aed756", "comment": "Malware payload (DiscordTokenStealer)", "value": "7fbdf531cd99b57e37bbe945e97c301cdd57ea913b33279eaafdd9a4343dbaee05fc580c6b36727b10974e0ce9027991", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250775, "uuid": "bcea4fa3-ed03-49a6-8a1f-570f3a5c85eb", "value": "T199174BC7F8925ED4C4EA8374D12A41ABB6627C091B3823DB1A90F7302F367D49E76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250775, "uuid": "4923b191-0f22-4fec-908d-8cb26ee43d78", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250775, "uuid": "5483be3a-15d7-420b-a930-096b5ccd455e", "value": "196608:NMSZeVYR6x1VvAYsFwtZCR65k/pSnvF4xbmv:NMStRgTvAYqwtZ0/pgF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250775, "uuid": "ae3ec563-5197-47cf-a634-3692d8e1a5d3", "value": 19208704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250775, "uuid": "b1da8f7a-ddc1-4e67-ba82-535d273222d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250775, "uuid": "157246a6-4634-4031-8241-307bcc5dd2cb", "value": "phantom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dcc371-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242318, "uuid": "feee85ef-abe3-4863-a83d-48d1b5c3fe47", "comment": "Malware payload (Mirai)", "value": "22f08bec8ac624575071e99d298e8608", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242318, "uuid": "161554e2-8c54-425a-ba10-86ab1dd3e1f0", "comment": "Malware payload (Mirai)", "value": "9f707cad4c2ee859b724ba801c66415cefbd7c1590271c877747b3f32a4a1baf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242318, "uuid": "1f177777-96e5-4c32-a331-995fee728431", "comment": "Malware payload (Mirai)", "value": "e6b770646552baef71f158bcdacc91d8d25fd127", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242318, "uuid": "2b18da4e-b02b-4f4b-bef6-8a034782f50b", "comment": "Malware payload (Mirai)", "value": "2bc0a74d884d31b592266e7dc51bae7ac549d60fdc3fd18a812a150beae7d1592ba97197ecb1a399dd06d74c819c3f50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242318, "uuid": "42aa513d-5808-43f5-9773-5e8c27ed9613", "value": "T1B2B30945FC505B17C6C652BBFB4E428D7B2A1768D3FE720399256F30378B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242318, "uuid": "6959666a-0c69-4acd-8fb6-77c662a1755a", "value": "1536:jUK9yqnU8vGRz4VA4j6T9y28Ty6O5FtZpqQcZlCtwywXvqcVuafhPeA45ZvH:QixnUHz4Z+5ypkn3E8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242318, "uuid": "799a6aea-1a5a-421b-b19f-68b4d9444890", "value": 117280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242318, "uuid": "51cce71a-c1ef-4e9f-b0b8-0e94b4fc4173", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242318, "uuid": "eb6db491-1695-4363-9728-4bbdaae99e9b", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2466205f-26ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774301269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301269, "uuid": "38e9a335-a8e7-4379-afce-f174a3d9c151", "comment": "Malware payload", "value": "f6d84e78da400e767db530d69adde7b4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301269, "uuid": "a6decc68-1e39-4a1b-a735-79a935347360", "comment": "Malware payload", "value": "9f7c76a6c0bfc41e952302077e867390bcda68198ac44492b9bc745fa05be2f4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301269, "uuid": "cc6dd835-99f4-43d3-ba59-483d352fff26", "comment": "Malware payload", "value": "dce3bf20ca7ff6d9909ebfa6e73bfb5199c21884", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301269, "uuid": "5dde1a71-46a7-47d1-8ac8-80b4f123a79f", "comment": "Malware payload", "value": "0c40f66aaddf33807ef51884464acf56394ef80e297b3a119787f4dfc95c613312c88067601febe4446a70dc07011fc3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301269, "uuid": "0ea5a01d-4651-4282-9d4a-71909b7eb5c4", "value": "T106925DB512896C79FBD0CE399F3C7F4CADE8C2C42124A3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301269, "uuid": "658da0ef-7e26-4a07-aed3-a510f56b33bd", "value": "384:CFcuQpWx+BL0SWL0guzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:CF8i+BL0SI0lzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301269, "uuid": "0c172ee4-23ef-42ca-8bca-0059d74dfea1", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301269, "uuid": "e6ece7b2-5f28-4150-bae8-39cbfa1c39e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301269, "uuid": "a9327b17-077d-4c59-845e-beb746235921", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b400f87b-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283042, "uuid": "6cf603b2-554e-4adc-86f2-6b8d6e8af644", "comment": "Malware payload (Mirai)", "value": "d340eef813310165e9e19e887a9942b6", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283042, "uuid": "ff5db14f-3ecf-4348-864d-83ed4c248f4c", "comment": "Malware payload (Mirai)", "value": "a06aacf9f47fb459344f5b571cc010da79f1556983772e2c14d2338e2c93b993", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283042, "uuid": "0f643d67-aff2-4a80-a92a-7b39c3adbfdf", "comment": "Malware payload (Mirai)", "value": "cf27065f7dc7f0df41773ad58ed76aa92748d64a", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283042, "uuid": "362b3337-d221-4b87-ae96-62e5c61ad2ec", "comment": "Malware payload (Mirai)", "value": "80562a194d9feb55df20d09b1f2acb0a3d26cba416945c09bfa1851fe026e92b6c39993cf1ef5b067e1c04570b67743e", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283042, "uuid": "4637e996-1272-415b-83be-e7a75dc6c49c", "value": "T159C44A59A8419795D1C02BBBFF1D934873131B38E2EFB1069D196F246BABC1B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283042, "uuid": "8b57af87-eeed-47c4-aae3-a7ff1d4a123c", "value": "12288:b/t7C0fEXNdU8vVDZHCGbKTEHKHRfD5EFCwF5IkrPD5ahgcRBrLLWhQBshW2:bM9dU8FZHC28D5uI+wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283042, "uuid": "9caa6c55-4d17-44fa-8be2-b8e7e89c520b", "value": 572812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283042, "uuid": "452d1d57-523b-4fac-8a2d-111abe2ab0e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283042, "uuid": "6fbf0daa-aff4-49a5-a8db-1d77674e00c6", "value": "141_98_11_123_21874_march15_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa5d52a-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239996, "uuid": "56d6308d-d948-400b-829e-2d3975cab084", "comment": "Malware payload (Chisel)", "value": "a880eba801c7c98c803933db3a047d14", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239996, "uuid": "1bbc7d51-999b-4c69-837a-52320697cfa5", "comment": "Malware payload (Chisel)", "value": "a0bd52fd9d209e1de369f4e4ee944d8a76f6ce15da9f6038a5c4a0d57125f161", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239996, "uuid": "c6435a88-8ec7-4651-b385-9cab33a11513", "comment": "Malware payload (Chisel)", "value": "f0b364142edf2422484a172f5eec6dc34c8d7864", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239996, "uuid": "ab7608b0-cc19-4423-b996-46fa7f89ac7a", "comment": "Malware payload (Chisel)", "value": "c6d3958db6ac27fa5930684eb8f63ea37aa003d410517acd727bcf2c6bdb13768857646666c2749d3fe3e9d1ebc15dc6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239996, "uuid": "cde962d4-fb0d-4a8f-8cbc-b80983c6020a", "value": "T1FA16339AD0C5799ED28032217B7A9CB678D74EF061D989CDA49A35EFBD428723F404CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239996, "uuid": "e4a05744-28f0-480a-8788-442dea134d5e", "value": "98304:NoTa3mSjT+q7ugf/sxr8aG3EzbrbnhU8PQqJFk/AGiEk:No+3/hyR8PEnrzxPQnIek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239996, "uuid": "9e3e51a4-f153-4d92-9b07-a914ea857c54", "value": 4113403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239996, "uuid": "64d068b3-8735-4ec8-89a2-11d4727dae2d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239996, "uuid": "c5ab69bf-704e-4f06-8e35-302ef9a66ba0", "value": "chisel_1.11.5_linux_mips_softfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa1e2a-26e2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774289015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774289015, "uuid": "150334cf-3de0-4d7a-9fcc-e2dc81da1162", "comment": "Malware payload (PhantomStealer)", "value": "eb7ccc8b9669f88a57e79c7d5b6faa02", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774289015, "uuid": "606887aa-f048-49e9-9395-7d775763eead", "comment": "Malware payload (PhantomStealer)", "value": "a0d7249a0df608c9cee5924acc55ad7f39cff3df7cf0702be47469c094fc23dd", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774289015, "uuid": "4e462abe-6aa9-40b1-9e74-8d0fbe3f5d26", "comment": "Malware payload (PhantomStealer)", "value": "300aa0865540094a957e635f7d8491a53c7ac334", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774289015, "uuid": "cc02f942-0216-4489-b5c7-5f39928ccad2", "comment": "Malware payload (PhantomStealer)", "value": "cee9e1fc8a7ba97459c4044c93b3aed0d2792644926bf0eae835875f0aa353af01dbf60ea2f6c1ac4f8a589a15f0c452", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774289015, "uuid": "7e7ad253-d957-4795-b1d5-ac7991b79bf8", "value": "T159F57B4B6470DA7949181B4DB0D24A434C5FA08FCAB954E6253ED6ECE6E4F0FA41EFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774289015, "uuid": "259dbe84-3852-4e07-b95e-0965833dd4fd", "value": "49152:nj5bvDdjastq0nwaIhzcS69YSHD9GmBcI+7kxGZtqXMIHTu/hFHJaqHE05JQ8wIU:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774289015, "uuid": "6aececa4-caf7-4599-9fd1-f7f4b1e1b6fe", "value": 3480118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774289015, "uuid": "cc411073-2c13-46b0-9fcb-77819121aa18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774289015, "uuid": "695e97ac-777b-43e2-a266-f72cf0adb0c0", "value": "ENCRYPT.Ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602bde5a-26d1-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774281612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774281612, "uuid": "479bed81-b1d9-4a36-9c6d-f858154102fa", "comment": "Malware payload (PhantomStealer)", "value": "721d4e6a18bef56c6b72702727c303f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774281612, "uuid": "030fa102-0740-4a3c-9f26-c8041190b765", "comment": "Malware payload (PhantomStealer)", "value": "a1cf75f957a630cac1c6583440664efee2371cb923360c2d711a0dde2ddd38a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774281612, "uuid": "6c34e26b-98a5-4d2a-a9d6-78997c3f7e19", "comment": "Malware payload (PhantomStealer)", "value": "e33c6e4e674219727581d241f92564ff61446662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774281612, "uuid": "bc57b934-f753-453b-8ee4-9346ab12f5f0", "comment": "Malware payload (PhantomStealer)", "value": "dfff34143995e01b6359c654bdfc199f79046390f245f2d29366c126542415134348a9e48316abffffd9979d8a05e2b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774281612, "uuid": "9133cf3d-8445-497a-8606-ff0030bd0e9f", "value": "T17D7501210E427F48C53E0BB8C066599173F18907A397EB5EAFFC41B55E63AD5CE2B902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774281612, "uuid": "67794ac4-7260-454d-b89f-996bf7c608d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774281612, "uuid": "7673967b-4b5d-4331-848d-7b38e5cc4317", "value": "24576:9MsNNbfrhlLSK2uxb4STBa5rXH98R0/eS9BrVXqI+QRd3p:zxfrhlLSK2Ft5rXKS/pVaIlL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774281612, "uuid": "ec68cd23-de85-4c25-98f2-0ca0ee27043c", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774281612, "uuid": "0ecd5435-2e23-490c-8352-e0966d09b2fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774281612, "uuid": "72a1b22c-cf7e-492c-b5b0-b6c78ddf4823", "value": "PO,(~1.2kb).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb10f3e2-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249553, "uuid": "0a7bb411-9beb-4d2d-af6f-3f1ac400c272", "comment": "Malware payload", "value": "d2c9fce5e948c308d7ba88386663be55", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249553, "uuid": "2395d85f-01fa-4047-a5e5-2e74434f6979", "comment": "Malware payload", "value": "a1fcfd050bda05674aa652bd63035211f7a872e3e8d6a9b91cad795578207d40", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249553, "uuid": "9f9930a2-ee68-4fff-b780-7aa887447ac5", "comment": "Malware payload", "value": "d7a2ad10508410a8841dce2934aed7c4610fedd5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249553, "uuid": "8a6914a6-07fc-466a-b3df-278415ce9389", "comment": "Malware payload", "value": "81baf7826c5dd228b3d799b25a1882992b48822e582ab5d2cfc83038d9509e5bdd9f0f7b10c170866ad10419dc736c1f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249553, "uuid": "f108e31b-1876-4e6f-bfff-4d5750b432a9", "value": "T1FAD5BF96B3C87AD9D416D93A9714F232C1B379234FB6E0CB599707090ABAED14F39B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249553, "uuid": "5fac639a-4925-4c3a-86e5-7dbf4bd491ee", "value": "b32a5f49b38df307069b1d6f3ffe7b3b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249553, "uuid": "41ce4f31-21a0-4353-97dd-3048f2050d69", "value": "49152:OeHj39HRGGK6int0UigzzsucjyMSbvRtmipSqAYug6jANtbG+q1wzVDkxIR8WkUr:btzint0UigzcjyMSbvRtmipSqAYug6jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249553, "uuid": "c3e4a62d-57e3-449a-b9e0-0b71cab4e562", "value": 2771456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249553, "uuid": "d97b4c11-350b-4775-90eb-f64550721ef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249553, "uuid": "c7d44516-7980-438a-a792-46c27ea94ea9", "value": "2libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a93ec5-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242328, "uuid": "bb8304e9-f21b-4937-8148-8b0f81e841c9", "comment": "Malware payload (Mirai)", "value": "25a8f526122f9b21206198cec38319cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242328, "uuid": "ef19ba0b-f71a-4709-801b-67b82761c0ad", "comment": "Malware payload (Mirai)", "value": "a25c7132f31b9c50a41c8ead94eab6e5b167b4dd678b70765b5c34a75527ce2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242328, "uuid": "3a6f04bb-fd05-412f-bc80-5d1191b3273f", "comment": "Malware payload (Mirai)", "value": "3f42c889a9e8fd391413a2d8a05ab03e9cc24b06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242328, "uuid": "f3cef966-6ddc-4d49-a865-62e1d8616e96", "comment": "Malware payload (Mirai)", "value": "3d08e968fe1148f43057d26dfbdc85f739607442f06482b5db23a17d169e3d44d8017ec31091e4360851730802f6c241", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242328, "uuid": "d183f555-b87e-41ba-b12d-4976892c3067", "value": "T13CF33969BA0F6C41F2C2D3F9DA8C87E13E1735E3C6778DA1790252EDDBA39D94980502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242328, "uuid": "51b08d57-766a-45db-abc8-147f1cb173fa", "value": "1536:wdMiHrrc/qDHavM5Dtrg89RPA4b1X75rgmnX7Dy+IfMpzEn5p5M/LW:i7vDtrnPTR71gmX7Dy7fMpzxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242328, "uuid": "37eedf5c-c12f-4afb-b15a-89a6de0c1459", "value": 157544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242328, "uuid": "7137325e-e7cc-40c0-bcf9-74f8b726a9b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242328, "uuid": "39c2cc99-a2a6-4d86-9bfe-60f74562cc64", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdabd5d-268a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1774250978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250978, "uuid": "4caf1c2d-8800-463d-b7d0-dae0d34e89c1", "comment": "Malware payload (ConnectWise)", "value": "6b429a6e47265bcd04eea1c274878a19", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250978, "uuid": "3610efa2-bf35-4791-8cd8-cd00de1ab4c4", "comment": "Malware payload (ConnectWise)", "value": "a3ac637f33bb3945aa82d53f8579f618ceb664d9b714cb667fdd9bbfa5337266", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250978, "uuid": "eb9b8145-f501-406a-96dc-6473309c59db", "comment": "Malware payload (ConnectWise)", "value": "d495176afd42a53fe5a7144e8eae9b218272dc39", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250978, "uuid": "63fe8f1d-4d0f-4ac7-a6cd-46fa4b620118", "comment": "Malware payload (ConnectWise)", "value": "5fca34a66eaab393af603d3b5f18e600cec0e69c05928626d9c2077d51efb4710a60f3b9ab44b5421900b8cb3574c2f6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250978, "uuid": "540307f2-d2a6-42ac-9f34-c3131afade18", "value": "T1D213AECAB4559517D643AE3192E5CFA32A78EFC34C46911B36E6B3880DB73C1B39D0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250978, "uuid": "e71e5c56-d845-4927-8943-fcc3a2033bf7", "value": "768:Jz4kzqEw1/iLwiB5LTPz5Yw7ZNzNSBkPN+Y7N2Ip4fTxf1ml9dHm7LZK:JMkw1/i7bz5YMp887Q9lfIbHmn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250978, "uuid": "749e21bf-3f71-4a31-996e-20192a9552d0", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250978, "uuid": "a59a69cb-d15d-4fae-85c9-2accf3ba7788", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250978, "uuid": "6bb662b2-a76e-483c-8f24-137b76d040fe", "value": "MEWDesktop-Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6457e290-2672-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774240817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240817, "uuid": "9af5156a-7e57-44e4-bdb3-7f838be3f378", "comment": "Malware payload (Snojan)", "value": "b538d39004245f764261a682adf2eec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240817, "uuid": "3a4eded1-af10-430a-b789-fb97e14402cb", "comment": "Malware payload (Snojan)", "value": "a59984f035f44070742ce72ff451f7834161dfc5c45793b919d6b071e04b1f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240817, "uuid": "92474b9e-06a9-47b9-9364-e7496dba2c22", "comment": "Malware payload (Snojan)", "value": "21123134a6194151b7838d00d7e0d72bd71f2ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240817, "uuid": "311e6e36-6d1e-423c-9067-0b384eb2a8c6", "comment": "Malware payload (Snojan)", "value": "5aa8399da1ed46cd6302f54e9f4e171c67cf1adece20b6bd242dc6727514f5918a35be94bbd6b68a72647146a1cf2cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240817, "uuid": "3136788d-fa35-4855-ab86-757bdfa40207", "value": "T10B345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240817, "uuid": "5f4e1caa-03f5-4bcb-8243-cbdcc015475d", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240817, "uuid": "61128b9b-b460-44a7-8c95-f2863dac0831", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/k/FnncroP9:wwDeM7iNEkgiOb31k1ECiJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240817, "uuid": "7dc83b40-9679-4574-a9c9-1a85b6a2a8c0", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240817, "uuid": "3c7be5b2-e731-4bec-85ce-36188e0a04f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240817, "uuid": "f6b0044e-9f86-4a8e-af71-4373783a3b26", "value": "zk9tzuec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe42c6f-2698-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774257345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257345, "uuid": "3c400e88-cce9-4390-b620-80debe10831a", "comment": "Malware payload (njrat)", "value": "134200cc0a80f92f56e99b9fd0fd22d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257345, "uuid": "fb499886-9300-4cb7-8040-806eb0361a1a", "comment": "Malware payload (njrat)", "value": "a62ca2b3feebabf5ebd5367e8106d20b89373e009e97fd26df904ea0b6f06708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257345, "uuid": "d45d2bb5-a75e-42f5-8b2b-af3684c93bb2", "comment": "Malware payload (njrat)", "value": "1de446472d6b08d4d987eba8a75fe025d62e9545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257345, "uuid": "0ce2aa86-cfcd-4014-bd88-0b7c31da41f9", "comment": "Malware payload (njrat)", "value": "37f1452da23a5b8e43f57eac458dc935b4656945980c40261859054ddb7c9a343d77e94f9bd5701d3c0ffb5ab89858c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257345, "uuid": "9a9a6caa-db8b-4387-a5e3-f2552801d662", "value": "T186033B4D7FE18168C5FD057706B2D41207BAE04F6E23DA1E8EE564AA37636C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257345, "uuid": "7ed36b7a-63cd-4440-b083-f484752120c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257345, "uuid": "77bd00d7-4195-45af-9ca9-cd971d89294f", "value": "384:VlCKMizd/jnBhFbJ8ycP713V5wy+39rAF+rMRTyN/0L+EcoinblneHQM3epzXKNU:jCg/lLJfcP7139+NrM+rMRa8Nuket", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257345, "uuid": "85ef2075-db25-4a6c-81c5-4a16c4ef9518", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257345, "uuid": "f6a30e19-711f-4802-9ff5-a817ea1290c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257345, "uuid": "39b00d5f-66fd-406d-a456-6bebad7c398b", "value": "134200cc0a80f92f56e99b9fd0fd22d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf8498c-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774229260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229260, "uuid": "55ffc85f-b30e-4a53-9c37-3b70d75e2e07", "comment": "Malware payload (FlyAgent)", "value": "77e6b9a3d87a684de07726eb163e1b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229260, "uuid": "5cf7dd9f-50dc-42e9-b566-4deeac24706b", "comment": "Malware payload (FlyAgent)", "value": "a64e8c4a7e2ca3bdf071fdb645bfd239955a7b9a973d557db2153405f21ede2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229260, "uuid": "de170d59-d7ed-440d-b79a-806c8c8eabda", "comment": "Malware payload (FlyAgent)", "value": "75e3d4b1051d142db922e6f8f24f35ecb199d637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229260, "uuid": "2ceaf8de-441e-4f81-95b7-bbe1c84c1efe", "comment": "Malware payload (FlyAgent)", "value": "eaf7277fe8498b22a819326e64049b5c0ea28dafc56280726ca615fe96e0d1a4e27406591e9f65a104cbfc0d5e976da4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229260, "uuid": "bfd15147-d22a-4029-b9a5-806f0b40493f", "value": "T1A4658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229260, "uuid": "361fa6b3-58d7-4df8-be39-24af5f00a273", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229260, "uuid": "43ae5c02-5b5c-4c80-b13b-e801e9fab076", "value": "24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QP:GcallSllG4ZM7QzMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229260, "uuid": "f073b88e-9c79-47bd-98be-52be68e259d7", "value": 1437844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229260, "uuid": "601de89f-9b58-4e43-add3-0d8f87667f5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229260, "uuid": "4f56d237-1696-4134-a532-3c9cc28bdaac", "value": "a64e8c4a7e2ca3bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4481a7-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259165, "uuid": "d977fba3-a510-407e-97d5-e0a9c0e5e439", "comment": "Malware payload", "value": "2ec717e02ee90adf029509d4474a730f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259165, "uuid": "d39339b0-007d-403e-a545-f9c7e626518a", "comment": "Malware payload", "value": "a68399e9fc24f8b090ea23cc8fced0b4dbd9c7026bc2db1492c0d2fbf45b7853", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259165, "uuid": "b141cad0-9149-4aed-96d4-e4922e2d0869", "comment": "Malware payload", "value": "cf4b694d81be131983f648cbb0919f0d38e76d67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259165, "uuid": "29aff97b-cd68-4c80-a9fa-2a360147fc41", "comment": "Malware payload", "value": "a3e9853be96625220f44a7e912a9271d484211dad47e7a905207ad92db4c5a1dd79f285b3319c19db9598bd1b12dc04c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259165, "uuid": "3c914f5a-cb2f-4dad-bc09-2839fe96ca3b", "value": "T1BC851EE26AB34184E6D775AF8231AD45CAA1709B1DC10F2E3A507EC7BB03352DE465B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259165, "uuid": "18c75c8e-e2b1-45a8-baf1-93d793e803b7", "value": "768:RddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddO:Pr+k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259165, "uuid": "88fafc7d-6aed-455e-89bc-a909df6d9a2c", "value": 1862712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259165, "uuid": "11c77efb-de01-408c-a7ab-a7c2df887eea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259165, "uuid": "bdd07a74-c94b-4bcb-af02-3e3c921ddc5f", "value": "2ec717e02ee90adf029509d4474a730f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d83db7-26db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285747, "uuid": "82a1ec3a-9d61-4581-bee3-168ae345c9ce", "comment": "Malware payload", "value": "6f4b9261aad4a7b30c0afef6ff19778e", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285747, "uuid": "6b8308bb-7212-4d5b-834e-718da85cb312", "comment": "Malware payload", "value": "a6a748c0606fb9600fdf04763523b7da20b382b054b875fdd1ef1c36fc16079a", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285747, "uuid": "1ac958fd-529c-43d5-8bb4-7a27e8be55aa", "comment": "Malware payload", "value": "b62b2b505eb298c068e5a7f1af8a6ebff54e307f", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285747, "uuid": "0f414e89-6b34-49bf-9d00-21fb96ef8508", "comment": "Malware payload", "value": "020522f72177fb5337c4e6a23b78d37e32dc13689238fef96cff9a6ffb61cd080e02f37ae69e33a61c14a6ca4ff4c084", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285747, "uuid": "1ae85e7b-3246-4778-9416-cf71b82e390b", "value": "T1C51833DDA3654A4851AFBDF02D473D8BF17A0E1430BA8025DC07B39A7A7B9C1227865F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285747, "uuid": "31ebb6e4-1a7b-4d08-b667-ae8480b8c549", "value": "1572864:FTuLl2XD9uUeuQPUzkRXjJKY0BvcwyA0d4eb5KskiIjsezwMG2:FTu4uUejszmXj9y0F5DkizI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285747, "uuid": "490fcd02-e171-4f38-ae48-42aab7d713c9", "value": 85328653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285747, "uuid": "42cee21f-d760-4391-8f1b-ee5b91193705", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285747, "uuid": "096840d7-e9a5-4e72-a2be-6ca84c6ae2c5", "value": "zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5995977-2706-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774304492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304492, "uuid": "575f6c2d-56de-4b50-9978-b0d5788234b6", "comment": "Malware payload (LummaStealer)", "value": "0c28e8e039887aeb6d4e85b677a8575c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304492, "uuid": "cc3ba0c9-361c-4126-aba3-98343acb100f", "comment": "Malware payload (LummaStealer)", "value": "a9d5c2f54ee483d7b72dd6450ba663f4e1be2598dc3c6dfa20fd39cc7ec9a806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304492, "uuid": "13b3c454-70d5-4ac0-a64d-376ac579d4aa", "comment": "Malware payload (LummaStealer)", "value": "1950aaab306eb2692c57ac3ea7e73878717a0044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774304492, "uuid": "db1fb7df-e2da-40c3-a12d-b0170ffba54f", "comment": "Malware payload (LummaStealer)", "value": "75f6f6086c6943fa158be9915f136a36ab91e083186415386d143932216cf1e8ebdc78ce43fd1384273c0d46b4b6a948", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304492, "uuid": "5d388b47-72d0-4c69-95ea-a26ee439b625", "value": "T1BDB47C95D7A999E2E54B133C11E27B3F8D10BA300631AF939AC4D98F6D5E9D3063C722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304492, "uuid": "26488438-973a-40af-9b0d-14386b48fa7e", "value": "a4e0e16b8597437425e07d11741709e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304492, "uuid": "1e098853-0bae-49d9-91dd-a5b44b6f0444", "value": "6144:7O0dkDl5i6k4Ft6Afvbt9V0ENK5ZM/TIbpKf8mrx/KDwdtJbJQJtJsJtJEJkJtJJ:7O0dW5i4r6AXjKEKSEpKf8m1/KDwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774304492, "uuid": "cad6543d-3249-4720-ad1c-af9630e8886a", "value": 526888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774304492, "uuid": "ec20da57-d541-42d7-a20a-0664ef0a6a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774304492, "uuid": "80a3af6e-1f2b-4c18-9c54-42d84e29ffd7", "value": "a9d5c2f54ee483d7b72dd6450ba663f4e1be2598dc3c6dfa20fd39cc7ec9a806.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf73155-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283057, "uuid": "5ebca2f5-67e9-4582-93a9-36ce58e81631", "comment": "Malware payload (Mirai)", "value": "01e909a65bc736be3c5fa49ca16c4cf8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283057, "uuid": "3d06cc30-238a-42aa-a213-17b50e50ba48", "comment": "Malware payload (Mirai)", "value": "aaaa89488caf328bea8e56fa95cae69124a561ec97594b686c93cfdd24f13e96", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283057, "uuid": "a73542cf-dcdb-403d-9aae-f4feb4e74424", "comment": "Malware payload (Mirai)", "value": "6af4ef79c4f733167f67d7d8e6dd77b174feb2fa", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283057, "uuid": "0dd61ec1-252e-4ccc-b0e4-963591854e2b", "comment": "Malware payload (Mirai)", "value": "750f5de1b92792722a2d6de826ab708caf5c32ddffc218301b02a9ceedb57f5d428e5e99cb61bb3a859b13b196fc60ad", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283057, "uuid": "cddb78c6-4416-4d30-a365-6f1f337b950e", "value": "T11A35331B2E380A1EF2D5587DA07BA54DDF3F4120A8694C8DD93CE2A85D5074A3CB85BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283057, "uuid": "7707edb7-7a83-47be-9582-4bd4382fd251", "value": "24576:kjmOO/9iY58t2CGr0ffGAotwuMgxBETxSC6EBUlh:kdOViAPvr0WAotwuVxBvC6c+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283057, "uuid": "11ef68ee-de81-4b9a-9aa5-1291b88bcc7d", "value": 1102717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283057, "uuid": "fa5372c9-0c22-4098-8531-31a12551d1a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283057, "uuid": "ed3969e6-616c-4f28-b0ee-de096e7b8b52", "value": "payload_13121.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadd415c-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283026, "uuid": "179fc9a4-d4eb-4034-9829-ad576f1a7931", "comment": "Malware payload (Mirai)", "value": "733efc3d3a2d1a6dd443536fae619beb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283026, "uuid": "c6a21811-69c1-4ff9-bb82-4c4f11dc8b9a", "comment": "Malware payload (Mirai)", "value": "aae9ca8658175fc14eab9c855b2c7c8b8d97396d710b71ea71e0fa19c08e83b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283026, "uuid": "53a6d7b4-9273-4337-ac3a-b0793a6d0026", "comment": "Malware payload (Mirai)", "value": "423fbd85aef466aa309ef07160b6e5e99df31486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283026, "uuid": "0756b2dc-5453-4e01-8b94-ead39413150b", "comment": "Malware payload (Mirai)", "value": "50b525159928bf9764f082b9e64283b05cd8c8e8278dece6c8200c973dc216648fe559e639681a6aa0693aa425231bb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283026, "uuid": "0214af75-454d-4c18-8808-a2448124491d", "value": "T114C43A59A8419B95D1C02BBBFF1D934873131B38E2EFB1069D196B246BEBC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283026, "uuid": "3125728d-13b7-4058-9423-433df458fb2e", "value": "12288:tWteMcMudlhq16gHC696xEMKkRQ5rhPC+mYMgU+C5raD2JMFnTXkKERWCH:t/dlhPgHC+L5rJM1+h+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283026, "uuid": "1fff65f2-e40b-4971-abeb-f214164bf963", "value": 576908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283026, "uuid": "7dff240e-89e4-41ef-baea-e89817f8e71f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283026, "uuid": "a63e00a3-38a6-402c-8f49-7912fd694065", "value": "103_77_175_243_21874_mar13_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223a9d01-26b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774269483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269483, "uuid": "7f1fb37b-9897-415a-849a-f8d3a8fd5faa", "comment": "Malware payload (Stealc)", "value": "80cc021d43fb253466ef4501e37cc237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269483, "uuid": "14d220bd-22b6-4b7d-afc6-dd33ec468905", "comment": "Malware payload (Stealc)", "value": "abb513eaa060b22c139fef518ba9b45785acd317ea6e01a945df346c9564eff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269483, "uuid": "45051183-ff0b-481b-bf67-5d1b7506c443", "comment": "Malware payload (Stealc)", "value": "80d67f0076cef7e0a8fcc3eda7655f0c186173c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774269483, "uuid": "59ea4427-d512-4a6b-a551-eae1280a436d", "comment": "Malware payload (Stealc)", "value": "84485690ef41249cdc3a3be7bd98f85ede09d6ff591aaa4d834d237d568f3e0aef0b61f848192b3316660719d87d9018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269483, "uuid": "4a5bebe7-915c-4067-a6ff-b57d3a4124a0", "value": "T14DF47D1BE7A502F9D1B7C274CA424957E772B8465370978F03E14AA61F3B2909F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269483, "uuid": "04de4cc1-0130-47a5-a8e0-fc9efc2a6a52", "value": "f456face36cfa724bf01290dd8927512", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269483, "uuid": "a678b26e-abd5-4f1d-8cbd-facd2a8972f0", "value": "12288:fzvOznjd7Dkqya3OJXJyZzNP8GTop8mqF88yxBlDetAqxSva:yXOqyzJXIPkEWRqFvybS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774269483, "uuid": "683f1f3d-7cbe-4c91-8ef6-1da231b0c54b", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774269483, "uuid": "d7f880df-c385-48a1-a1a7-2a41879cf1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774269483, "uuid": "981bc54e-1040-43e7-89df-8d60ce41195c", "value": "abb513eaa060b22c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e35782-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250722, "uuid": "06070439-44d5-4344-a585-8fb5b8db5780", "comment": "Malware payload (Vidar)", "value": "3f30fc83448f84c7d03029b8708256c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250722, "uuid": "592253e6-d113-4da0-8825-65c4cda321f6", "comment": "Malware payload (Vidar)", "value": "ad3b27faeb06f7740fd69746cf78b111b01cb673016964ba49ef3e1929dfc3f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250722, "uuid": "c5a88554-dffb-4f30-a173-7f01bbc85581", "comment": "Malware payload (Vidar)", "value": "bba7efa214433d75858c517ff5dbb34dc8c5b825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250722, "uuid": "5083b7a4-4a5d-4db4-8d44-026409111a74", "comment": "Malware payload (Vidar)", "value": "bb3337eaafaa8523e5859450156c686326039f1b3d896d1d730ca152574d6f4898ef13a46a68e01d6ab6b1ed01dfdc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250722, "uuid": "48f8489a-7704-4745-a8e5-9c5709d3917b", "value": "T141B58D0B7C9545FAD46AA7368CB262A17B70BC5A0B3233D32E91B6382F763D06D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250722, "uuid": "e43ae320-5994-4db9-a5d4-1cdd2177750d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250722, "uuid": "efcb25ce-36d4-47af-89d3-435b17bb1db4", "value": "24576:WSD2nhI4w2P3zHbhUDCp/W2X25X6KSBPgn8Iso+qm+jLmqhqDqsFhele5n923baK:WSChIiP3LFbts5X6rB4n8IR9HmOycr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250722, "uuid": "83ff0338-ca82-4afe-bbb2-fdd78601a2c2", "value": 2293456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250722, "uuid": "ba576ffa-9ca3-47bb-beb9-b0a48ce874e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250722, "uuid": "c34218a2-ea25-4346-a3b4-cf2285af9472", "value": "ad3b27faeb06f7740fd69746cf78b111b01cb673016964ba49ef3e1929dfc3f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff37a45c-26b6-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774270283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270283, "uuid": "b016cb9e-6b04-45ed-bdcf-da7a0617aef7", "comment": "Malware payload (AgentTesla)", "value": "b06b0c7c0beedaf19846f31741048496", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270283, "uuid": "74a44fbb-2680-4375-b414-0e0a4fa91442", "comment": "Malware payload (AgentTesla)", "value": "af2d1f22ac1ea7c37f8c3a945e7aa18a9a3a52b34680fbd1ba3db68dca26d389", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270283, "uuid": "cedd02af-35cb-4042-97ee-bd3d2f757fb6", "comment": "Malware payload (AgentTesla)", "value": "5c0e1023df0a686c1867651ed0ec6ef9550d8219", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270283, "uuid": "f884dd0a-a1ed-4c57-bb17-0a78b2f63188", "comment": "Malware payload (AgentTesla)", "value": "42751f8ad9fa73641f15ec55cff1f16c2155b633e15a8284d401ec7f1d7fcd774acb058e48c69fd7e9774589c7012227", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270283, "uuid": "b1694ef8-4768-42ac-ab33-62a9c1d9f713", "value": "T11035AE027381D062FFAB91334F5AF6115BBC79260123AA1F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270283, "uuid": "bd1a89d0-f18d-49c5-b807-234a3a1d2c85", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270283, "uuid": "688ccd2b-1fb6-40b3-9459-fa47093014f8", "value": "24576:+5EmXFtKaL4/oFe5T9yyXYfP1ijXdayaISNY92BFr3:+PVt/LZeJbInQRayENY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270283, "uuid": "20311358-b267-495d-8523-54bcf04e77bc", "value": 1119744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270283, "uuid": "a33e50d6-3c3e-41b5-956f-7483866d0b40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270283, "uuid": "be592f22-55cb-4b7e-a5be-2a39f3e95629", "value": "Confirm the bank account ______________ PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba6439ad-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1774232372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232372, "uuid": "c4fb4b2e-c9f3-4edc-a8fd-e0a5330b1ce4", "comment": "Malware payload (SheetRAT)", "value": "76ef9dadedfb296539945a6737c9ee13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232372, "uuid": "d2cc6a03-f80f-4c7d-88b9-46b29151b218", "comment": "Malware payload (SheetRAT)", "value": "af4f29740da64f53d2c6d9112cd8f6d2b9913e70fa1cab0739b2adbac6118890", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232372, "uuid": "eb94f1f9-b545-4ab0-9d16-a84a96f8fba2", "comment": "Malware payload (SheetRAT)", "value": "7b5b75545f824a6cd39df3f522f91e010df26527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232372, "uuid": "f3cd38e5-d959-4d2b-9181-bb1710b3fcf2", "comment": "Malware payload (SheetRAT)", "value": "7764d966b729800b7dfb2f0876a11a999ffdcc69ed6dde41893aff6666566876e5ba4fe8aef20476e297a60c0c464800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232372, "uuid": "511b44f9-b840-4153-9e0e-2583fee27356", "value": "T199463309D6B454FCDB268972E5802253F962BCC683B6DA8F134045D6AF7B0748B3F792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232372, "uuid": "0bafce26-bb1b-4751-bc3d-ca036d1435ca", "value": "75fa3cd6ba5edf42dd675dcc4d33c571", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232372, "uuid": "33393746-bbc7-4882-8498-15c4efba3011", "value": "98304:nxuMwqhll+6wZ5S7XxoeZsUQXl3NtRM++/VJDj2ScT52/ufdalLABmYBcmb3FJ8p:nTI6wi7XT4vtRi2Sct2Wfw1ABL8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232372, "uuid": "7e274dcd-52fc-4683-a19d-e75e04279264", "value": 5669487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232372, "uuid": "5f27a92e-a8d2-4e20-bcc2-8ac29ecc0a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232372, "uuid": "97f90d73-3876-4d42-8791-7e94cb27aba2", "value": "af4f29740da64f53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195c4056-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237255, "uuid": "48ae990b-3c99-4f09-8417-d6aeb11b7e35", "comment": "Malware payload (Chisel)", "value": "3d77a0dd04d5dc98c6590e32a1d92170", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237255, "uuid": "bd73e434-bdfb-4dd6-a5c6-807ec084a32b", "comment": "Malware payload (Chisel)", "value": "b0372780f0567411a31ac05e3c1a47d3499946f54002218da75a23fac68511c5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237255, "uuid": "f8d7ac9b-9422-434c-b929-af2f6c8b71a2", "comment": "Malware payload (Chisel)", "value": "acdf04deddbf062416bc413a104ae154c35a5c62", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237255, "uuid": "49cafc3f-4fd6-43ac-8f2c-3305a46c9441", "comment": "Malware payload (Chisel)", "value": "df94ea01afaf2192c81d5b9d561c4be50b60197e3391fdff67d27a91207826b4e9a97d6da3b1a05fa27b962d617fc9f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237255, "uuid": "43e52390-7a09-4bed-8dfd-20836e289c11", "value": "T10D1633A4819A863446C176EF0B4A14C235F59F9840F3ECA22AB643111F9EFFBD5391DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237255, "uuid": "345fc89e-37c4-4d9f-9472-237bcf415dc3", "value": "98304:rwMKO45tr+p5+z4Vf7vwJcTNSMCLlOQTaP1k5IEBx:NKOUtr+pwMF7vw2kbTh5hBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237255, "uuid": "1f5c3515-6a55-41db-905f-768a29234c5e", "value": 4238799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237255, "uuid": "4bdf3679-6ce3-4927-91e9-38ad88cb234e", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237255, "uuid": "115ea03c-1842-46c8-b2a2-001ff7b42392", "value": "chisel_1.11.5_linux_armv6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4510037-2676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774242750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242750, "uuid": "6d9fb848-c23f-4c6e-b675-ff9b22c10a35", "comment": "Malware payload", "value": "c7707c5df1953511cd617658aaae7b2b", "object_relation": "md5", "Tag": [ { "name": "8ee6ff0", "colour": "#64502B", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bella", "colour": "#6E204E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242750, "uuid": "38d0a93f-62ea-4a8b-8d0d-0041345109e6", "comment": "Malware payload", "value": "b1175d90e25ad9ff6c4d60a4d291e6166e4c1d091ada0086c02f2c03bbcfd194", "object_relation": "sha256", "Tag": [ { "name": "8ee6ff0", "colour": "#64502B", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bella", "colour": "#6E204E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242750, "uuid": "9c8165a7-6b0b-47f4-adae-f0150833b6df", "comment": "Malware payload", "value": "4db1a4dd0b3f33759886b56bcd8d7dc30f807034", "object_relation": "sha1", "Tag": [ { "name": "8ee6ff0", "colour": "#64502B", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bella", "colour": "#6E204E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242750, "uuid": "21385c74-efe3-4af1-8204-edbbc4a0db48", "comment": "Malware payload", "value": "b66bdbabd8cefd1ee783e4b93a5d1e24945ab268f17579442c0926053156c5284cba8c16a4414257d9dd4c6dd581f62e", "object_relation": "sha3-384", "Tag": [ { "name": "8ee6ff0", "colour": "#64502B", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bella", "colour": "#6E204E", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242750, "uuid": "6233fd0b-8a0a-49ae-9f90-c9c07de1fc40", "value": "T18A933A46FA8ED5BE47E018ACC908429636ECE177417D5260FEE0926D7046CB7F0B7E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242750, "uuid": "f3e042ed-69a8-4441-b74d-038af939b9c9", "value": "1536:al/AQKv0ksfLEqsD4d0BfCNzVISu+Q2q0wJRDMabj/QVcRprm3VaiaZUuO:al/AQKv0FuD4uBf8VISu+Q2q0WDNbj/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242750, "uuid": "2c2c75f3-ad14-4d30-ae36-8ad4a2f6705a", "value": 94516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242750, "uuid": "676401d6-d344-4291-9387-1eac0919d86c", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242750, "uuid": "44439290-fac2-4ade-bb0c-ed5d6f32a42c", "value": "Bella.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ee5cc7-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774266137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266137, "uuid": "169c6bc7-086c-4da1-9a4b-f11769fb9a11", "comment": "Malware payload (RemcosRAT)", "value": "dc76f576206d74cf57ac8332a3709e68", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266137, "uuid": "911f2be7-7969-4462-b5cc-4e6aaa4ec09e", "comment": "Malware payload (RemcosRAT)", "value": "b129aebdda7a4faae9ce6359e2f8d02e26c046710d542475fcc9024e9d38f840", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266137, "uuid": "0b0e65c7-2ac8-4f5a-ba3e-701d2c79c3a4", "comment": "Malware payload (RemcosRAT)", "value": "1a43740ce80e726de04e10e1f8476928645adc24", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266137, "uuid": "144af9b4-fd60-4a00-b7b7-f4a3842883b3", "comment": "Malware payload (RemcosRAT)", "value": "2fa8b612c95e6579ea65a8dce058516a4954227d79c4b03c884d4eb0548a8e568125582c0be340bdb9bea25395c68cea", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266137, "uuid": "e7de4fe8-a03f-41f6-9cbb-2169bd278353", "value": "T111D5E476484830F3EB59A14E044CCC3EF28C965C5B535C58E766863ADDEE0E1E3DEAA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266137, "uuid": "7619d9c4-b99f-446b-b09a-9a4ac86966de", "value": "768:X133wjAT71xs3eJAkxMhFRrDSFoAW466+quuuu/VXFmuZqcw7Nu4CJHbZuuuawzI:Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266137, "uuid": "b11d2aed-2293-4445-9d83-b2410c214ee7", "value": 2762527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266137, "uuid": "d314a96c-c737-45ad-8b73-96b491167d93", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266137, "uuid": "978d1a88-c376-4151-9996-ffce3d938588", "value": "NA-LOG GmbH-Best.-Nr_0004226.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fd6275-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283077, "uuid": "289ed902-ad9f-4b85-b23e-ee20d2189be3", "comment": "Malware payload (Mirai)", "value": "68749adc266caa4b55689d011cada70f", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283077, "uuid": "1bc428aa-20ab-4f36-9b46-633428ddc596", "comment": "Malware payload (Mirai)", "value": "b24c9255bf3c8dc65f35d61544e1959354b74c46d4e1c99462f2f4292ee62cda", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283077, "uuid": "fed6ec85-cfeb-4205-8ed6-ee0ee534b8d5", "comment": "Malware payload (Mirai)", "value": "5473a992c07159da6ced5c9160336ac772b42f89", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283077, "uuid": "dab94ce1-c4ab-4ef8-bcda-0ae9a582cdef", "comment": "Malware payload (Mirai)", "value": "f5b618e13db8db8334bab4da97364d9b3560dcded0a4fc1b6b8897ea627f26fed7bbb7daae789f331d91f55a93518627", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283077, "uuid": "9a0dd064-8e8b-4c49-b17c-c7ab908b0979", "value": "T10E53E756EA419F02D4D334BAFB9F41593353AF6CD3FA7201D920AF60238A9DB0F66116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283077, "uuid": "04c51870-6dd5-4404-a360-8ea1b96705f8", "value": "768:WpnqiN5LQJqkwhaCdLKbyi89QWoiCiyKeLIlmV9StttNZCNY2h2evIbxW:WpnqcbaCsbyi8uWohR7V9mZ+Y2s8uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283077, "uuid": "56426718-9658-4904-9355-66f6f3470c53", "value": 61988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283077, "uuid": "1eacc412-36dc-4f2e-9696-d495e5fe0ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283077, "uuid": "70126d25-67e6-4830-bb70-b0e352566e91", "value": "rkloader_arm7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13e1356-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283091, "uuid": "eef31501-7830-4758-b897-5302d4e529bc", "comment": "Malware payload", "value": "e750c27b9a4fcaa6a048d86c4d011c92", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cecbot", "colour": "#ACACA7", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283091, "uuid": "2586bab1-9b03-4f1e-bb2c-1864bf590032", "comment": "Malware payload", "value": "b3c1d5fc273d19556b09f935b9b09b782b113b98a8a010ebcbb5de5bfce77e67", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cecbot", "colour": "#ACACA7", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283091, "uuid": "5a14ac7d-00c0-455a-b806-abe16bf8a80e", "comment": "Malware payload", "value": "4b846a214cf187090376d31e526d50bb14ea0f5d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cecbot", "colour": "#ACACA7", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283091, "uuid": "b1ab48ea-744c-44ee-b66b-8754fcc16738", "comment": "Malware payload", "value": "94027690a4e439fd373a682258f38688c23c7a2456b45a82c3f43b3cc1a51e41759a146ecb70c5594083b88fa987ca17", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "cecbot", "colour": "#ACACA7", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283091, "uuid": "340fa718-0769-4174-9b87-34454cd4c0f2", "value": "T155F3137B5B7E0510F9EAD1B0C716B35DB929CA48C4C2EEA36744F85248F01FA6711D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283091, "uuid": "ebae58a2-11a6-4c65-8c7d-0a14e487b59d", "value": "3072:SvVVM+OlatXfdJLnD80EbUkUcra2LHaecZMUL16jFN6j5fiM4GjqfXrYH:S7M+I8ffoXU1/eaecLyFOfx4WoX0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283091, "uuid": "d69ae11b-548b-4750-a46a-d5711a4fb61e", "value": 169080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283091, "uuid": "0e99640b-1734-4c0e-bc81-d14f6e94ab32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283091, "uuid": "340b86d0-2cc4-4db9-becb-9fc298061410", "value": "xd.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d63a92-26ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774301384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301384, "uuid": "c9e18fca-b85e-4801-a82d-cbabe257193d", "comment": "Malware payload", "value": "7c20250b37b86d50ef154aa838fe3fa1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301384, "uuid": "cab912bc-ff1e-4049-b86e-1635597f1122", "comment": "Malware payload", "value": "b3c3085f10604e647770fdc14ff5a589504db266a83f4e4a44b2e146a988ec2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301384, "uuid": "cb9fae0e-0dc7-47da-ad9b-1c12a0dc09d5", "comment": "Malware payload", "value": "e2214ab24a0c9ccc0e784c2f6d42e99c8b2c9ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301384, "uuid": "93454958-fd37-40fd-9602-d2d4f8ab2dbf", "comment": "Malware payload", "value": "85fdfdb8da4b945230a0739606f6ecf1df88f73bce9bdd491df877526e071537ccfa9d807372125bfc31e9b731e33b3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301384, "uuid": "ff901d2f-29be-4b51-956b-bd4794289ae6", "value": "T11A242A55BD415F22C6D126BEFBBE81CE33232BFCE3DE7112DE045B11268A84A4E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301384, "uuid": "16a3a9a6-3986-428f-9d62-3ada89165c51", "value": "6144:mkHdg+u3Rg/ywIBzW57/+LZmpz47UZqm6JWw4kPi5Nkja0HelZm2vwhsmNw1jgqm:PURy9/fz4Aqm6JWw4kPqNkjaoelZm2v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301384, "uuid": "d188ec1c-a1ab-449c-9c79-91656bb0f26e", "value": 224460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301384, "uuid": "0fbf6d0a-d0db-480f-9de9-b8daaa76a1ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301384, "uuid": "d592f264-38c0-4ee0-af63-40f38b48f67e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aee28e4-269b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774258384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258384, "uuid": "da735005-6778-420e-b689-14faaeae8bc4", "comment": "Malware payload", "value": "16fc542c53138cf42f76d52419fd8cea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258384, "uuid": "833eb70f-e163-4ec4-9c5a-c866b4dfe54e", "comment": "Malware payload", "value": "b3f7d13321ea2da274d124216cdfebd980feca6cd6bb16e9c174d06ec5c6ef16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258384, "uuid": "fc34acc4-56eb-4a52-8e5c-c884ad14b5e2", "comment": "Malware payload", "value": "8f6838a2c9e7ca15af9969b0ec3e17b42fb025c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258384, "uuid": "61e48c3f-a610-40c3-bb5a-e6b86af80fe6", "comment": "Malware payload", "value": "3cd8f8b4fa4b7a1f20ef06520afdb3caa89d899bf864218f677ef4f5ef4bd326313e42bd2faa4d59818129f7caa4828f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258384, "uuid": "62e86f22-14df-4e65-81d7-3ee80915f104", "value": "T1A2A5151116E5284CB133AD4EDBEDE691DF2BB272210E674F13B7038A42DA4429D8F977", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258384, "uuid": "e84d4557-9a0e-4c11-a1a5-68f371aef545", "value": "3072:5IbIZIAIjIZI8I0IBI/ImIpInI8IyIhIZIZIqIiIlI1IbIJIfIVIFINIwIvI0IF+:dp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258384, "uuid": "3c05acf6-3b24-4d7c-8ca0-b9da88e8c559", "value": 2196788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258384, "uuid": "45eedda9-99ed-4221-b1a6-25481e3b5da1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258384, "uuid": "17dcd454-a721-4976-89aa-cc6137f0c7de", "value": "Ordine cliente GSM-576_PDF ~0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca5beb4c-26cc-11f1-a769-42010a9c0008", "comment": "Malware payload (OrcusRAT)", "timestamp": 1774279643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279643, "uuid": "eb0ccf21-cd9d-4677-8a3c-d29bb65d6f8c", "comment": "Malware payload (OrcusRAT)", "value": "1093d8a22a7de0ebe6c792af8402689b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279643, "uuid": "e95ae4f3-02b8-4fc0-903b-b951b09db961", "comment": "Malware payload (OrcusRAT)", "value": "b4580444411800cef98b30d7fb599bbf69b230ccba2077710c4048f30b6acbcc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279643, "uuid": "81c9316e-fc27-41c5-bbe8-eec460ec32d8", "comment": "Malware payload (OrcusRAT)", "value": "3c4838e26fdefd961263bc956bfd30c4e98ddf33", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279643, "uuid": "971a0165-5372-4b7d-89f3-38473e5f0232", "comment": "Malware payload (OrcusRAT)", "value": "378031ba41e4dc379289b3f686b6d8bedb901d3e64730afd7b7ee286d5fefaca0ae51b1ecbf4a419afdf0785422e6ba6", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279643, "uuid": "54ff712d-8dab-481d-8da2-10fb1a897b84", "value": "T19D1123AA58D748486371D77912E7E1D9A453A18AA0414E0C7344224BEF9934F4683646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279643, "uuid": "ad860367-2c96-4aed-82c0-4777a9e4c5f9", "value": "24:hMNmMvy4GqptE0ia5Np8xuY8y+Zr88+M8E4olEC:ImMqopO0Jnd4+ZXt40F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279643, "uuid": "827ea896-c91e-4a2d-b442-75b515ea5e67", "value": 869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279643, "uuid": "c4a46737-446e-4e74-9558-6441b5d9bd61", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279643, "uuid": "a1b0f27c-62e8-493c-badc-91e7602f115f", "value": "1093d8a22a7de0ebe6c792af8402689b.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7953f76c-26da-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285520, "uuid": "ef89e51d-9d5f-4c44-bc3e-51fa941ce7d0", "comment": "Malware payload", "value": "9ba7827f1a6b409e3d4051d8cae5b7c0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285520, "uuid": "40010b2c-f38f-4267-95c2-d5965e32a24d", "comment": "Malware payload", "value": "b6daee2979ee41ab8a085ba7718c190048f6ddc018fbc65df10fe61cdfb1545e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285520, "uuid": "3dc3566a-fe72-4fe9-8483-abb329802b65", "comment": "Malware payload", "value": "f3dab5d311945cd6c45dc231d1a26f281698dd90", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285520, "uuid": "db8a3d8d-070c-45da-a138-ee2b272ba5cd", "comment": "Malware payload", "value": "62844eb3ba5520dc4d2668383247ffa61f97ab70dcbf055e0cdd64719b2140d3973e56bacd960d0f4eaf6937abf2acad", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285520, "uuid": "beaf0f43-1599-4f9d-bac8-cea66162e191", "value": "T11286339FD8032F59C225D57E5A8E89703D5A427F8D83EB1724A77057AFC0ACAB03644B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285520, "uuid": "bbfdf995-67a6-4f64-9203-061bf1cee522", "value": "196608:1nK8RhGwlYRyaNHydK4cQwzzMrWPa+Yw0c+:4qGwzKbkDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285520, "uuid": "25de745a-79b4-4d7f-a8a4-66fed094057b", "value": 7849282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285520, "uuid": "38e53512-2f14-4af2-bab5-16ce294bf1ca", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285520, "uuid": "8ab54512-5631-4db1-975b-7aa102c54a4f", "value": "2SearchHostService.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d23b552-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252079, "uuid": "6807dbb3-6a84-465c-bce4-d3869aeba7e9", "comment": "Malware payload", "value": "295dd02dead7ca1ac4f42cc6cea2ca5e", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252079, "uuid": "c68c5a68-5c41-443a-966a-84651f22abf8", "comment": "Malware payload", "value": "b77b542ddb10f2327b75ac6fbb144499b898d9c8e26028a18fc7955851176ed7", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252079, "uuid": "f1234b3a-e3d0-4f34-a46c-ed5b68c796a2", "comment": "Malware payload", "value": "7bea8bf050039edaa4706135bc36651250876f95", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252079, "uuid": "116a4f27-e9bc-4aeb-86e3-6d49e8ec6f31", "comment": "Malware payload", "value": "1fca6ca213c47a83531f444c7ae2d2afc54df257bd1aea2fa76fa16b737adf73a942352ff09e3dc4d533fcf86e61be35", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252079, "uuid": "c2d1b2cf-4ae7-4b0f-a32b-b008b15d8042", "value": "T1C6152305EAB160CDDE5321784FAB894AE236D855CCF79A4B31EB380C5BAF7351026CB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252079, "uuid": "1dbda332-b0d3-4033-b359-a6c6aa430dcb", "value": "a2faeecc634162e7d292483eff53af44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252079, "uuid": "ae446a9b-a13b-4241-97b5-00602197a283", "value": "24576:GTgtZ4SLWcf2KroZROxoQCqtjEDCV+0Cc:ugfIKYpxqtYW+0Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252079, "uuid": "e6f6ec03-4ddd-4e5a-990e-f52ce8104771", "value": 880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252079, "uuid": "e82e744b-5258-4359-bf36-dc428df03079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252079, "uuid": "bbd4128b-c816-40d9-bca0-76313a60d48c", "value": "hfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119e4afa-26f4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774296513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296513, "uuid": "7720d43d-7b7c-43c7-a5da-de377d08266a", "comment": "Malware payload (Mirai)", "value": "6ed0ef2bda3446293c07d73878e987a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296513, "uuid": "b3dd744e-58b8-4980-8e79-6fed9d8d2775", "comment": "Malware payload (Mirai)", "value": "b86cc44385da63a755928f40ae79b4e6b535580568e395c38474f5c9308b11db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296513, "uuid": "600cf10f-acd8-4689-b947-be42dc051ea7", "comment": "Malware payload (Mirai)", "value": "57bba8277491f80a2ef440613322f8b467eddc12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296513, "uuid": "92360b55-075f-4609-8c09-693707e0ebec", "comment": "Malware payload (Mirai)", "value": "45e33fc3554d12737a85f6a61be6767e8efcf801cd56cb31b0f89b7cac56823a6f559ab76d012640531991987e297f9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296513, "uuid": "d5906da4-551c-4e58-882d-f35317db574e", "value": "T12DA31891B8819613C9C556B7FB5E4299371603A8D3EB3303EE248F75378E89B0F7A845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296513, "uuid": "1dd51def-d45b-4a3b-8616-b048f18984cb", "value": "1536:+shgiGkrMxM613943p1bVPtocCdokBGHSZ3HLtOxAJafv13ROiIFtWe7RtnQ:gkaF3943p1bVPtocIokLL0VAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774296513, "uuid": "a0d0be6d-8d33-4e5c-8b00-641002cf33fe", "value": 99660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774296513, "uuid": "6f4f7f46-197a-495f-a8ac-a8d7cbdc0171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296513, "uuid": "c2608cf1-ae1b-493d-a6aa-30a2fa2f4cf6", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c68453-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "4a88e0a1-6071-46ec-865f-70156b4df4b1", "comment": "Malware payload", "value": "1d1e0d857e41036d0406203c95fb60f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "759d1da3-a91b-4c44-8604-b483723ea8ae", "comment": "Malware payload", "value": "b969c62337b450e5cc3d247f81bacfdbb00ecf29c0dd8583b7be43c92b5ecfc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "6fc52b29-1e94-449c-b5f2-9b6e7518d3bb", "comment": "Malware payload", "value": "7816e73e4a2734a1293f7cf1243a23353c581d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283019, "uuid": "b8f51196-9a68-4383-874a-aea414d6ca3b", "comment": "Malware payload", "value": "e263ee74057e2ef58c764062248d92621d568d3a248cbcc14ca5f8725f2afbcd4c5c8914740fc04d9f4bcd63cf9f4a57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "c8e07705-935e-450c-9dec-e000c817428d", "value": "T1BB658D67F842A952C4D466BAF61ED2C433030378E3DA7206AE1AC73575DF68E4E3E641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "47c534cd-61b0-4780-b111-be16a2cedbdc", "value": "24576:7xDbj+6JhQErm6AqIcn9pCE5nxBwPMy6ioUfnjqRgCI6f+:7x7uE9CE5QMy6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283019, "uuid": "877d0dd3-89f7-4dff-8d2e-98a4d7b8ac4b", "value": 1480640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283019, "uuid": "9b86bad6-35cc-499a-a1e9-2c029db00e65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283019, "uuid": "420ec15b-3967-42cf-b311-5eb7290fd3df", "value": "72142e7a704e2b5f7da279af349c5490eaa8b5cac83015e7115b10796f1af641.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c9674b-26ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774271819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271819, "uuid": "1d8e25d4-8bf3-44c4-bf3f-3481cecea44e", "comment": "Malware payload", "value": "8c726f9fc41f44a565a853aca7e3f02b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271819, "uuid": "98604bcd-6dfa-4b4f-9469-af6f642a74a5", "comment": "Malware payload", "value": "b98ea0c4d6c619bff6b6b2aaeb9be5d56fe637e5121a1e3b32f3c2c6915f5408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271819, "uuid": "0b5afeb0-3633-4ea9-99b5-ece8939cb68c", "comment": "Malware payload", "value": "98ffa60f5160daef1b7b6a3896703b59429afdb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774271819, "uuid": "3bc30fe2-95cb-41ad-9a83-e723e316a0cf", "comment": "Malware payload", "value": "32f4e17c1631cb1a70eb5617eee26a8ccca9420ea37f256206057aaa782fd767b44e36147a63a6170d1aaaf733cf47d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271819, "uuid": "86c08d32-c8f0-4024-b635-afa59626036b", "value": "T1B3858999E6AF49BD521C1DDD6923E43489037C4D22A5CC8FAB13A291C4D1B9AFCF42F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271819, "uuid": "2740b6e0-96c4-497d-8ce6-684f42f99131", "value": "384:oBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBl:Vmc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774271819, "uuid": "725450d0-8333-4f77-bf42-c6c8fc851ea7", "value": 1710983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774271819, "uuid": "83291eb3-b508-4f3e-9f0f-8c905c33deb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774271819, "uuid": "85407388-2684-4b66-810c-1da4f0f6a213", "value": "LUE.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8662e2-2699-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774257660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257660, "uuid": "85bbcd33-1f08-4142-97ab-e54fc132f02d", "comment": "Malware payload", "value": "e29ddeebef1fd4ef69698fa2ee7b1d65", "object_relation": "md5", "Tag": [ { "name": "Cassandra", "colour": "#C831DD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257660, "uuid": "68828b81-e21d-49a4-b4bd-f9d696c76c28", "comment": "Malware payload", "value": "b9abdf181a8746c43cd3665ce5c45ff33ddb8916b400454a26b2cb3e346bc194", "object_relation": "sha256", "Tag": [ { "name": "Cassandra", "colour": "#C831DD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257660, "uuid": "6cfad441-4d40-497d-b422-686eb6ab4484", "comment": "Malware payload", "value": "919b0e3bfc023f595dfb4e83688a96970dc5fa2b", "object_relation": "sha1", "Tag": [ { "name": "Cassandra", "colour": "#C831DD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257660, "uuid": "c480e60d-458b-4670-8059-477152eb7d68", "comment": "Malware payload", "value": "510c0922120e81a261dfa15995034fc16aeac15a1e6c26a3819175ad9e2a6dbc6e98205cd6baae7c0d87dafd666282c8", "object_relation": "sha3-384", "Tag": [ { "name": "Cassandra", "colour": "#C831DD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257660, "uuid": "30d14766-2fba-4c17-a836-890d849897f6", "value": "T183433B08BB9E9F23C1BE45FAA0C2755413F0F0B66257E3CB6CCA11D541DAFD65602A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257660, "uuid": "be729b62-a34f-43ab-892d-81456f29d4f0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257660, "uuid": "b2531667-2e3a-40bf-8923-4f747d0601fe", "value": "1536:wt0rTBOfIIyCUTaK1YUUGtI3k32KBrdOOCS:WuIuTaCUIGOEHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257660, "uuid": "acc247ae-f0b1-4b44-80f2-b3d5005cb8fa", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257660, "uuid": "7c313cde-8a97-4ccc-8801-b206ebf06ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257660, "uuid": "0a1cf2ca-981c-4eb5-a854-c648a19dcc55", "value": "CoreForge.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ad88db-268c-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774252094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252094, "uuid": "cc46649c-10f3-4545-bc50-3f2564b9f9ff", "comment": "Malware payload (Gh0stRAT)", "value": "4a794d9e4ac36a7b95916ad1dd45db94", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252094, "uuid": "5c127dde-f926-4304-b0b6-5e90b4713e9d", "comment": "Malware payload (Gh0stRAT)", "value": "b9cd020561be2e11ff40e52f4b7d06b7f15badf1a9de756479fa47a7c1a07c37", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252094, "uuid": "e636fd3f-d7e6-4bd3-a242-1b192823a9fd", "comment": "Malware payload (Gh0stRAT)", "value": "dd9e399920a6e872e32f2265dd5117b2ce85c17a", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252094, "uuid": "36086ca2-1221-4121-8dd4-a353414f34f7", "comment": "Malware payload (Gh0stRAT)", "value": "097a5bd2cd4f9c17b542bde104e37a51b29288ecd35bd1de75be6a9b0fb8c7cbb49b18a2404bfcef556be70719d6660c", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252094, "uuid": "d7615cc3-6b99-4108-aada-6341377b3ded", "value": "T1D656BE41B59AC0A6E68B05B0CDAB93799F387F5947E14663B284FEDF74322813D3212D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252094, "uuid": "f4aabb3f-8aa1-470d-aaef-a3363698e553", "value": "c720e1e2973cef7420930d206a342655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252094, "uuid": "9830b38d-efe8-430c-bc13-b6caa69bf887", "value": "98304:28rYuzUCWX/TQMyvgbBDWhUhw5L5YdTM/M5MoMUMiM3WlZyQhn4nDZce3zn:f8XpX/0MHbBo1fYdEWlZyQhn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252094, "uuid": "dcc100f8-1547-49bd-a406-051772b97a38", "value": 6377472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252094, "uuid": "866b7a29-0312-4331-afe3-0be8e5cd583b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252094, "uuid": "db9704e6-4abc-4a3b-ad82-8e3f80af3624", "value": "Hero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e53974b-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774266228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266228, "uuid": "3b8482dd-cd7c-491d-8659-397a6369d09f", "comment": "Malware payload", "value": "c3a210dd931e1486920f1fd4336b43b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266228, "uuid": "8dc9d264-7cb0-448a-a087-362ea4430c3e", "comment": "Malware payload", "value": "bb02c58e6477f037fa0ebb470395746d4a00229debf3fb1b20bab21f7512c3b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266228, "uuid": "9ea10e2c-89dc-4b18-b26a-63423dfa6192", "comment": "Malware payload", "value": "089dbddf16923996032ab84b16e1fc121d0b4cc2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266228, "uuid": "fc1c0c56-265c-4d07-88ac-a19bb603a8bf", "comment": "Malware payload", "value": "dc21960d390746e8372c7673086cb5e41910c68137f6026bcf9d600e2573b8e31ac2b6e6c1acef746f766e5fb06c3359", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266228, "uuid": "827f6dd6-c1e2-469c-9a23-72127e6fbca2", "value": "T1D364490263FA450CF6F34B88AA3754664EB7BE965D79D02D0A99140D1AF3E04C8B67F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266228, "uuid": "42e0b9ca-2baf-4fe6-abde-ae49488f99c9", "value": "6144:ekYK/4B1awt6ncJbnWb2nNB02b7devccpudjisnN3x:ekYK/qYwAnc9nY2nNhb7dev9UUsN3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266228, "uuid": "f30e0ddc-2583-4068-abe7-8f8163581875", "value": 317572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266228, "uuid": "a7fd01ef-6350-470a-b3f9-b2d2dcebb3f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266228, "uuid": "f55dd44f-b731-4191-859a-4e2c45e0151c", "value": "Payment_and_Order_Confirmation_POEUF202603.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5c1166-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249558, "uuid": "7c21d1c3-1afd-47cf-9976-ba3dfd95efb5", "comment": "Malware payload", "value": "65aa0ca3d5134070abf7fa55815e942d", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249558, "uuid": "e5417c2d-a5b7-44c7-96dd-a91f3c1c65c7", "comment": "Malware payload", "value": "bb4cd1770891999155edc14096e2b25aa6c23847912360bcfca71155ddcf5ee6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249558, "uuid": "bacd81f1-e3b7-4976-96c3-43a6428f84ea", "comment": "Malware payload", "value": "fd5f8a45a09125f91ec57a84d5449d6393fcf9d0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249558, "uuid": "4c2c9f0e-8840-452a-8061-3aa7e34931b4", "comment": "Malware payload", "value": "512c922f06c7ac8a33c86bcd7d9bcd6e9b0c5afbfc2be2c3b33c05eaaeff4dc9982b0cf2e330ce0007c58bce64c32013", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "thairefaruq-com", "colour": "#F41F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249558, "uuid": "9c7a0e4d-2f07-4fdb-bbe6-4e45edf4a15f", "value": "T1AAD5BF46B3C09BA9C506D9758727E632C1B3F8224B76C0CB6AA6D74E5E77B414F39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249558, "uuid": "47d19383-08c1-48c0-a16f-eb6769e612db", "value": "4e7927123b18ec34ed583f67ab70c2e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249558, "uuid": "e64b0e59-921b-466c-b784-a02cd0537416", "value": "49152:Cj4m1+ZNC44V/xAMnQQGFLFZfav1oKdVrGC+eh15WH0vYG10l75vmCOIPCVR628v:1ZNokyv1oKdVrGC+eh15WH0vYG10l75f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249558, "uuid": "2812607a-ba40-4581-9752-6f946c27d550", "value": 2921984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249558, "uuid": "e966f562-9304-4114-b8c7-49572704f5bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249558, "uuid": "c61fd230-b9dc-433e-9171-4fc6b8717c75", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a8e3fa-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774301132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301132, "uuid": "a5f83bb1-5661-4728-b16e-2b928e09bea3", "comment": "Malware payload (Mirai)", "value": "34984096a8a5a199f5cd5a1df8be0b35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301132, "uuid": "39c82b22-cb13-41bb-a526-b9e173c440b2", "comment": "Malware payload (Mirai)", "value": "bb818e66ab8cd4e897182062ec34ce72dec27283c532393fb72b262a9f877b82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301132, "uuid": "344540cb-c12d-44a8-9c79-b40178e2f617", "comment": "Malware payload (Mirai)", "value": "e8812ec7ac1d50e3a0130ec83a4c251db4cef207", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301132, "uuid": "6e8d89cd-ee54-4d21-8ebd-b1eeae1e2263", "comment": "Malware payload (Mirai)", "value": "4f0f6f6a44267036044ef6c1a918f85a709855f5280385a90746d56f286bac64759c58b5c9c6606df14a2b21989483cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301132, "uuid": "69ce1f91-b90a-44f1-ab93-f5cd4f58e688", "value": "T1E5B2D1B483C6B905E2B01D318A31B3C6544541ECD2E730236264533BF3DA66B65B968B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301132, "uuid": "5db7bc1e-2a54-4a56-9e1e-840eca4d2c10", "value": "384:drBZM9NVmKhBW4p6NBVgDe8pY1VjAsZ30kiIIiMfzdvRC5lljVv/MhymdGUop5hw:d1ZIYXFGeK0qkilvfzdJC/ss3Uoz9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301132, "uuid": "d637bd5f-ca01-4395-a60b-a1ff8febb6cb", "value": 24800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301132, "uuid": "acc11ff0-bfe0-4344-b6e1-dd23750a731f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301132, "uuid": "8b6ba930-6066-42b9-9711-e2ff2cca6084", "value": "Polar.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da47d3b5-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283106, "uuid": "a02a39a6-7be4-4d7c-9cf6-7d69498ad83a", "comment": "Malware payload (Mirai)", "value": "0ba97c7367ad5d4a98cafec371ca7b93", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283106, "uuid": "5e111bfa-d20a-4448-a76e-ec2e1943983a", "comment": "Malware payload (Mirai)", "value": "bcd77b768638489deb43a7247da1f84ae8b4fa7a110edb911e5173e86ddd9ec3", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283106, "uuid": "effb8754-80d7-4c27-baa8-dec49136a117", "comment": "Malware payload (Mirai)", "value": "ea30360f7bbf2b2f1a3a89de4e3914a1db675376", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283106, "uuid": "8dd5da33-ede9-4133-ba50-a3921082a6b2", "comment": "Malware payload (Mirai)", "value": "7997aed86b92961d385009eec38949f87d863f1249a190ef11bb77f27445d726f0d83d19ea23bc89dbe6d82fa6b78524", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283106, "uuid": "39f407ac-f753-4d02-9446-8e9d1a867614", "value": "T196C44A59A8419B95D1C02BBBFF1D934873131B38E2EFB1069D196F246BABC1B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283106, "uuid": "cc2bf6c6-9315-4b00-90de-9fd2f9bff3d0", "value": "12288:TMtfz0TcdQAZsW8HC1NNPEmKnRmpYmShF9liqJU/ca0LsH2wo/JrQrRW:TqdQA38HCWYpYHikxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283106, "uuid": "ad850335-b3ef-4a99-b549-8f0c64938964", "value": 572812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283106, "uuid": "52ddb447-c98e-4949-b483-605db1b11bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283106, "uuid": "eb09dc26-d4c2-4047-aa0b-29dd061a8b1d", "value": "147_182_169_126_3389_feb27_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eed9a81-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774300938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300938, "uuid": "f8aa0d41-aaff-476f-b544-a35fa5161f57", "comment": "Malware payload", "value": "a12b7d534b82c115455bebab82337cee", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300938, "uuid": "8e11e1c5-ec60-414b-b94a-44d45c7a7d97", "comment": "Malware payload", "value": "bceb1355ccd36226ed85e6afab0001d641e627e8c2965e85c4370d9a6af43901", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300938, "uuid": "3ca1b533-2f84-44cf-a11b-da34e2b370f1", "comment": "Malware payload", "value": "c2ce3cb9285d2d113e7f973b00a71bf2024045bc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300938, "uuid": "7d507788-64fb-4910-8ec8-b37bc40994f6", "comment": "Malware payload", "value": "f5e4bf6a8c9aa087d4e5a18e31e3d62157e32d7d827985a40b91478ece12a31744b8341722fa38caa2712e7cb88ff86f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300938, "uuid": "542f17ce-53ab-4f32-b94f-63be448c2610", "value": "T133E423E81558964AFCFB05E532062BCF2E6036F3ADD781223262F1D5E619EE410AE3D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300938, "uuid": "26974a66-6188-4581-83c7-0b5d74fe361c", "value": "12288:EsfNYBjNiI8+Bt/Ddwc7pSTaWH86XKOec7TP7er5fuZ3+gxiw7L6ZL21hwc:EsfsZP8+nbdwc7pSH866DmT4i3tiyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300938, "uuid": "3ab4149c-c829-4a80-80a2-dcaf593112cc", "value": 685998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300938, "uuid": "33746cf8-4c55-4c89-82f1-6380ad203005", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300938, "uuid": "e12cc04d-e463-4d20-b1b2-311a82152923", "value": "bceb1355ccd36226ed85e6afab0001d641e627e8c2965e85c4370d9a6af43901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0979d0b3-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259133, "uuid": "f81f15ed-72f2-499b-86c1-5c27f1aaf2f0", "comment": "Malware payload", "value": "66693c5713c9d856ad1ee2ae96da16c6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259133, "uuid": "279ee1a8-a662-4475-bc73-46cd904ac9e2", "comment": "Malware payload", "value": "bd44cc37899b3e7c8333cfd57e69db2e54a4934f471f681ef2c77a9fd5189fde", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259133, "uuid": "79591036-2460-4081-ba69-411a1ec6f4f4", "comment": "Malware payload", "value": "ba182b5a49a4c73fe0a89625ea8949f78696740d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259133, "uuid": "12bc786d-2aa6-4902-8d77-89cb9e224ac1", "comment": "Malware payload", "value": "d0fbf9b612903ffe3148b5adb1b3ea33b885b4ef74aafdfcc0a65cd215d08adf1bc95d8b58e477bc8cfc5fbddea599c2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259133, "uuid": "e2a23de5-356f-48ee-8975-1efff0b5a429", "value": "T13AC5F080885FEF361277781BC9120E9EE2AF896A6E70A577DED88947114C173CCC19E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259133, "uuid": "449c36b5-050e-4c2f-95c5-2dc57a647e34", "value": "384:sb0WKrKdiBO/NY0nHatr59BJ148c8nYwt+t5TqNeh9BJ148c8nYwtf20WKrKdiBO:sgyneohycv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259133, "uuid": "f9197a10-3f8e-458b-a813-441c1f487374", "value": 2540285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259133, "uuid": "9920ba55-6ac3-4959-851e-f70a0c812745", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259133, "uuid": "b26b7197-13b9-40d8-8bea-cbdad77b9359", "value": "66693c5713c9d856ad1ee2ae96da16c6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9951dea1-2676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774242624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242624, "uuid": "069c434c-ea28-4caa-9e3c-3657dc8cc8ca", "comment": "Malware payload", "value": "eade0c5d24b18f3cb4b0b4a74c94a636", "object_relation": "md5", "Tag": [ { "name": "28d04cb", "colour": "#93DA94", "exportable": true, "hide_tag": false }, { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242624, "uuid": "24f8c71e-5f7b-400e-9d09-3c2a6c7b5dbf", "comment": "Malware payload", "value": "bf44f157b03f3106e67242cf51a3463b7f5c9d56d5ac89b81289f7d745986487", "object_relation": "sha256", "Tag": [ { "name": "28d04cb", "colour": "#93DA94", "exportable": true, "hide_tag": false }, { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242624, "uuid": "405646f7-b9e8-41b4-8585-0c7cd5da7eec", "comment": "Malware payload", "value": "f73eede91ca397e1ac97f561cc3c3aa357d88e46", "object_relation": "sha1", "Tag": [ { "name": "28d04cb", "colour": "#93DA94", "exportable": true, "hide_tag": false }, { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242624, "uuid": "b66b1cec-4dc3-4a88-a6b2-f08322b659ea", "comment": "Malware payload", "value": "ced8bc8e609c664e64e666bc3df8bd56bbe44ee818dc565b6bccd8c174f5b712033b0343015b8fc70a6a0076dcda7bab", "object_relation": "sha3-384", "Tag": [ { "name": "28d04cb", "colour": "#93DA94", "exportable": true, "hide_tag": false }, { "name": "amsi-bypass", "colour": "#EF8606", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242624, "uuid": "b28dc60f-084f-4b8c-bd3f-65fbf685c71c", "value": "T131A18428323F5B5EC6C348559EC6EC195631AC0F12DB4DA0F8EC4600FF5A43D6A7572A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242624, "uuid": "8cb0669c-00b1-482b-b1d5-7e9f3bcd8b49", "value": "96:WhjS0oR9L4j4GpM+MMDyZL1UZMxtOIAn+hjAtlkm5P45SLkw1bqelAsSn:uWXZgDyt6IThjAt7xqetS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242624, "uuid": "bd6c5b73-7a81-46ee-9d0f-b9e18c460b00", "value": 4864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242624, "uuid": "0b91940f-a7f2-4dd2-b3ec-33f49e7d1f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242624, "uuid": "3db0d4b7-aa16-4905-a0b2-44adf4c8b7c3", "value": "POC.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcafb4be-26ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774301632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301632, "uuid": "e9bf07e9-3ba8-4068-aa81-afb78106c87f", "comment": "Malware payload", "value": "6a0128809b6f04023fcb4cf78988f394", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301632, "uuid": "8a8a509d-a362-4709-94c7-e18a261e2f15", "comment": "Malware payload", "value": "bf692ccea08c451af5977ea6d3d7f4f4bd77c4985e574ce6fbbdb7517a630a25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301632, "uuid": "6c9bf364-06db-4a37-9768-4fb515bb00b5", "comment": "Malware payload", "value": "40173ee207466ac3f6d4de5441e6123aa513b373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301632, "uuid": "c738c289-ced7-4e3c-a459-98809346c63b", "comment": "Malware payload", "value": "f5e3d018ddc0818d3dc365f1b1ec83f10413747431ae04ff77edf8ef2e754619de55880924a4a853ed5cd681ab762230", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301632, "uuid": "b9f4b156-4593-48d3-999b-90143f522b58", "value": "T15C1429457E419E23CBD0677ABFEE42CD732223FCD3EA7112EE014B16369A51A0E36552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301632, "uuid": "62e2e524-fe9e-4803-829b-843dd72645c4", "value": "3072:lUeC5xbBJX+1GY3pkp3/WUklRZakDGZav95TPGO8ORO65svFQTIoNj9rx+0afisx:lpC5xbB5+1GGUGlRZ7GZav95TPGO8ORU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301632, "uuid": "cf1ccdb6-bfae-4f3b-87b1-216c4b843bd7", "value": 190972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301632, "uuid": "6693a582-f51a-4240-8308-712d769aa963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301632, "uuid": "90a1e198-b32a-4cb8-bc10-a88ed6c112ef", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d345d02f-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774277940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277940, "uuid": "27f6b1f7-671d-4520-b2a9-2bd0027af3e5", "comment": "Malware payload (ValleyRAT)", "value": "bcca1a99a0134c90fedc7df3254f2345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277940, "uuid": "513773d7-e4b3-4b3b-bbec-f189229d651e", "comment": "Malware payload (ValleyRAT)", "value": "c092e3b047c6173359e3e9d870de4db19c494de42d7ef511b822e301860e56a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277940, "uuid": "15c2e3b5-3d70-4bbb-ae71-149822f436e9", "comment": "Malware payload (ValleyRAT)", "value": "be9be03e7839ad43d40d8c0a1567efea927ebbe4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277940, "uuid": "cc495530-c4fe-46c0-9daf-6717c89f78b9", "comment": "Malware payload (ValleyRAT)", "value": "ba142d12d3fed00ad6476e2fa4d85c478ad5154aa1aca606a3aaa154974b4e26a2b95a1378c793f5c8358dbafec7fcbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277940, "uuid": "07e51263-1979-4a7e-af0e-9aa6ee8b1a3c", "value": "T1CBA4B086FBC6ACEBCB171231899F43693338F7D2168657171929B2341E236D0ED86B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277940, "uuid": "45502b16-d68b-4f65-8f0f-4a35dd7ccd4a", "value": "b51e25470f1749c15ea3db6cf0eeac2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277940, "uuid": "301c23c9-923e-4d85-8568-2e6000c5a891", "value": "6144:oFqTwYHaHhCwYg4AW9lNWAgSX06Sod2ELYMKO4/hb0H+g/FPf6:6m0hxY/lNWAJk6B2ELY7OE0HlF36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277940, "uuid": "9bf49ade-1396-49ee-8920-f8116be4d79a", "value": 450975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277940, "uuid": "fc7e5e8a-f848-4ae2-8e75-ef6703c7f27c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277940, "uuid": "4d1e8711-1382-42b0-9f45-0870f0d9cf9f", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d351fbdb-2684-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774248734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248734, "uuid": "6d11deba-13cc-4fb5-a092-d9f75a3f636c", "comment": "Malware payload", "value": "1bbdbfda7bbd2f908ae8ca0aa5a03087", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248734, "uuid": "1b58a031-669b-489c-965b-37f859fe4707", "comment": "Malware payload", "value": "c0c9afb77978ba1446fd5bb4b57c5ceaa95467a90d9bd374ab08a065c7b19fcc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248734, "uuid": "82c5451a-fdf5-4f16-9715-8d33053772be", "comment": "Malware payload", "value": "af9c5ec86c05a96304176aca46bd6bf4e0f28db9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248734, "uuid": "f2b45a5f-e12c-4391-b62c-e99e39513bbd", "comment": "Malware payload", "value": "d0c9240dd54b0ef8ac027418acbfefba09661884501b3aaf3fa56e30b5d5f14a7683ee65ace047c00c94b6a4079cc077", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248734, "uuid": "46559b32-11cc-4726-92b9-6f0317896aec", "value": "T13C925CB412896C79FBD1CE39AF3C6F4DADE8C2C42124E3ACBA0F39205A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248734, "uuid": "432609d8-0d45-4941-bc0f-ce2d7fa5642a", "value": "384:ZmccuQpWx+BL0SWL0gMzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Zmc8i+BL0SI0fzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774248734, "uuid": "02fcf6fb-4838-491e-bb02-2f21244cfa8d", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774248734, "uuid": "50620bb8-55dd-4467-9fab-6f57b4e646db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248734, "uuid": "2dff0624-7d86-4a17-a17e-9e6c393a8210", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024cb89c-2676-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242371, "uuid": "2cb920fe-dfcc-45d2-945d-d64c5248e22a", "comment": "Malware payload (Mirai)", "value": "3c1c92060da396014ffee147e7140991", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242371, "uuid": "1ebce2a7-ae1f-4e15-9457-8c1a9007125a", "comment": "Malware payload (Mirai)", "value": "c119b72b258630e375cc70ac10687c15f354c65429f250e6d6a4d0083f27bb99", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242371, "uuid": "152c5bce-026c-4fc4-a750-49707ac34d58", "comment": "Malware payload (Mirai)", "value": "d0d59be6209bc6cf69c51ec25ec7a0c04f9acc40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242371, "uuid": "49dbbe95-e8a7-4355-b2b1-b4bb97074924", "comment": "Malware payload (Mirai)", "value": "aa230d59247f17ed86ff995d2c2cbee12930f768b9184e2d55783133da163357bb55f13fb5559d1c668c779cf409a669", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242371, "uuid": "4aac6014-05b7-4576-9fa5-7d9b0e752ff9", "value": "T14532C617A7B7AE1BC4D0277B1193072162E95F916024472F7D0D1C8E6E9A3412D3EBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242371, "uuid": "394f6752-ec83-4de2-9e5d-969d6f536e04", "value": "192:xvrOR1CQOsz1NxfAzMH9iG0GhWaDpU/O7Q89AGSybEqeif:xvrbCzfaM2GwIU/kwGSfUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242371, "uuid": "e7a19508-bbaa-4c8f-83b2-8bd074ec9c7a", "value": 11024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242371, "uuid": "6d575bac-3dbf-4706-bd7e-b5afca946388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242371, "uuid": "c767857d-1882-49c5-82da-0cb6c587e293", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351c7fec-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774229142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229142, "uuid": "fe35c40a-7043-48e2-9b8b-b5d4c2bf67bb", "comment": "Malware payload (LummaStealer)", "value": "afee388a90f33b3ad0c7536b2888d2f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229142, "uuid": "414c1228-437a-4754-a36b-0a287f7dc94d", "comment": "Malware payload (LummaStealer)", "value": "c1c184605fe5cf542ca36819035815d9fa5d96e2d3c56c2f641f220518241c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229142, "uuid": "b3e97d49-94ad-4bb4-ba5d-cdb3898bf595", "comment": "Malware payload (LummaStealer)", "value": "0eb302063cb0bb3f46ae7b1c5dc3678885e9c115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229142, "uuid": "842d9c72-ba1b-4b3f-a812-b1019b94e8c5", "comment": "Malware payload (LummaStealer)", "value": "364134f4a591a86b47349d75e1d469a74bfa0bafec61b3744825ac675860d6b4f1e3ec43a099d33ab67e2d3b140d7ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229142, "uuid": "0e2d855e-5ae4-482f-b6ab-f4c2c50ebbe5", "value": "T161643945E7B368B1D9830C79319AF23FDB3926084318CECBDBB0DE54B9275E65939A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229142, "uuid": "7266312c-e2fa-4c51-8d02-bdf2f5d68956", "value": "27867cc79589a38330daef3059900599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229142, "uuid": "12fcc76b-e2ca-4b62-ac41-c225ffa6b99f", "value": "6144:3ywAQrRZ5IejKR5IL61QgwYa6QaFWaaNek8wpDM1i5ZjkpXxt766agpjyEqZ:i8LCT5wYaTaFWaaNe9AM1kZjkpsg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229142, "uuid": "868db036-c596-432b-9eea-e8324ca8c53a", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229142, "uuid": "59e425e3-1011-49aa-8148-0e448c01972a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229142, "uuid": "9f318706-4bb8-4d45-a3e0-b68f7710eb75", "value": "c1c184605fe5cf54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ca4adb-2697-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774256850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256850, "uuid": "674de52a-21b4-4a0d-a003-2ac1a9a3b9ac", "comment": "Malware payload (Gh0stRAT)", "value": "35763d34ebd3084da20e679b69ae9b2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256850, "uuid": "cb5dd78c-69c8-4b61-8266-0a0db2564bf0", "comment": "Malware payload (Gh0stRAT)", "value": "c283a3aadcd4b6266d9e557f9313c0c9968e05f5b20a5e919e16a711b9a63745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256850, "uuid": "b3f0353e-ad10-4cc3-8fea-6e792a0e010b", "comment": "Malware payload (Gh0stRAT)", "value": "27ff8f0bdd9bdee2550f110aeddc9599d39a1f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256850, "uuid": "41ece76e-e170-46e6-8c16-ef7865a859e0", "comment": "Malware payload (Gh0stRAT)", "value": "6f510e03d63533c819be62ff1f5c3f6e093f4401a629f09b6214262bdfb725a031c13138f9755db4a1fa78159d3d685f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256850, "uuid": "e503cf98-647b-410f-8230-d69a994960b8", "value": "T1C1D422F12968D42FE09841B2E75DE43276E0DCC278A50B3296E57A1DB3C540BFA39635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256850, "uuid": "eed7f318-9f04-4e92-a35a-addfdcbc34ee", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256850, "uuid": "fab14cdc-7206-4e87-b1ae-59e8d5bd18f7", "value": "6144:PQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOqi:4J130ENL7kArI+y3XipfOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774256850, "uuid": "ab834775-3f3b-463d-9f85-17a5ab148a47", "value": 656901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774256850, "uuid": "a390e949-df0d-4827-a935-ee93da2023c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256850, "uuid": "4740e366-9c6a-4727-a2ed-266b6bf1200f", "value": "wininet.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d5bfbc-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (NirCmd)", "timestamp": 1774257548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257548, "uuid": "dccac1ed-1f8a-4d19-a6a3-bc5f0723053b", "comment": "Malware payload (NirCmd)", "value": "fe2d94a95d16b6eb2222e682bb59f745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257548, "uuid": "6c5192e9-4e29-4e50-9ee3-ce5322b48b57", "comment": "Malware payload (NirCmd)", "value": "c2ee8ea3a0374b1bbceac9bf883b6d2666b2807e871ae8aa36611b9eba6a4ee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257548, "uuid": "64d0ff6f-d170-4ec5-b542-95d3b1643b49", "comment": "Malware payload (NirCmd)", "value": "f284f406d75f2698022af8a4e8f140a33b6ff832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257548, "uuid": "dbca61f3-d3e0-4707-ae2e-5bd87db2cd91", "comment": "Malware payload (NirCmd)", "value": "949823c3413d525aabfaf736fae8a2c2c8654a26bea1b3e6b2a288cf2eddf084d35e739cb6a530f1812090fab4587113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NirCmd", "colour": "#A5465F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257548, "uuid": "9a331043-72ed-4207-8ac1-e9ae6b35f613", "value": "T12AA52342F8C485F3C4511C331B65A7616A7DBE202F268EDBB3856B1DE9614D0EB31AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257548, "uuid": "d0eb2c7d-8700-4b7c-97bb-a37d4847e302", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257548, "uuid": "74886c4c-b555-4177-a133-7efd410a7143", "value": "49152:ABRWTpc8iYM5pF9UBB6jdLXsuuX4/cqZIiQx6lSONx:a8TFM5pXUBB6BLXTuoEXx6lSONx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257548, "uuid": "2c883489-a50b-4abf-8422-286021b5c2c4", "value": 2110512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257548, "uuid": "e9287684-e659-4461-9423-71ad7f4d433c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257548, "uuid": "ef766427-b1af-4542-8049-e254f6bd5639", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0b8308-26ad-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774266389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266389, "uuid": "9f7f87bf-d348-4b4d-a51d-a7e97c3f7e00", "comment": "Malware payload (RemcosRAT)", "value": "432d2644bdecc82a1a177cd08cbbc445", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266389, "uuid": "ca6adba6-133a-48f3-87aa-d89ea8822a0e", "comment": "Malware payload (RemcosRAT)", "value": "c365a4fa1ce9a63e25b0fd5c5a45ee30ce56a3815909bcc89c6053a1502aea77", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266389, "uuid": "22857b6b-d749-4557-9944-a9765885f977", "comment": "Malware payload (RemcosRAT)", "value": "498ac4a8d29ceab0ea2d3da52578eb0cbf77af39", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266389, "uuid": "8ddd3595-2d24-4c46-b52b-e45de30d23df", "comment": "Malware payload (RemcosRAT)", "value": "f834ad6a40bc34d5726f3dfbcd840bd9aa6786978d7aa2b62e6ecf8ea1cecec7aded86eaa8e3008b503a29fb86f2d67a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266389, "uuid": "fa67ff83-2fa0-41e7-8241-f974b6a15d1b", "value": "T118F48B6CE3B9158F8D3D5855AFE042A1B0F3F24F4A4880DB55DF1ED0EE96C64E0A4A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266389, "uuid": "acf0c7dc-e51a-4f55-9f52-0d881691365f", "value": "96:wTpGhYOQSyC3lErdvWVWOh31sVa1lqqq1553pgzOjpN/iBzlab2qM/xoGzC0inni:opceARE7nUqfiNRc8CB1tZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266389, "uuid": "bd842666-5ac4-469b-bef1-996c045b29f1", "value": 788408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266389, "uuid": "7e939324-01c0-42de-9636-2429b7ebc9d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266389, "uuid": "acbdbf44-9864-441f-9080-2d87f848ae35", "value": "godwithuskobogreat.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dc40e9-26c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774278057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278057, "uuid": "ad1119da-6b1d-441a-9d59-10eaa541d114", "comment": "Malware payload", "value": "2e22ceb75e5bb1e03c74e222867b33d9", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278057, "uuid": "905bcbf0-d447-444b-a662-5486aa81ba82", "comment": "Malware payload", "value": "c379c5d6d5a8cf20ef120327a3c8dd2331f60216d0a11b85d1fbdb2aae147646", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278057, "uuid": "9903f587-9cd3-4295-b4ab-907eeac10b65", "comment": "Malware payload", "value": "c1b012acc1f39b52f9ae230af5bfdefd97820b1c", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278057, "uuid": "ea857810-578f-4b45-8478-0d047e553ca9", "comment": "Malware payload", "value": "ad46d117bcfd18de77ecfd6ef51927d0b1c53d5e0cc821bb667bae625f70b4e853786fe3f11e4f6457b91c1c99a77914", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278057, "uuid": "2141646f-378d-4967-abf5-0e7b02bec3b9", "value": "T18E046D2D8F2BE0D0433EF490C2D99D6673504A56CB7C8B98FF21AFA61D14765E79A20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278057, "uuid": "78181a94-8ca0-4e8b-b4d3-2f7138c7c1d7", "value": "768:s7mxa96MH7rOokUORcpFoa4bOYOd7O36nHzZljXRnSr9nMMzyBQbU5ovOr4kqUXc:q1bNkSoa4mjnHVlTRSrjb/XlnB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278057, "uuid": "0ab7307b-e912-4ca9-8b15-8381ea505314", "value": 183897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278057, "uuid": "b370f1d2-de0d-4373-aad0-46beed8c1fdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278057, "uuid": "141ee7db-4a67-4b68-a6d0-5b07298c39c8", "value": "file.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce22014b-26aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774265046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265046, "uuid": "9fbd6f69-b0b8-4994-a33d-effdb568b197", "comment": "Malware payload", "value": "896957e0831e6fdd8047fc7e4bc602cd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265046, "uuid": "ebe3a77a-84b4-499d-b47f-982989f21a4a", "comment": "Malware payload", "value": "c52e67379ad0e69289899a4f5c97ac7d40e487a5635c7c2bb5f3821f0c9458e0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265046, "uuid": "65a3a49e-7fa7-4a34-8b0c-6bc93b7ca480", "comment": "Malware payload", "value": "351c67311acb152c7147eab9b4742771063f3829", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774265046, "uuid": "d60462b3-3b69-4e98-b04e-775334574737", "comment": "Malware payload", "value": "9036eca7b375bd7f0ad72e8cd9c4d7dd4b150342294045f04ee542dfabfd2892482434be150f4e4574eba77eb5c8f34c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265046, "uuid": "4d34afa1-7543-45a1-9ac5-3103e61b9e68", "value": "T16F746833CAD1241584DCB8EAA2D6D5AB1C9D861B9E30BAC5913CC47D93FE6B0C5DCA70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265046, "uuid": "392d08ef-34a6-4052-873f-2a64788db301", "value": "6144:IG9c2a+53UdC1E+dtgTkLx7UqyoVc26JBilooA:IG9cW3UY1E+dtgQLtUqyJxBiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774265046, "uuid": "713d096e-2541-4f60-9dd8-b8a4e4ac4fa3", "value": 339576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774265046, "uuid": "d6285a43-6d23-4eb6-87fb-4bbbe344db88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774265046, "uuid": "c5b4dee0-9615-4dcb-9935-16160046a412", "value": "Konfi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda3c60b-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283111, "uuid": "341fa49c-180a-4a17-8e82-8041b004f095", "comment": "Malware payload (Mirai)", "value": "a7b39ff55a570a9976313ae09ec6269f", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283111, "uuid": "a5a94af4-2cc7-45ea-ae57-b4237f09e1d0", "comment": "Malware payload (Mirai)", "value": "c654028d4e9cc619b195f2d1411236ed863b2dd7a86f78ff8e33ccb9fce4682c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283111, "uuid": "2c86e1d8-380a-4d5b-8a37-f34b73fde22c", "comment": "Malware payload (Mirai)", "value": "ee6764c751851dc6d7a820fbaf48ace323248b5d", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283111, "uuid": "ba5a58ba-f3bc-44f5-b4aa-d1963166abd8", "comment": "Malware payload (Mirai)", "value": "f93ccea805a3c3c1e1d2daa22763f4d2dbf56b154983886cd162082869f361a942a4d1499c5d742451e9aea8d91e9506", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283111, "uuid": "9a419625-bd68-48ca-bdb7-3ea0ed4f7b8c", "value": "T148C44A59A8419B95D5C02BBBFF1D934873131B38E3EFB1069D196B246BABC1B0F7A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283111, "uuid": "949f5b8f-17a2-422b-b078-79ec93ecb4a8", "value": "12288:EYtUj0ZudTeeq8jHC6ooprEyKNRPTJ2XhrXQW1BffNaXqeTUSyFxpNDhW:EfdTeGjHC6aLTJpWpuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283111, "uuid": "dda57f17-529c-478d-a97b-ca562020461b", "value": 576924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283111, "uuid": "9e9acd3d-d126-481e-9eca-8123325ff388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283111, "uuid": "0c0adaf8-ca37-480b-a6f5-8d9b9ff102c2", "value": "richy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638dee01-2688-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774250265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250265, "uuid": "072d90e8-52de-44f7-827a-3da83b9fb345", "comment": "Malware payload (RemcosRAT)", "value": "7e5c9f37d356633f8327adb86b91eb29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250265, "uuid": "c42594b6-ae6c-4b46-b4d1-41d5159792b1", "comment": "Malware payload (RemcosRAT)", "value": "c69981d6496ab4c643857853b501bf11f97ad27750588af4e37fadf199acf4ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250265, "uuid": "9d5e3980-a5da-49d6-b131-19c03a53559d", "comment": "Malware payload (RemcosRAT)", "value": "728fac4d6eb1f36cccae627c4802f118732bb553", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250265, "uuid": "33cc5831-ca29-4544-a8bc-0f195ec01ab4", "comment": "Malware payload (RemcosRAT)", "value": "c2a49ae939945db52473ca24ca45c934f3a8ef3b55e624844adaa986739b8654714912a209b146cc2b83735205d91bdb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250265, "uuid": "25c4b1fa-3369-4863-a9df-86d13fe8a569", "value": "T1DE567225939C9773F7E1A79C107ABE225815468B29C8CF1531ACD70C3BADC271368BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250265, "uuid": "1cd614be-9eed-41a0-96d6-c030bda08797", "value": "196608:dLHi9wfSyy0PPUylTvyUBHaSFeNkjrWnCktnSOm:xHim+0PPUyp6bSFwAq7nvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250265, "uuid": "73e749fd-f821-48b1-b63c-2ae55e80b8df", "value": 6345660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250265, "uuid": "bc9a51f7-b381-48ae-9f24-3b22c291b013", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250265, "uuid": "3878c3e2-49aa-4e8f-a692-e5178ceb8a21", "value": "PO350267823.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3db4f55-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242320, "uuid": "1ca1a2a2-f619-42a9-9e0d-b8b882754f23", "comment": "Malware payload (Mirai)", "value": "e8c892955a1444f6e8e14f4a325f3cd8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242320, "uuid": "1bf1adf9-148b-4dde-931d-60063f8a8f18", "comment": "Malware payload (Mirai)", "value": "c6a7e2c1767f5b54c1ab950d2360ab91207176e959cae7a4a15dab4b28f21cc3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242320, "uuid": "80204f59-ea4a-4496-b715-e58ea6758f8a", "comment": "Malware payload (Mirai)", "value": "04f3dd66af27ca8fcca2663b1b53ccb5ccf6395b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242320, "uuid": "b805dcd5-a71a-48fc-8524-e6a6c390d6ed", "comment": "Malware payload (Mirai)", "value": "c1c292a2c8c052ba8b6a4fe392cf5dda57bd51bea777900530043c3571f3694e6cf67487d008259aebf7884cf79dafd8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242320, "uuid": "6c18c52a-c51c-4bf2-98fe-ff68f5fa988b", "value": "T1F1D308C7F900D9FAFC0AE7374853080AB230B7A549925A372257357FED7A1990477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242320, "uuid": "576f3293-95f0-4a25-bf36-dec314b6c6f6", "value": "3072:0Sbul4MGHJvkrybLutTK/OwpiZdDoOPVO6V1jbiALNHFIDx:ErybytG/Oyi42VOgLNYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242320, "uuid": "d21ebb7b-e8a0-464e-8979-dc9818b38724", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242320, "uuid": "2310d29c-7a60-417c-a3eb-a896683de290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242320, "uuid": "c73c7517-7398-4928-9202-2c626e18fe27", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed12882-2708-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774305098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774305098, "uuid": "f139421b-9517-49ab-8416-7f0f7718bfc2", "comment": "Malware payload (LummaStealer)", "value": "2a94ae596b5d9328e73d6d35d42dad7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774305098, "uuid": "043007b6-6db3-4746-b321-b5246dae5d22", "comment": "Malware payload (LummaStealer)", "value": "c789ee7c2011a7c3945a1e21845504ac79bd192fb880a6912caf94dd9086e703", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774305098, "uuid": "af4c99d7-2af5-4e1b-b062-aca1c97daa3d", "comment": "Malware payload (LummaStealer)", "value": "66b5770b425cbb365a6d0b3cc692e4c7ebeec6f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774305098, "uuid": "c251ca04-e7cb-4152-b50a-2cc25eb483fd", "comment": "Malware payload (LummaStealer)", "value": "dd124122229f70a96af15eb2f12c4fa954b345e0e842d13dac0064bde301950451cb50d63857b8729a4b941a37b2ef88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774305098, "uuid": "b0ce364e-69fd-4f96-b14e-dad3286f8054", "value": "T174948E59CBA748E6D44B0A7810E5A73F8D24BA3043345F93AEC0DA8F796F9D6453DB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774305098, "uuid": "fba68765-e9fe-43f6-8110-ae472a527d97", "value": "b8719196ffe22afea573066d6b5f5108", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774305098, "uuid": "fb886da3-852b-4fd2-bb37-59d862b53184", "value": "6144:PkK6W/39Y4zbD5ozoOxMEpgSVumtLoYgXCuVy1w5XTlLU7JjJDJUJ4J2J4JsJ4JS:IWf9Y4zbNUcQbBgXhVy1w5XJLSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774305098, "uuid": "78edfeeb-843a-4d64-810c-2573798212ff", "value": 428708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774305098, "uuid": "dec4b1f3-9c3d-47c4-9467-0776305dc3cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774305098, "uuid": "88277875-5de5-451d-92f0-809298895ec9", "value": "c789ee7c2011a7c3945a1e21845504ac79bd192fb880a6912caf94dd9086e703.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff63eff-2676-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774242689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242689, "uuid": "8cb1e705-a788-4c10-b52e-eeb73148ff8d", "comment": "Malware payload", "value": "b85ac40fa657eaf15ef07814e677acb7", "object_relation": "md5", "Tag": [ { "name": "776bd91", "colour": "#5C38FE", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "windows-exploit-suggester", "colour": "#D7E0C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242689, "uuid": "f0b3455c-ad32-48c8-a0b5-e98fc5942c56", "comment": "Malware payload", "value": "c7ede901b75c2a48af62d4444fb1a9e62acfdee92ca21517bca1d573afd8e6b7", "object_relation": "sha256", "Tag": [ { "name": "776bd91", "colour": "#5C38FE", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "windows-exploit-suggester", "colour": "#D7E0C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242689, "uuid": "1a9e5923-270a-41ab-be6f-a43a392699e0", "comment": "Malware payload", "value": "a6df392a19e90205fa2817604feb02bf634e0315", "object_relation": "sha1", "Tag": [ { "name": "776bd91", "colour": "#5C38FE", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "windows-exploit-suggester", "colour": "#D7E0C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242689, "uuid": "0f847fb7-1ad2-4689-93aa-b160384bce00", "comment": "Malware payload", "value": "bf34422930286e40e92b122c62fcc1f7c01821a49b762427136f1fbbb7ed1adb13e9db9d628d2b600ae61b7f8a0389d1", "object_relation": "sha3-384", "Tag": [ { "name": "776bd91", "colour": "#5C38FE", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "windows-exploit-suggester", "colour": "#D7E0C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242689, "uuid": "ed6b473e-beef-4a56-8693-156b4266f7ab", "value": "T1C363EA9117A12E35437342826ACF3246B31D205B17E549D4F8EC939C3F85AFAA3725EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242689, "uuid": "14091c94-8b19-4a22-8877-9eb50b6970fc", "value": "1536:TKU38AJBrwejZtw4sh2H5TstgVxbM7ytX8r3iu7AiwdYmBRNbiMoJsipkxPv0Yr7:wiweVtwc5igVxbM7ytX8r3iu7AiwdYmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242689, "uuid": "1fc4d873-84fd-4b7b-8d2d-6a3cb85ec08b", "value": 69175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242689, "uuid": "ac6080fa-f605-467b-af4a-93233c5cac7a", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242689, "uuid": "268069c6-7a7a-4bf2-ab5a-9120c9047b69", "value": "windows-exploit-suggester.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ebddd2-26c7-11f1-a769-42010a9c0008", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1774277411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277411, "uuid": "e87b662e-fd77-435f-85bf-3424921f0010", "comment": "Malware payload (ArkeiStealer)", "value": "824cb7842629a59cc56b5c86cf29ce6b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277411, "uuid": "2fad1c0e-74fa-4ab3-bd73-aa53a8cd17f4", "comment": "Malware payload (ArkeiStealer)", "value": "c8e41815770b17624a724a6f16be26a55f8d7fdb12dba529efb4b388ac19f8e3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277411, "uuid": "20e3b268-c81a-4b2d-93df-306eecca0d5d", "comment": "Malware payload (ArkeiStealer)", "value": "868ab2c4c1250cae63c9d4cc0269a50e52f9668c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277411, "uuid": "741892fb-cbee-4432-b687-642a347c09cf", "comment": "Malware payload (ArkeiStealer)", "value": "43efddc0abea251109cbef2b3ae9d1d5b8494682798e71205fd37d807f3cca3536c8d740bbba26b8ae6898f666371c98", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277411, "uuid": "ff4379b9-ed39-4cd4-ba8d-19e0aa77cdd0", "value": "T164351211B590D433C29A1231C965C6FA0AFAFC31DBA98887B6D03F6F7E715F18A26345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277411, "uuid": "56e3d699-77a8-4305-89e3-eb60dec66c41", "value": "9efab118ea0124c04f1260438c593805", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277411, "uuid": "8763a450-f954-4935-8368-66ce6afb411b", "value": "12288:uDZSb4oD1VzRZPBrzTuiQ9cqr9GBX4kFMr15jK9H2gF/pdlp83D:uDo5rTb1qr9GBoOMrGPF/pd4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277411, "uuid": "392c6deb-fe7b-42da-88b6-aa5ee371315e", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277411, "uuid": "51cff6a1-8056-49f8-8dac-49afa516c331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277411, "uuid": "e26961a6-b90c-413b-90b8-21f675bb31a0", "value": "824CB7842629A59CC56B5C86CF29CE6B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9451f9c5-26cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774279982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279982, "uuid": "a3c4f4d0-f26c-47f5-9a4a-f7374b38ce9b", "comment": "Malware payload (RemcosRAT)", "value": "7d83593e662d3dbae4baaa9f88e8df67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279982, "uuid": "90940687-a589-412e-a7a3-c0844d8e7054", "comment": "Malware payload (RemcosRAT)", "value": "c900419b3bbe82ee2575baee02ae117465573706653cda154b8ccadaba663fad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279982, "uuid": "cd3509cc-3f8f-49a4-bf4e-632a35472a5c", "comment": "Malware payload (RemcosRAT)", "value": "e69e52dbb6e57579eeb622f37cffd3deb7a0fdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279982, "uuid": "631607c4-62ca-46f2-bad2-50179ae3dcc3", "comment": "Malware payload (RemcosRAT)", "value": "5ace76833b7e2a4d780daf53a9c2a074fbbaffb040b8cd6198b7b70f1495a228f6acfc4531dc8e0579b4587edb620d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279982, "uuid": "dbdf7ef5-58a4-4ecd-a0d8-97cbea8fd8eb", "value": "T16984120177E4C526E66300705D72C6BAA9F0EA6A5866C35713507FAE38FE6D07E0E783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279982, "uuid": "5957f978-5c32-40bb-bed8-6dfc160e8a0a", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279982, "uuid": "1d3a018a-14ca-4588-a659-3d35a650ecdc", "value": "12288:YMw+9m5NkVTMUSReD9mFP/puZXUg7T9UnG:YMw+A5NkZMUSResXyknG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279982, "uuid": "aadbe812-7fbb-4fb3-aab3-03299d6819b4", "value": 407657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279982, "uuid": "0323ca77-0fc4-4df3-ab3f-355bff3015f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279982, "uuid": "08fede15-fe83-4946-ac1b-8bdefab59d30", "value": "Bestellung 24014256.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6698b76-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774232338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232338, "uuid": "072ec18e-5018-4dd8-9a05-ae63a4869e9d", "comment": "Malware payload (Gh0stRAT)", "value": "1aaf61b2087bb7cf62225362067caf34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232338, "uuid": "89d0c3a4-4ba0-471b-96ce-1591a1862fcf", "comment": "Malware payload (Gh0stRAT)", "value": "c99172fcbc60cc2ea59fd7b59cc594c4d7653187d995d29f66bfd94185a479fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232338, "uuid": "e3aeb928-7ba1-46e0-8440-e88352f34af1", "comment": "Malware payload (Gh0stRAT)", "value": "cde7bd9240c9bbf4afbaedba73fe5c64b16a5231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232338, "uuid": "040cc6c2-5079-48a1-9f14-5a5dc2bbf7c8", "comment": "Malware payload (Gh0stRAT)", "value": "c30a8b99d43b7db859c145017501ce76267fbd311f8e43b38d681844a1316ffc69b04624d8829b856a527d9c0602c5a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Farfli", "colour": "#2E1E78", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232338, "uuid": "932d5559-df23-4d72-9136-f1aadf65bc0e", "value": "T1075412E01A68D41FE0A50172D6AAA63366F0ECC07C660B2797E1BA1E76D440BFD35736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232338, "uuid": "7c2f3b48-17b9-4e0b-8589-4b1bc945f0d3", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232338, "uuid": "f5a9a4e4-0d8e-481c-9fc1-47b0f09a6e2e", "value": "6144:gQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOqsG7H:nJ130ENL7kArI+y3XipfOK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232338, "uuid": "cc3c44b4-3ef7-44f9-ab67-d4b3445f654b", "value": 288234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232338, "uuid": "fcebbdf5-19e7-4715-bbf9-356e73a29ffa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232338, "uuid": "cb86e6c7-55d6-459a-9bbf-79309be25a4c", "value": "c99172fcbc60cc2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9463198-26ae-11f1-a769-42010a9c0008", "comment": "Malware payload (BankBot)", "timestamp": 1774266783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266783, "uuid": "2c3eb6f0-3bca-4e39-9593-3b402e6870e3", "comment": "Malware payload (BankBot)", "value": "20266f76b272adda597190d0fa059424", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266783, "uuid": "08e64f49-d73c-4f12-aeb5-8bec50b356e1", "comment": "Malware payload (BankBot)", "value": "cadcce6d4088c72fd0779d59d00f5753eaab585a263e3c92374df29ae767ac15", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266783, "uuid": "038996e4-11bf-4094-bce5-4bea3e80d2a9", "comment": "Malware payload (BankBot)", "value": "2e03db0f3e6821374c6adbf9d9c2720a160773fb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266783, "uuid": "68902cdf-641b-428c-b8b2-0364aa492575", "comment": "Malware payload (BankBot)", "value": "9c2ec09c8d235f477ad481edf67b83fb43b32f6498f95a7f01c56990175d9eefdea4775bb21735ac331735b8082b75b6", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "BankBot", "colour": "#7BC738", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266783, "uuid": "5dedf1e9-5fbc-44e0-ae10-c0b7d4acfc6b", "value": "T1CCB5E046BB989F1EC877D1320C4A5235645AEC23C713C387D9782B6928AF6F44F117EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266783, "uuid": "d0e47fb4-041e-4f93-93b0-aac588280580", "value": "49152:4U2nwzGPMWeoNeQlk1NnEorb4tZINseAm6rIqdd/Ww7/:4UHG/eQlkPbrb4nnm6E8/R/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266783, "uuid": "af04d02a-d4b7-4f0e-a1c4-3ef9d7cde796", "value": 2441463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266783, "uuid": "395ca110-a6fd-4219-b8db-4508207a2e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266783, "uuid": "bdf8555c-100b-4f1b-b49e-14a9f4db6180", "value": "Chrome.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1110a87e-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774257428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257428, "uuid": "9284e6f4-acde-49f4-9f4f-8ec3ec650636", "comment": "Malware payload (Vidar)", "value": "fcb84e7f794774dabd58c098a97fc46f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257428, "uuid": "43622450-16e9-4023-9e3c-07ad5f5b5830", "comment": "Malware payload (Vidar)", "value": "cb7264735e38f2575a354762c122a90d8994ea406f4911a42d8fa45d397fc4ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257428, "uuid": "406697b5-4945-451c-8c28-cb0c7e1bf090", "comment": "Malware payload (Vidar)", "value": "065b250bb3ea5353d2824906b966e4e7c0599566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257428, "uuid": "57285178-8f55-4306-b284-9ea285a8b242", "comment": "Malware payload (Vidar)", "value": "74331b157e6bbbf0a80443939de0b20d63fc81d4e5067d47af26d501ee4bcb83e4249c4641a909c09a0ad52595d31dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257428, "uuid": "779aced3-15e2-4a9f-b0ac-3d9a69f2f430", "value": "T1C80512297A5588F8D109C0B8C7859573AB76F4CB0B3265EF569011343E27EF62F38E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257428, "uuid": "318e5910-dd72-40a3-b2aa-4969b76aa541", "value": "5740e1cc1606398403ff4d6cbda99f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257428, "uuid": "265b2139-a7cd-403a-9691-ed386a5fdf65", "value": "12288:U+O+vvi0/mkxsnWJ+RghPQlAyo29S4Z2nXNg73Kn5d2q+NK9pPphkPvbjcv:U+BTV/+RgSlboq2I3u5xAK9pPoPv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257428, "uuid": "7f50ae68-3c60-49b4-8118-57d09f560050", "value": 824832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257428, "uuid": "c1e46d85-b020-40d8-b68e-c41a9493a007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257428, "uuid": "e2b44d21-aae8-42f5-ac05-fac55241a4c5", "value": "fcb84e7f794774dabd58c098a97fc46f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594a2a8a-2679-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774243805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243805, "uuid": "4b28f616-709c-4f61-9076-4e470bbe277b", "comment": "Malware payload (Snojan)", "value": "07fb81b35744360e0967da0d857cd495", "object_relation": "md5", "Tag": [ { "name": "Cyzt", "colour": "#86DDDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243805, "uuid": "c2ff1f0c-e739-4acd-a587-6fa2da8f1733", "comment": "Malware payload (Snojan)", "value": "cbd786c54cd358faafc075a5f95674f92d9662bdeab8b0184b71fd37647290a6", "object_relation": "sha256", "Tag": [ { "name": "Cyzt", "colour": "#86DDDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243805, "uuid": "e1ad73c9-4b26-4653-8b63-0c78a75b7247", "comment": "Malware payload (Snojan)", "value": "7aa5cb9c8bfa62728510cd71ebed735663d29090", "object_relation": "sha1", "Tag": [ { "name": "Cyzt", "colour": "#86DDDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243805, "uuid": "0b1364fb-8aaa-43c9-8738-bbe79b30cd84", "comment": "Malware payload (Snojan)", "value": "c0bf0ff3335e7ecc217bc6d319b6bfc4f94f757b2a45c83c5347237b00692e90aa47dc16f13f5f79f2b7877989ec1e85", "object_relation": "sha3-384", "Tag": [ { "name": "Cyzt", "colour": "#86DDDC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243805, "uuid": "5e2dad1e-813c-4fed-b80e-741fde0fd895", "value": "T160345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243805, "uuid": "5f757feb-dc15-4396-b44d-b585c1b7ae98", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243805, "uuid": "e23fee32-b391-48bb-85f9-007a35e056ec", "value": "3072:tJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/M/FnncroP9:XwDeM7iNEkgiOb31k1ECKJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774243805, "uuid": "50c4efe8-d229-443e-8880-74bfe1b2c9fa", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774243805, "uuid": "0d4b71ed-a0b2-45d3-9e5e-4a90bb73053d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243805, "uuid": "ab00a5e4-7cff-46cc-a659-297c4f94810a", "value": "cbd786c54cd358fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fcb63d-26c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774276067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276067, "uuid": "beb65889-255d-4319-a15c-afbb5b2de72c", "comment": "Malware payload", "value": "94779909cc510194900c3cc17d1194c8", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276067, "uuid": "edabd04a-894a-41cf-b2a8-bf65c1568d95", "comment": "Malware payload", "value": "cbe9e32393529cd79e19a639a1d2da93fba06082be2bdb0c04241f269f98c773", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276067, "uuid": "7c997aec-6f5d-4a0d-a956-f7e4f0fbc516", "comment": "Malware payload", "value": "ba3874ca96f9bca1daff22ef49ea7505d52b40d4", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276067, "uuid": "cde36855-74b2-4b84-b99d-427ccac9e56d", "comment": "Malware payload", "value": "4eec0a9907b7cab02e8eb66c4b5da6c37db5a7ded56cb48555b17db9add54896926e4316a465f8f20d992fad9bb255c7", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276067, "uuid": "4501ae8a-d05d-4a9a-b8b8-1ef2b138899c", "value": "T1D33701E49DA93E2A28782206937EE49CC224D072F24765A4D4BBD3D19EC761F03F87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276067, "uuid": "3ff71dab-6986-4020-8dcd-705bfad633d3", "value": "393216:izZShZzyv9YAppTWme9vKeUS2JjW4c4btED9Gn3Ff5+E:iIfGvnpMx9vnUS2JlG0Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276067, "uuid": "3e00273f-bd89-4086-b5a4-8baaafdf3d14", "value": 23178389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276067, "uuid": "30eed334-5b7d-41fc-9802-5e14c0364688", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276067, "uuid": "efc5dd43-1b52-450e-8d84-1b4f93e173fd", "value": "cbe9e32393529cd79e19a639a1d2da93fba06082be2bdb0c04241f269f98c773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97e75ce-26ee-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1774294218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774294218, "uuid": "747b76c7-9919-4d37-8746-20a20184d86e", "comment": "Malware payload (DarkComet)", "value": "46d58768298f49568796ffbb2a38bbbe", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774294218, "uuid": "6ca6e854-cad9-4361-8b8f-c3606239055c", "comment": "Malware payload (DarkComet)", "value": "cc08361af030e9b6a7e63ba6396030c15b6bb10e7690b27bdf9f279eae46106f", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774294218, "uuid": "c61b7aba-158a-41e9-90fe-0eddd1717dac", "comment": "Malware payload (DarkComet)", "value": "f30d82c3588e2020810016b18402534b12a702d1", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774294218, "uuid": "0303edf8-4648-4ff4-94f4-351441f65f67", "comment": "Malware payload (DarkComet)", "value": "f67b6c6c1c05da022733efa6128320df9fbaa2d621e3545d4593eff50ceebb66bea55655ab106f3fc49e1df1f69ff1f1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774294218, "uuid": "85182c2c-1172-4156-9eb3-49a0a334b8d5", "value": "T15A24701262078D4AD53223F88461E7FDC6522FD4B93783165BF07CA3F9B2A835D2A5E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774294218, "uuid": "c3fba7e5-d452-4049-a1e2-7ed857fb7eaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774294218, "uuid": "bcf1af49-540a-4d2f-87b7-f70bc91def96", "value": "3072:yuUQTBYG2SziW9Hn1bs+g118Tt9kg5jHqtRQAcccokHrXRvx:yuUvzm9H1bA163kSHoRQz1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774294218, "uuid": "9bb172ef-0cec-4dbf-a03e-f191312ef0f0", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774294218, "uuid": "be78fa84-5e02-4c65-80d3-d17eef0d985f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774294218, "uuid": "9ab98dad-703e-4c4d-ae2f-7dde46f67bbf", "value": "cc08361af030e9b6a7e63ba6396030c15b6bb10e7690b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c811d0fd-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774250863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250863, "uuid": "d4d276d3-be7f-4b56-a244-3214a3b4be08", "comment": "Malware payload (Mirai)", "value": "f453d86b2af2cad58aef6a4b0f12ed86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250863, "uuid": "af9dfdc4-8587-4923-8149-6ab496062e8b", "comment": "Malware payload (Mirai)", "value": "cd3fd91053a5815252b5a6097e2abeb01af70b48e8e159438cc2a6611f66a6f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250863, "uuid": "c71d3e37-de42-45f7-862b-54a703bcef8b", "comment": "Malware payload (Mirai)", "value": "2cd2e9c9de1e1e5a95af8de70b0cabedf2f8231f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250863, "uuid": "0e9429f9-a158-48cb-bc6d-4548a31a3387", "comment": "Malware payload (Mirai)", "value": "d3b33b564aea34b4778308ad5903ce8b16c3871e11535c24f837a3c4bc5372877f7243e2122f1605c62199b75fb232f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250863, "uuid": "1a2e0167-2b18-4870-a5a1-ab780c863f13", "value": "T12444070A7F902DF3C46BCE3741A50B4A30CC645752953B3A7934E624BE1B94FA9E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250863, "uuid": "69ad34af-9f85-4bc3-8479-187d56c9743d", "value": "6144:meiSyWpC6g36RlapFUqrQZDfcT1OFwbqfZ:P9mNrQE1XbqfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250863, "uuid": "4bf06b8a-2efa-4310-8aa6-9ccde30334e7", "value": 271796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250863, "uuid": "70fc8916-5d83-4b5c-b041-2329bb65dd2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250863, "uuid": "d753a33f-a338-427b-9c8a-9ace8455c6bd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe026a58-2695-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774256107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256107, "uuid": "191d09d6-6b9d-47f0-b1c8-01c8a67cdfc2", "comment": "Malware payload", "value": "af8ba68e4ff02a366264b3db7d29f898", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256107, "uuid": "8d5ee38a-946d-4bdc-a3b2-0575b3cee83b", "comment": "Malware payload", "value": "cddf7bfa2913861d72b0a0715e259ddb2e48340a56d528da1a64237e90a490a1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256107, "uuid": "3a8744a2-ab4d-48ec-acc4-7039c3b52972", "comment": "Malware payload", "value": "83cae25bfe71133ace725e7d7d0ab5731cf83625", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256107, "uuid": "5bb7790d-eb95-4593-8723-93aa9628e712", "comment": "Malware payload", "value": "0c69ae658a4bb49b6c8352aa8bf3f7d82b9a3846b0b4d4d194eee77a0c24a9d9c3c257dec83802f4129ec130a05a888b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256107, "uuid": "77b4f189-1161-4d35-87c2-f34ff938310c", "value": "T164C321C809AB84F94B4F64549AEF8D13DF9D9113021CC5847BAD9FE43F016BA70EA9E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256107, "uuid": "ca737c18-f6a5-4837-8e66-82dafdb7387e", "value": "1536:8GcKuEn2YWmiHZTzb34ZTIOmvXoG2lNKFNgUqW:RWbHZTv34ZTIOmgJKFec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774256107, "uuid": "f28a9cca-da48-4ecf-9edc-456362c2ddfe", "value": 118553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774256107, "uuid": "671d6835-ca14-4ff8-bf06-658f0ab028e0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256107, "uuid": "e8e7e30a-0ad2-4b4a-8dc8-236319775845", "value": "Alpha_Release_School_2391.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de6e264-2678-11f1-a769-42010a9c0008", "comment": "Malware payload (MimiKatz)", "timestamp": 1774243410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243410, "uuid": "568e8644-ab44-492b-a497-f3c36cd37cc9", "comment": "Malware payload (MimiKatz)", "value": "a4f4d92824ab417d923792cfdf794092", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243410, "uuid": "9905d1d3-0cb5-4283-af7d-ab6a0ef406ea", "comment": "Malware payload (MimiKatz)", "value": "ce7d25b4f5fdee33a3b1f72c92abb2c907a2dc8347442fb8c7940e9616a17dc8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243410, "uuid": "e2960d95-df8f-444e-9dc6-7f5fc1f811b0", "comment": "Malware payload (MimiKatz)", "value": "ea0f4ad0d37cad3c447406a5b94aa68534bace8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774243410, "uuid": "f8b5f2a3-5daf-4856-9569-ea8ae8dff5af", "comment": "Malware payload (MimiKatz)", "value": "845e543e1ea31e6b3eda9c233a0c7903840dedd5c04c5ea05f0a5b089ddb1dced20b57c1cbd7d95e906224767198b6dd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243410, "uuid": "e770e070-d9b0-46e8-9761-854dd246353b", "value": "T1F9755C43E2B28CE7C7D90534DC6AD2767B347A1C93FB86737680D9D7B5622907A2031A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243410, "uuid": "5b528427-d3c8-440d-92c3-66f2e725a52a", "value": "24576:o4rDuOIlp7ePLgRyU7CKiFgS8LPfL0jUkM5FIJRweiMtRMqYCTZWCK0Y:F9oXUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774243410, "uuid": "17327df9-7459-48ce-81e0-52b7217c3709", "value": 1610792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774243410, "uuid": "ed5e9d60-dc0b-4bf4-bf72-3f242eb76035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774243410, "uuid": "67dc60b5-c308-4cd9-a172-a1edf8ae51e7", "value": "ce7d25b4f5fdee33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35ce1e7-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283121, "uuid": "39ca0f84-944e-4025-9f44-ca52b180d569", "comment": "Malware payload", "value": "b0f41c73e0e26a61e1e410e3966308a1", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283121, "uuid": "b2a23fc5-fb8f-4ebb-856f-c9e552329924", "comment": "Malware payload", "value": "cf083b9cc2bf0fadd945df7bb0736cdc38475170e34166e31d21df0049aa7416", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283121, "uuid": "01b2441c-af89-4033-a325-4ddbeffd9ed1", "comment": "Malware payload", "value": "390ca92499bf5f00bd13a3809ab278333f921c2b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283121, "uuid": "72abc0b3-e021-449e-91f1-01acfb29a53f", "comment": "Malware payload", "value": "c61c0686a99a6e66a47deebffbacaa84082b8fa0a83242c348ff52c3ad3907f410d220f1cc691dc0827421c805e9ad1d", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283121, "uuid": "e96d0d2b-c613-4b46-b45f-d684d7499a9c", "value": "T1CB4142E0BD5EDD36F80401BCA48A8B131BE1442F109DB54862FF7962460E58EF79B739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283121, "uuid": "aa5e7412-70da-4b58-bac5-ef29228e8e78", "value": "24:6msuQgqL1/Ihm+NfLrfxaMdfg2R2+W9purQUBpnoiEGQJ7xP:6mXQgqL1/IAcfrd42RYYrQInoiEG4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283121, "uuid": "ec3d1eef-e37a-4747-aa41-410f192bc318", "value": 1912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283121, "uuid": "a76bfd56-8632-405e-a9bc-bd64d4b3133b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283121, "uuid": "c61ef1bf-1888-43d2-8487-20767adb2b14", "value": "mossad_apk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71c164f-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283127, "uuid": "b795e494-cd71-46dc-a138-c10679bd6fb8", "comment": "Malware payload (Mirai)", "value": "19662854998bc0f74d9f0565bc5216ed", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283127, "uuid": "56f2c7f0-ae74-4307-b9f3-a4424920dc93", "comment": "Malware payload (Mirai)", "value": "cf173c982a341d2b14c6b024807836016a40e22ab0b6596591d98e841c24be62", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283127, "uuid": "4f1b3ba6-5778-47c4-bc0c-157f406ebb40", "comment": "Malware payload (Mirai)", "value": "c355476ed1742e93bdbad730ec0fca0f2cae3f80", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283127, "uuid": "ce551863-6f67-4742-80fb-822f83c83136", "comment": "Malware payload (Mirai)", "value": "74e236723587da16c313563418b23aa0207c181b5e5b65b463f60502a5030458ab34bb87d188205a70af0d1fe2c57828", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283127, "uuid": "95d90c48-238b-49a8-8f7a-c52c04b71a1e", "value": "T138057C98FD4E3C42E2CBF27DEE4A47E1612BB1E0D32781B23952135DD4C5AE9CBA1116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283127, "uuid": "23b3266c-c242-414b-b619-934e41795a5e", "value": "12288:t7yRIOOvoAPRDmDnEIfUkMn/1xZDpZknjM+4WY3Wglw5D/BG3:kyOuDuEIfUkA1RCfYroU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283127, "uuid": "994120fc-f123-480a-b7c3-0a4a4eac9673", "value": 860640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283127, "uuid": "e0aef5ec-6d12-4701-a1c8-a4de31425702", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283127, "uuid": "76a2490d-7670-4e83-9aae-3b285a1457c8", "value": "arm64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69063712-2672-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774240825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240825, "uuid": "55b2dfca-f64f-4357-b2e7-0ef54ec73cb3", "comment": "Malware payload (Snojan)", "value": "965dc4db8028aa76d8cbfed447b2b9e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240825, "uuid": "510b4110-80e0-42db-a16d-e4d7ad7596d0", "comment": "Malware payload (Snojan)", "value": "cf38be6c5987f1d3ba25e27bef372e2c2bc523ef8fb35801be030a5698f6025f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240825, "uuid": "675406bb-5204-4273-9c4b-f629c55998de", "comment": "Malware payload (Snojan)", "value": "fa8737296bd0776d8f58cfb496637970e80adb14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240825, "uuid": "c66113fb-188d-47ce-87c8-6faae1dfcfc5", "comment": "Malware payload (Snojan)", "value": "2b745e1fcf435fbd17f35bb27e7a1138046dab9f049a7333f2232a94a0c1d2fc007ffaaeed598c64fc7d726ff38b133c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240825, "uuid": "f1951a38-3329-4a11-9771-555caad37bf7", "value": "T186345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240825, "uuid": "f5422257-1151-4834-8fc1-5a19d88e9d68", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240825, "uuid": "1a12f284-4cbe-4a0a-a396-f7c9ff003e31", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/z/FnncroP9:wwDeM7iNEkgiOb31k1ECDJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240825, "uuid": "fb959c70-2b6d-43fc-97e5-33c9e7bfb991", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240825, "uuid": "ac7d9c94-df18-47cc-a0a9-0d70234cb5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240825, "uuid": "b8c422bd-040a-415b-97ea-454d55fa1a6f", "value": "k24e9evba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c36320-2704-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774303716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303716, "uuid": "19bac840-310b-4341-aba4-17b34f61100f", "comment": "Malware payload", "value": "72b714e1c6afd53e6932402c1ee19904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303716, "uuid": "2a3b6367-d87c-4dce-a0f6-120d9750c4f4", "comment": "Malware payload", "value": "cf582a89c828a4b6411733fc9bb7c88742dd2d7299ad879d1006a917c3ab8dd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303716, "uuid": "89b9897b-ed42-48ed-9bf0-c01108b266a3", "comment": "Malware payload", "value": "cfd8c646cbe8358d741e2ca07667edd33e8ef172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303716, "uuid": "d2d852e0-b1c1-4fce-b0bb-55f03f6fe2c1", "comment": "Malware payload", "value": "becac1650bec27b81d8043c57dcfbefa893bbb72c842dd0eda6ed465c7a7febf7b7381b53f12816723d77d5a9bb213db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303716, "uuid": "887a8306-43be-49db-930c-b77f827715aa", "value": "T16544070A7F501DB3C86BCD3B46A60A4A30CC645762953B3B7934E624BE1B94F59E3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303716, "uuid": "0acdf8d6-5324-4d86-b8ab-fb36be63ed66", "value": "3072:J+PMRmkquhPsF+D86gpDD4gHQnU3k/b9nSA/sRHgetuuRjBq5/QtL:J+PMFhPs6glD4CSfbQq+Aetumq5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303716, "uuid": "b7d0cc09-16cc-4750-b138-c6ceb312ee3f", "value": 272052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303716, "uuid": "82febfee-388d-4c3e-9b26-82c6cbc47f21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303716, "uuid": "0d245308-26ea-4200-b7ff-51ef93c97544", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d7376f-26d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285006, "uuid": "27e09912-3759-48e8-9d21-fb5dca2f217a", "comment": "Malware payload", "value": "d104b9806e49c5288c7156059855f3e3", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285006, "uuid": "c19de493-0b3f-417a-8965-b7ae687e82c5", "comment": "Malware payload", "value": "cf68058dba73e8eb8832e31045f56f018ffd4c7dd740ee24d32c3d2e4321d9e6", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285006, "uuid": "bfab11e3-fc42-45f3-aeaf-e1b5f6332add", "comment": "Malware payload", "value": "7e260e9dde0b9dae7006f9ec36e2f3f1cc7c6b37", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285006, "uuid": "76a933bc-800e-46bb-a784-e60fe9d9ead2", "comment": "Malware payload", "value": "d034cdaae7b65bea69a3708f55e5c5964623a648557e8f1fb42e4aef3d77e0476b510672dc99bbbbb8445c93a5915ab5", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285006, "uuid": "3aff0224-c04c-481d-afb1-49d0fe9e9820", "value": "T1B03701E48DA93D2A28782206937EE49CC224D072F24769A4D4BBD7D19EC761F03F87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285006, "uuid": "cc38d1ac-8788-4a90-b4db-3b8e8db4c945", "value": "393216:hzZShZzsv9YwdMzJs4uDMkppTWme9vKeUS2JjWVFf5+k:hIfIv9RJpMx9vnUS2J8Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285006, "uuid": "fbadce43-9278-42d1-8a00-ab761f0049a9", "value": 23178450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285006, "uuid": "52de8182-c0ca-406b-8ba8-95747296589b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285006, "uuid": "a96929c5-7719-4f91-860a-a87a0a0ff100", "value": "cf68058dba73e8eb8832e31045f56f018ffd4c7dd740ee24d32c3d2e4321d9e6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6968836b-26e5-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1774290218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290218, "uuid": "b22e74ea-24db-49af-afdd-422de4f97207", "comment": "Malware payload (DarkComet)", "value": "5c49b42bb8074f46434d23fbd179e448", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290218, "uuid": "69775f45-381b-46b1-87f3-dfe8af5cabd8", "comment": "Malware payload (DarkComet)", "value": "cf6bac13c5316f2577d4b1e5a6d349ce0cad51b7adef0569dfc891b79abbec95", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290218, "uuid": "d3e60592-0d7b-4928-a315-3f540e38be62", "comment": "Malware payload (DarkComet)", "value": "9f758a4c887e1ba52849c320dbe1b2784ebfbcff", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290218, "uuid": "404dd119-7724-42ec-a5d6-901ac2748ed4", "comment": "Malware payload (DarkComet)", "value": "9e27ccfc5818d57683a647ed211516355692c9056ecae18cfd2141c7505a28affc11e7b95d9143abdb425e98db1224d4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290218, "uuid": "68cd94f8-871b-4f23-893d-9d14b738a786", "value": "T13AF46C32B2819437D86239F89C1A82E6D82A7E112E29754736F63F0C4A78587FD553CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290218, "uuid": "cfd4d73b-573b-4b49-8387-d416fca58c22", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290218, "uuid": "8ef8f525-a4a8-4e70-a0c2-185c02858416", "value": "12288:L9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8y:FZ1xuVVjfFoynPaVBUR8f+kN10EBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774290218, "uuid": "e5bf0a01-3955-413c-a273-936e6c6f5e5a", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774290218, "uuid": "ea495e20-bf5b-441d-a496-2f4a09b21f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290218, "uuid": "48127026-982d-4c78-a920-1da16f08ee96", "value": "Valorant Core 1.2 (G\u00fcncel Setup).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276c54d3-268d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774252311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252311, "uuid": "50eccc06-5e63-404a-b42b-1362a6f84b6b", "comment": "Malware payload (Mirai)", "value": "139cd4ca4c9d1a190a31e773f3f8f17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252311, "uuid": "7da5630a-82bd-471b-bcc2-aa1eb0d3e86a", "comment": "Malware payload (Mirai)", "value": "cff37818e204e6888d25e573645391d895ec1b34ea9bb6837ba6e65623cd0cef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252311, "uuid": "827a4f69-269a-4324-add2-65edd90b50fb", "comment": "Malware payload (Mirai)", "value": "4fc0411462396a5081fa50e77379185898cb57e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252311, "uuid": "838cf3bc-ffe5-44cd-9cc0-4d66b388f33e", "comment": "Malware payload (Mirai)", "value": "5ca252d1e28e7e5e077ebcd69efab35470bb135a735fa50557b523c623ee4ff34243f6172ff508a09cc6017af4cf88a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252311, "uuid": "1048a2d9-45a1-4bcb-b6ec-ed2b5cf8c415", "value": "T1861418457E449E37CBD0A67BBFFE42CD331223F8D3EA7212EE0547253A9641A0E26552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252311, "uuid": "b5d5e977-1f13-4450-a9b6-ed34371259f6", "value": "3072:y58N/T+n/o9JOL8klRZakNWJ2gJJ39aHA+1Z+yMvdELIUpbFjCm23bicyRQ/hYiX:ymN/T+n/UJ6lRZVWJ2gJJ39aHA+1Z+nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252311, "uuid": "b1a42e7a-048d-41df-b70b-9c07e3d047e7", "value": 190788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252311, "uuid": "d0f42684-2a8e-4e82-891f-885806134a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252311, "uuid": "acfa33e6-f4a2-49f3-bdca-35ab7128e950", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4adba3b6-2673-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774241204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241204, "uuid": "3941f5b4-40c0-4b67-9971-2c9b08284e4c", "comment": "Malware payload (RemcosRAT)", "value": "c9741c83dadc26e3ae291207d494e91f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241204, "uuid": "ef94725c-8a22-47ff-9a51-285faeac334c", "comment": "Malware payload (RemcosRAT)", "value": "d1805bb55498f94da1f9040517f7baaaacf2d4f77cdb6cd44a9436115dd12be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241204, "uuid": "85c95c6b-40e7-449c-b0f5-0e0f56bb0fb6", "comment": "Malware payload (RemcosRAT)", "value": "e5d929209bd61a0522ecaf4c1662dcb0f220456b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774241204, "uuid": "08a8a320-db30-43d4-b92f-993b5efad92d", "comment": "Malware payload (RemcosRAT)", "value": "12df8fb7561bc22e697ca9662e2da6401da8b78c92397a7fef57c8559d3a016dff3980cba186e5501dd8469393030f04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241204, "uuid": "2fcdd606-2c50-4e29-b3dc-e328a709232f", "value": "T16F551211AB5BCC53E1BA1BB4A9D2E47007B49E4DE827D28B4FD93CE73623B851945383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241204, "uuid": "9c069698-5db5-4e48-a300-1162d762ba69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241204, "uuid": "c774f6c3-d65a-4be7-94ca-e5b111b29836", "value": "24576:ZdHMJ/XLR5+WlU5rLil/RRL71MwVSaqtcG+aHhC8wZzEGZjV/UCVmjSA2:ZBMJzR5+WlU5r8RL71McSaqqG+K89NzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774241204, "uuid": "d8c36506-4a5e-4174-a763-5ed059e258ce", "value": 1283584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774241204, "uuid": "9003209d-ffb3-4de2-9257-9a035ef11b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774241204, "uuid": "f975f051-9e97-45cf-a6a4-dda092070a5a", "value": "1x40' HQ \u570b\u969b\u5317\u5ddd SO3611-0421 KEELUNG - \u4e2d\u9060 EVER MAGUS V-1432-004E (AAS3-D3E-003E) .pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c63226f-26a0-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774260641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774260641, "uuid": "aa429cd6-7e88-494d-b652-d55f8f5825e2", "comment": "Malware payload (GCleaner)", "value": "89c2d8a1abc0afffe6a5f72a70b508ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774260641, "uuid": "1360e00b-6776-4b3a-af25-a59ac3b2c142", "comment": "Malware payload (GCleaner)", "value": "d24227569a0589f908ae91d469667cb87cd24fe691135eff4d5e34b4c1741c8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774260641, "uuid": "ac4fd52b-9a0f-4cf3-b77d-0b38e1558bcb", "comment": "Malware payload (GCleaner)", "value": "f2d71df0a73707a34bd7b77ed6cb3998b8ef0acf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774260641, "uuid": "1b111dfb-1d91-4dbf-b465-e85feb598449", "comment": "Malware payload (GCleaner)", "value": "7179e02bd4eef727921d72d746c02d4bced13147e696f86e14aa0951429522d18a65ebb97dfa51df640f7762bd1e7b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MixLoader", "colour": "#0A9DB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774260641, "uuid": "674a5b15-9d62-4f18-b7b1-31258e390a61", "value": "T1E4A4734EEB5711BAE7EC8878815241BF936233454B205ED77220BB43E623B9F8D7D681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774260641, "uuid": "a4b0c3ff-30d3-414b-a93d-67eee1272ab2", "value": "ae3f6117529afad9eace4fbd7f7c891b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774260641, "uuid": "ee5437f1-9c33-4791-a711-d7b5dc59ebd4", "value": "12288:ulTjYAtug15c1ervvo6OgPEEsswGnrHjXFza92:ul/YucsopswGnrHjXFza92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774260641, "uuid": "b6089c19-d548-48a8-afdc-0bc9b991d80d", "value": 470528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774260641, "uuid": "30339c03-bcea-45c4-949b-64dbc2dfd71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774260641, "uuid": "06cef96e-13ac-4e71-ae9b-fe5a8cb485e2", "value": "wshealthsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9fd515-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252131, "uuid": "8ef40e3e-ef7e-4c17-a3c5-2564603a595c", "comment": "Malware payload", "value": "0407fc9fd5e620e2b61012c181414b60", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252131, "uuid": "5f1edbff-8a88-4674-bf89-378b536e890f", "comment": "Malware payload", "value": "d24fbd4cdb4dec48793b304c6f35fdd9486a386435b3339d927491250a68dead", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252131, "uuid": "f28fd7d1-8c59-41de-9c9a-e3e0878c0d95", "comment": "Malware payload", "value": "72b1d314ba92c24c5185a8193df2635869a264de", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252131, "uuid": "325a4e0d-373c-4819-a783-1286d3ac2d26", "comment": "Malware payload", "value": "c827ede3fdd937bb6c99fb9a925879c697041c2de4efa5774b313524e2fc67e85b2eedbb96e6ce5431603c60c29a7177", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252131, "uuid": "3931c523-26d1-4498-8af5-5d5b3d0e91b5", "value": "T110D622B1A37180AAD038047C591695B8D9DC1C218F64EEEFA5E7FA4B65B02DC2381DF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252131, "uuid": "82afc274-bc68-4b37-984d-1da33e0fe15e", "value": "4d1397abb0dd1c0e248a008ed8b5ee0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252131, "uuid": "9515b5d8-d767-4aa7-bb68-88a8cfa32af3", "value": "196608:BeHp073Rf3N4zY6J7Nmssb3oJ9W3J2KARXL46ErkHhHpZFkkFwuuZ6HC4H:BeJa3xD+7ND03z3CRXL4DWZFkaHCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252131, "uuid": "abb5e6ef-b1ee-46f8-907f-6c79be31b7e2", "value": 12678144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252131, "uuid": "aa4d0600-411f-46d1-bcf5-12958ead8cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252131, "uuid": "7639b0f6-7c86-4867-8803-9cef962fd702", "value": "gh0st.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66bd5e9f-2694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774255424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255424, "uuid": "f8ad6c83-a309-464c-9a17-12d35acb7d99", "comment": "Malware payload", "value": "5c23ca2c0e159a51882d85f766fb1739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255424, "uuid": "5fbe565e-c185-4160-b0f4-7549956f4871", "comment": "Malware payload", "value": "d275abca286cd75af971d0459fdf1df37c7b19c514abafae5d0b04bf42ccfb45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255424, "uuid": "2ae68ed2-706c-4c90-b3b5-078d2014a163", "comment": "Malware payload", "value": "c1b32be991712363bfd4d51f6888d078491dffea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255424, "uuid": "b150ab67-8379-44e2-a049-bb03348fb4d2", "comment": "Malware payload", "value": "5e908dbb099380d9bfe79071ba77b1963beca5cad8488989d81a953b317433066957a5f983c4024c0a6cd194131fbf8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255424, "uuid": "d69ff1ff-5f1f-4092-b8d3-61f3b638a588", "value": "T1E8466C07EC9555E6C0AEE23086729253BA717C486B3127D72B60F73C2F72BD06AB9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255424, "uuid": "9f2a24ee-1649-4ed6-a56e-06100f9f6e39", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255424, "uuid": "49fc48c1-bcbf-4512-b6bc-b34f3b403ad4", "value": "49152:vLH/6MUKHqDZ36COkH1ccQFGBt7Gm+E5d3/p4440UVZcZvL/fe20jFlO5iUHcXTj:v4zF2GbGE51/pVDAc/E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255424, "uuid": "0c97f0ca-8178-4dd1-8356-970f27345263", "value": 5852160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255424, "uuid": "8b9746fe-7135-4ec4-b4dc-5103857f43e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255424, "uuid": "3a6e6040-2dd3-4942-95db-0262baf78806", "value": "SecuriteInfo.com.Trojan.DownLoader49.35852.26036.22232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4084d29-268c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774252145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "355b12b5-985c-4e8e-a8a2-cd53044de205", "comment": "Malware payload", "value": "2637dda9c3e82d44d6d321bd30b6a71b", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "0678bf87-167f-4765-895d-e718b3abef8f", "comment": "Malware payload", "value": "d340b6fffb83d27d86fcf5141d0ba7a2c5f65b843c73e818850bc8a52fbe997f", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "ff862ba7-cccf-40fa-a1c9-45ca1191edce", "comment": "Malware payload", "value": "4c4628baa7543c94ebf9925451cae8e6f475d542", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252145, "uuid": "1eba2065-f702-442a-8709-795e606f8d72", "comment": "Malware payload", "value": "ee9a19fa0806a342f168277d1c20a49d298f3a201aa443e35a6f43c01865912541f6f2be5525c7eed5e9ae4f51852917", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "0f457bf4-3049-4754-bcb5-1d20f4dbaa68", "value": "T18F51A963178281C3C81D16792147DD1FE46D87002BE48EDF8EC07874BA92E15772EB49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "ba51ac52-0e34-4f87-b5f8-e618bcd636d0", "value": "24:e9GSY5993opGjLxe90gGStzuiJY8VVERYEIYFJlaVGGSijQ5sQWmrW5Ap5ybjPA8:K893uGjLxW0Ytzr4YdgGtMc+p4b7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252145, "uuid": "537574aa-e950-4aaa-9b7d-d26b34528a37", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252145, "uuid": "ffc86c89-4e89-4689-9b32-8e2c06af6c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252145, "uuid": "6cc60c84-5341-456f-8e35-f6ff303a6318", "value": "load.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556232b1-26ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774278588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278588, "uuid": "a56884bf-73ea-4a47-867c-df988789e00b", "comment": "Malware payload (Vidar)", "value": "8321d590c4e60e24c7fe4fbbd159dde2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278588, "uuid": "e6059f67-8c1e-4aee-b71a-7593558d8918", "comment": "Malware payload (Vidar)", "value": "d42c918955a62ae3931cf0cdb13563c0e0cc47f0df7a58be2d21ad14c3ff3db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278588, "uuid": "7e875a00-e450-4ca7-b7ec-f670b9a142a9", "comment": "Malware payload (Vidar)", "value": "b91b1c9d7025902f8c199a736755de889e04416e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278588, "uuid": "fdb5bbdf-65fc-4ddc-9808-547c4add91ad", "comment": "Malware payload (Vidar)", "value": "19a19e9367bcfe19c3f0ff104980427da2f41b7a16fe7dc7ee1cf2223b6204145f47f7401dfa4035be8f1bcf32a243ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278588, "uuid": "82ad0fec-ac9e-4c41-bcf8-95b326c4351d", "value": "T196B68C43BCC461B5D4AAD2328DB552A17B31F85A0B3037C32F45BAB92E7A3D45E39394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278588, "uuid": "6a0a6aa9-2251-44a1-bec6-698f18bf8c1e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278588, "uuid": "d2dc17a6-604e-4544-bb1f-56f531459245", "value": "49152:JfXqvWqzRqGqXJlEhyNGQNphX1nMYPpmdEMAptMYgtX8K1:uWNn1MFuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278588, "uuid": "c04f7a23-ce53-419c-8403-9ea466f55a56", "value": 10485760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278588, "uuid": "bc4d49ff-b26c-40b4-8515-7cded27c6ae9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278588, "uuid": "482cc4a2-8551-4942-8ce3-e66d4fc030f6", "value": "xd42c918955a62ae3931cf0cdb13563c0e0cc47f0df7a58be2d21ad14c3ff3db4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f792d3-267d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774245762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774245762, "uuid": "e005e433-86bb-4010-963b-df0148196e07", "comment": "Malware payload", "value": "23ed59b021a3bceec795521566b440d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774245762, "uuid": "da3834c3-d23e-4236-8037-b5b9fd9d1bc6", "comment": "Malware payload", "value": "d52a2b743651e1447ecd61f28a48e1dda31b853485bfeba9c6cccc01da133b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774245762, "uuid": "ae2156a7-a2d5-4ff7-b122-218b96daba72", "comment": "Malware payload", "value": "9c6b3e7ace2d2749b4743ea2dee8e1b01819aedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774245762, "uuid": "b8654b05-6170-475f-9c5b-0c4af98642cd", "comment": "Malware payload", "value": "6bdfbf001d6988b548fa305b8e863913e25513774d052078d6b651888ef674e889aa7c3eab10ebbc758ede57ccca74ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774245762, "uuid": "e9446143-b22b-4185-bd04-6a2c7e2a2515", "value": "T182157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774245762, "uuid": "c625c7fd-20b4-4cb9-8c9a-4281e5a1cfd7", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774245762, "uuid": "04786bca-48d0-4caa-ae2b-bddc1e074bfe", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6hG:d/QMnl5YL7WzZyQRdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774245762, "uuid": "2e4da1eb-64e5-4621-88d2-864b4b44c363", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774245762, "uuid": "c9e3978c-ed19-49a3-b87b-34d00620f445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774245762, "uuid": "a449219e-ae55-47cf-b935-37b924e4de37", "value": "d52a2b743651e144.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea6ed0e-2687-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250069, "uuid": "fd5684d4-a2c9-4644-8638-d55c6d72fca8", "comment": "Malware payload (Vidar)", "value": "5fcb8ffed9dafd689eeace2982d61a1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250069, "uuid": "20527218-0702-4962-a5b5-0033ad0b2ff2", "comment": "Malware payload (Vidar)", "value": "d5884e06c00580043592863f443c391f05ca24d1720a17d5bcb4539a42bd5d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250069, "uuid": "d0893a5e-ddc5-40e2-95ee-84220c83baf9", "comment": "Malware payload (Vidar)", "value": "81f8f32903de3280d9c84361e182ddcb9226b5dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250069, "uuid": "390212fa-3013-41f5-bf79-83f1c06d4098", "comment": "Malware payload (Vidar)", "value": "090d686e61e814dd31e2a67370201bddb2562650e276a6566245e1eae29356e0cad5d7155e31651cbbe9cc5a655c1261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250069, "uuid": "f259019f-34d5-41fe-a5ec-2fb302cead99", "value": "T18DA57C07BCD104F6D06AD73689B712A27A75F80D0B3223D72E50AB792FBA7D09A75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250069, "uuid": "d98fdb8b-1498-4391-af60-f1fb5730f3a5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250069, "uuid": "49d0b8bf-7b3a-4354-afa9-cbe9dd144abb", "value": "49152:rlCKwp1kFh7soSNRR9rkphxcmRXBSZYhD/3SaF+7bYzHNJpD:rmbKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250069, "uuid": "f398aab3-bdb6-4666-8122-666740e5652f", "value": 2151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250069, "uuid": "bbfdb454-44c0-4b85-a084-f9b777e3549c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250069, "uuid": "3a2a2f1e-28e5-4194-8278-2ea48f1531ce", "value": "5fcb8ffed9dafd689eeace2982d61a1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca1a72e-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283137, "uuid": "58bef487-c501-49a7-b958-6dcacbd47224", "comment": "Malware payload", "value": "d25be15f7b84ade65f959806733b246b", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283137, "uuid": "a8f58004-bdb4-4f69-8b40-f451629763d2", "comment": "Malware payload", "value": "d5c6a196a16100e645c0b2d7938025419bd670138dfa02e06da9cd1a20acc60e", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283137, "uuid": "66e458ce-a697-4dd8-8fee-53b3307b7aca", "comment": "Malware payload", "value": "0a3201a8cc462b9fcc2f9ca039cc8931c9159eb7", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283137, "uuid": "c0973ece-ce27-4cfc-9bbc-dd7d5f5163c8", "comment": "Malware payload", "value": "0a008bb7322132284acfa7a5499680dc7a500717fa6486481a785e8099343d58f1b5ac6eaccbdccbfac36418e35a5cf6", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283137, "uuid": "9f45145a-5e44-4a02-887d-0406b55b7537", "value": "T161015054228B0F43CE6005759C450B551233C4576266A3CF1555D57A6C476BD2CFC348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283137, "uuid": "14bc6cd2-8b83-4fb8-935d-c9cd6b56c707", "value": "12:BNdAnI+NygR3ywTuLS/fgrLRsPdiK6AhcQKW7iQ/j+8Pn:tzZgURIWls1iEGQJ7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283137, "uuid": "935cc194-5e33-4a32-a4ce-c7dd57b57c87", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283137, "uuid": "5fa167b1-a114-4fd1-bbe3-2be49115dd87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283137, "uuid": "8ab43db1-cd93-4f25-be73-3274d396b08e", "value": "mossad_d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33677d4c-2687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249755, "uuid": "d5a87a45-6d68-46f8-84e2-6a1ccda48d74", "comment": "Malware payload", "value": "5d772d456c232e76dbd4aeb3a99e19f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249755, "uuid": "401da6c3-74f1-4721-b9e4-58cc4396d57c", "comment": "Malware payload", "value": "d5d2bfae4ebcdcca6193011145a75292a2d09523c7d5612099d3d88b78292e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249755, "uuid": "bcfb5781-3fc4-442b-b3b1-b891a9e4d79e", "comment": "Malware payload", "value": "cb49915186d1d4cc80c3d9ee9a99b6163098bca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249755, "uuid": "8ad6a147-df8f-493c-bfa4-b67577c935f0", "comment": "Malware payload", "value": "8478cf38a511199140fdb15ff81cacc2377a85b23c659409cdc4fe20cd878cbe8952ad6dc5ce467209059fee7fcaf3d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249755, "uuid": "3455ad65-ad93-449c-9421-e372ef8aecd9", "value": "T15DB59E5393EC41E4F07B4A7488694716EEF27C250B74A6DF0285F61E2F33AC25A76722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249755, "uuid": "af20f20b-b6e7-44d5-be0b-6989f58cc24d", "value": "74a352b7be38be736b4f1e0d51b66e8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249755, "uuid": "473140f6-7e30-4770-9917-e1f990db976e", "value": "24576:6TVGtHCOlSXNVKeB1vc4ZcVsof9gcvPAPtEGH5AyoV6FaTv8:gcticEVKevv7m9gcvYPbH5va78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249755, "uuid": "55635779-3957-4210-be46-4d4f5cabbccc", "value": 2397064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249755, "uuid": "18e9b40d-d9cd-41e2-8174-d58bc93db265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249755, "uuid": "1e0def81-4a24-45e1-ae60-7d18472496f3", "value": "5d772d456c232e76dbd4aeb3a99e19f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4a25ec-26c8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774278011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278011, "uuid": "793b1f56-2d0a-4db1-b9cf-404ba0ac1890", "comment": "Malware payload (RemcosRAT)", "value": "410dd496f3c18351cd31ec2559ae78c0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278011, "uuid": "771a6eb8-1dbc-4e40-bb66-fa9572d184da", "comment": "Malware payload (RemcosRAT)", "value": "d66524242bc07380bb42e57cf349f92fe6073b6b7b7b1ea43ca4e39b3797f91b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278011, "uuid": "7ca21a35-f030-447f-9adf-f78a38b814c7", "comment": "Malware payload (RemcosRAT)", "value": "3a118b127830ef8cafe6560d3cdff3d975325a77", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774278011, "uuid": "9e5e612b-afdb-4ab1-be3f-3dba2f97d5df", "comment": "Malware payload (RemcosRAT)", "value": "a5ae00890fd25ee3d2dcf700d89765d34719fc68af1af682905e9512c9f3f7c0ebdd5f9fecea1625db1259c37495e461", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278011, "uuid": "88098685-8c8d-4b8d-8cb5-8faf42d96291", "value": "T132B50193ED8F4717E0B21CC494D789DAA21FAB3D94F1CA5919227AB02C2AB1CD0F5DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278011, "uuid": "fbbd247a-2958-4704-84dc-4d6ffe250c69", "value": "768:q++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++K:Qsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774278011, "uuid": "2b600714-7954-4d21-b9e0-f87211fbcec6", "value": 2397220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774278011, "uuid": "ba955601-7e97-40a3-a3c7-5a96cddab6c4", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774278011, "uuid": "b5c45597-2707-48a8-982b-d550a4228abb", "value": "z11Pagamento23-02-26_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595e6a9e-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774229202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229202, "uuid": "1a0bfe5b-834b-4177-8834-048d208a4ded", "comment": "Malware payload (Snojan)", "value": "856b0b616a655b2d7b3dada62d1e88e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229202, "uuid": "eec2c706-1aef-41fb-a746-cdcef4a5ec4f", "comment": "Malware payload (Snojan)", "value": "d69d47703331c3a407d94dcc2404834f3d1d1692f900aa45cced4eb0baa1daac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229202, "uuid": "14d70d84-2a34-4475-94a3-a6135cf74740", "comment": "Malware payload (Snojan)", "value": "c9ad7b4bf0f4682e165c560fe172a3a84440f031", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229202, "uuid": "6ce66e2d-d304-4aae-89d4-5488c3ecc497", "comment": "Malware payload (Snojan)", "value": "1847ec714037f43cc2db98ccc5ef868a1abbc5112dd65d24f77dbb817ee52d97637bdaa06c35bad2e4dcaf5de761b665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229202, "uuid": "1d0d318e-e886-4f46-824b-c9d70f73967f", "value": "T123345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229202, "uuid": "9942255e-8c53-4249-b59c-48b109739d84", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229202, "uuid": "f3a5bbf2-7b42-4f3b-bc15-05b3a1129304", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/H/FnncroP9:wwDeM7iNEkgiOb31k1EC3J/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229202, "uuid": "be792ab8-516f-454d-9cb9-bd3d73172cca", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229202, "uuid": "0a656093-e422-4cbd-907f-d16333e4088b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229202, "uuid": "9ebd4f4d-09b4-4bf9-8ca1-2cf62963c675", "value": "d69d47703331c3a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de0ba64-26c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774276079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276079, "uuid": "39a555d7-0127-404e-8eea-29be8ea774fd", "comment": "Malware payload", "value": "6100234f12594e6b43083cbbaed56afc", "object_relation": "md5", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276079, "uuid": "c48b7185-ec66-4a2c-b216-7812622d81bc", "comment": "Malware payload", "value": "d7b4155323f6ef7b1f3519a29db8f56e4f2e5c8fcedb2577613cb46d61933c78", "object_relation": "sha256", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276079, "uuid": "22f0d8bf-cc40-49bf-872d-f50b3e63624a", "comment": "Malware payload", "value": "662eefc95e66326b914fed8c17f5eeb2ee27c982", "object_relation": "sha1", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276079, "uuid": "53e9b7cd-611c-41f9-8f26-973fcb2dda89", "comment": "Malware payload", "value": "0a5c570c639bdd7e66f2aea01f690c1a104dce59e3d7f0e6f760f1b6c17b0599967d145999424681a25ad13bff2d0b31", "object_relation": "sha3-384", "Tag": [ { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276079, "uuid": "c6bcb7f3-4ae4-4161-b8ff-bdb0660a2a31", "value": "T17767A112BF6AFEE54C7849156B3DFF39DA3209B5EC8238412360357B42C29B0758BA75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276079, "uuid": "fb2f2ff9-a630-4593-9ff8-57dba86795ed", "value": "49152:pTSPom/FGzCvOquWYRzVEv7oGjzrBKISZeuiiqTPGGCPFb7xzBuQctF/bsQbb3+L:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276079, "uuid": "75cd7991-bbbb-42fd-afde-5b551830c9af", "value": 30904520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276079, "uuid": "a2f63e3d-51d5-4e59-a2cc-0898f7b23f85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276079, "uuid": "a9a51257-413d-42b9-a7a9-126dbb126cc1", "value": "d7b4155323f6ef7b1f3519a29db8f56e4f2e5c8fcedb2577613cb46d61933c78.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5416ea8-26cc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1774279661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279661, "uuid": "3d7c1269-d87d-46d6-830a-e0243f99338d", "comment": "Malware payload (Formbook)", "value": "47c6c3ce7fff782874bf9f9dec9aac62", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279661, "uuid": "1c0e5b5e-1c34-42fd-8cef-75b9a253c9fd", "comment": "Malware payload (Formbook)", "value": "d9d788886bc58c979ea756cb990cd03ab489cf19af271847e30447e99c014c0e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279661, "uuid": "6a1f3e87-7c10-40aa-954a-8f7e7e23a285", "comment": "Malware payload (Formbook)", "value": "0b93fdc7d09920fc9312c4ae052bb8cb8748fe68", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774279661, "uuid": "56433a12-911a-448c-80b9-1b17a959cc53", "comment": "Malware payload (Formbook)", "value": "ccf8ba3d1f0f0462afc619c09013082f08d6a883ac4ab123cb8b645b6f90dc6105efd6f00919145cf2cc725fb2d3a797", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279661, "uuid": "44431360-1e01-4548-b305-7d9da2757893", "value": "T1D4845A61DE70172A0F43179DFDA00A1687BDD114593B50B2FAAA078D61066BCE3FEA7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279661, "uuid": "2c8ab3ed-8397-46dc-b285-a98c71483097", "value": "3072:9laYltYmltFltWXltWXltWVlQltWhltWnkSlzltIlWnlLltW6lHltWslVltWnkpX:7ptsyV4ONd1nOSliOFOXRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774279661, "uuid": "9bad2fb6-2001-4ad1-b298-b40698802260", "value": 400225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774279661, "uuid": "0f56fb84-61ba-4670-b3a5-eb68920f422b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774279661, "uuid": "308ac64c-8926-4d42-b028-a1e168eaebc3", "value": "47c6c3ce7fff782874bf9f9dec9aac62.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b92660-2689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774250725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250725, "uuid": "9e30d843-3f28-4838-ac1e-09a9f6cdfaf1", "comment": "Malware payload (Vidar)", "value": "63ed274ad84b493bc67dd55d8fa153c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250725, "uuid": "f672534e-323a-4cff-9816-495504edc01f", "comment": "Malware payload (Vidar)", "value": "db3243f73573d63fedc8edaf78db45e332c914bde7949bcb59addd052195ed03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250725, "uuid": "d29aa41f-992c-4092-8e16-882596d8204f", "comment": "Malware payload (Vidar)", "value": "ccb696b3fcb16ff91a17448a74971856b170305b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250725, "uuid": "c9381a46-8d7e-4565-84ad-e04f2d328432", "comment": "Malware payload (Vidar)", "value": "39a1b9b3d61bbc56e6a0ec0695822c736195cfaad3d47d27d10bab63eebb3d2b1532ad8362832c7e6539d2b867c54fc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250725, "uuid": "be437c31-fafb-454d-af72-47dcecf9e6c4", "value": "T12AA57D0BACA505F6D0AA97368CB762D27B70F8090F3223D32E916A782F767D06D75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250725, "uuid": "ee81d471-416b-4c0d-93ee-833c6c0b054e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250725, "uuid": "4be136c4-c3e4-4113-af81-ce38c685f090", "value": "49152:Y7RAOGV+bgyvQ0O/qKfcIPlZ8Mc+m7TZc5Pz:YltMEWB0Ik9Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250725, "uuid": "5467bfd1-8072-44ed-b274-743f090cb8f9", "value": 2248400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250725, "uuid": "71677ebc-86a3-4fec-8ae2-d1baec135068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250725, "uuid": "9db54445-fbd7-4ca3-9c38-6b6d09ff1b5b", "value": "Bootst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fb13fd-26fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774299181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299181, "uuid": "a805d4bb-3297-472e-b9e9-2298503ebf9a", "comment": "Malware payload (Gafgyt)", "value": "a6bb2a2cee93ee557dbe30eb30740b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299181, "uuid": "d0a217c5-41b3-4fbc-a63a-7dfb57e6f338", "comment": "Malware payload (Gafgyt)", "value": "dc1fb6850987dac160f0e7d2933080876c1ff14c081d29e80977f65cc5bd12c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299181, "uuid": "c0d21fee-f7d9-424c-b9a8-adb8dfcf167f", "comment": "Malware payload (Gafgyt)", "value": "938fbb2b90342ac28f50ab29d49fcc32978eb0c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299181, "uuid": "3bfda7ea-7ac2-4f19-b243-aaf81f6ebf91", "comment": "Malware payload (Gafgyt)", "value": "a2807886ab2254cba7d13e912f5a27554060376f077b48f9868691ae14206e51a9b70f3372264033e3230fc74278d488", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299181, "uuid": "5ec317f1-9847-4dad-ac9c-69548753a4d2", "value": "T13E44165B6E328F5DF661C636C2B74961E39833D722D1C685C5ACFA101E2064FA42FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299181, "uuid": "690e4ca8-3cb6-468e-a184-985a1f9159c2", "value": "6144:gTkJsCtDFelyDJdO18ddukmkbnwvDe3qv8Xjr:qizFdPwWqUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774299181, "uuid": "fdd0287a-e2e1-4828-8183-cca1c5d91b2b", "value": 255668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774299181, "uuid": "c953093a-2ccf-409f-a662-c957f267a737", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299181, "uuid": "f833c630-c8a7-4f6b-abcb-ebbf8f961c6e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f5e465-2672-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1774240905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240905, "uuid": "347665e0-4fc7-4178-b9a5-dac36fb2a8da", "comment": "Malware payload (SnakeKeylogger)", "value": "e2696febe6181e994ae3bbcff53371fd", "object_relation": "md5", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240905, "uuid": "520ed839-a9a6-48b7-af02-2f445890dc4d", "comment": "Malware payload (SnakeKeylogger)", "value": "dc31630436166d019ad9472db3b82f498ad0ed02d4cbd6a000d8b0dcee246e3b", "object_relation": "sha256", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240905, "uuid": "382d0495-360c-4784-b800-c05b0b3796a2", "comment": "Malware payload (SnakeKeylogger)", "value": "98c60bdac6af8bd00c44d22ab981c3f9a1d49377", "object_relation": "sha1", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240905, "uuid": "f3b9d942-422d-4cd5-9902-ddc15084f6ec", "comment": "Malware payload (SnakeKeylogger)", "value": "4e199ec388faee9a1518068422df115fc55ba5c9d14575fdb0a21d5ec5120044c0fd5e12246bee5dfcaf5b2bd3ce9c63", "object_relation": "sha3-384", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240905, "uuid": "d938636a-4a91-4096-bdc1-229052ea577d", "value": "T17B25015476A8CC03C4AB1AF86A62E17A13B55D9D9432D3C68FDD3EEB35E6700190A3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240905, "uuid": "fe09a871-d686-495e-82e5-9c00e84261eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240905, "uuid": "7988dff5-9546-4c90-b832-5917a384a1f7", "value": "12288:x4i6CxMhvXuHPub6HG9sb6tWDNII/MA22sgnTZU3/V2XVqBy17J0dCGq0qIR8frK:fMJ9b6HG4fZ22X2P6n11O6IyuGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240905, "uuid": "9442b3b0-8951-481c-be2e-4c674b3a94a2", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240905, "uuid": "973f2b18-922b-4543-917f-a1f68a14b9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240905, "uuid": "f22c493e-e453-4ea5-a229-ec2e9377e6c5", "value": "7c40815633530147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e053d06-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259141, "uuid": "c090c0dc-9805-45b7-8b9c-ed46dc51dd60", "comment": "Malware payload", "value": "2cff44d10101e08d268b6aaaf935c682", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259141, "uuid": "f24a1b62-0758-4be9-908e-a49fac1cf375", "comment": "Malware payload", "value": "dc5356639b7e6513979e87e60ff5099cefbfc2a6ba167f705723b8ea51c9e0a9", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259141, "uuid": "36b1f398-9d6a-4e2f-8990-e820538acdce", "comment": "Malware payload", "value": "7acb0a683144565fdae17913e849174e5c3ea269", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259141, "uuid": "6549e5a5-e338-40b4-8f8d-4577cbfb7510", "comment": "Malware payload", "value": "7b5668fb269aa549aa09163ba069565264d690b0abfc57189c35cf600f081b94795da501e8e5aff4d2bf415a46008d7e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259141, "uuid": "950f99c0-7e3d-49dc-b1dc-89561d977cab", "value": "T146C5BA7E4417DAFBA8474D13BE05632C607AD96C5BADAE2649530BDE108F30F9EC3249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259141, "uuid": "49b4c4f3-35be-4550-abf6-8c04fd851b07", "value": "192:8hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhb:Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259141, "uuid": "bdc3c170-7f07-4eb2-bfc5-abbfae925737", "value": 2550343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259141, "uuid": "1079fc06-0348-464e-8439-4f4b2516b375", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259141, "uuid": "6f3dff72-7ae4-4cc9-90b9-458a22bb5094", "value": "2cff44d10101e08d268b6aaaf935c682.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52cacc9-2694-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1774255556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255556, "uuid": "a19d2cde-ecf8-4290-a593-450944c8d062", "comment": "Malware payload (NetWire)", "value": "fd4805fa7ff642f047d98d738fd129ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255556, "uuid": "41443d9a-be8e-40ea-9d70-7fdf6a79e408", "comment": "Malware payload (NetWire)", "value": "dc9cf86ceacb019977da48abbf347e054a430a97ab28a96fa30305d2a2f84dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255556, "uuid": "91ace333-f33c-4730-afe6-9bca56d4789f", "comment": "Malware payload (NetWire)", "value": "472eaf55bf5f4b08c01bd8dd6bfcc36d4a0ff009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255556, "uuid": "b028b705-6e5c-4555-9d21-e8ce851a1447", "comment": "Malware payload (NetWire)", "value": "164fe6a056a84c4b0ab8e092296d36e67584ff2d17b8b0930e6f79c1ffe23080365b258912ce3767ec60f519321eaf7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255556, "uuid": "0d93d737-9d35-481e-a5ed-a33de4c60b61", "value": "T14565BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255556, "uuid": "ab4803eb-cb03-4625-995a-504bcce38435", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255556, "uuid": "be2f57ce-4c8a-4d71-b7e6-5922790a869e", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWY8:ho0c++OCokGs7Adgrd1f26RNY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255556, "uuid": "0324f24d-377f-4cab-9ebb-ed6f2d126fd5", "value": 1461074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255556, "uuid": "54e2df5b-eacb-4f8a-b101-e15f33cedbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255556, "uuid": "3e348da9-09a5-4344-93f9-61ffe199c8ca", "value": "2026-03-23_fd4805fa7ff642f047d98d738fd129ab_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daaccf0-2672-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1774240833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240833, "uuid": "86986212-8b9e-4a04-a36e-9c6065accf20", "comment": "Malware payload (Snojan)", "value": "af385e6523480e8f9ef1d58908f64c74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240833, "uuid": "e13dfa66-7a2e-4568-9061-25e622754984", "comment": "Malware payload (Snojan)", "value": "dce31ea84d4beab6a87f20cd7ba1a4d79ed34c351c9805b089a10c2d6a3bf228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240833, "uuid": "8f2cee1a-1ca7-4320-9733-f1dda2f6c90c", "comment": "Malware payload (Snojan)", "value": "b3444df174d1891a41ca666c769012f7da5b274d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774240833, "uuid": "83116d8f-52ca-4a5f-a85b-a43e5eb65c12", "comment": "Malware payload (Snojan)", "value": "63a72c1e90626389ebc2351215e81a1acf72afa02040f8e3e21b97777c7b8d949e084f07671638efddb3ca73dd040730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240833, "uuid": "2a410e03-3799-43fc-8f33-ed5c19bf515f", "value": "T15E345C20A998E4F3F8A301B105045B716E71ED39175ACA83E3D5EF7969A4310DB9C3BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240833, "uuid": "b0d96803-1a28-4c4c-9697-cb78eaea1bac", "value": "ebc6265200d8989371b723b2f52c43df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240833, "uuid": "fb5b2ece-c01d-44a4-8a3c-0f31550e58da", "value": "3072:sJ0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/L/FnncroP9:wwDeM7iNEkgiOb31k1ECbJ/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774240833, "uuid": "00d638be-a6d4-428f-8108-cc91774a364e", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774240833, "uuid": "6d4398f4-bd66-474e-a023-a27ca8864980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774240833, "uuid": "08f42130-aeb1-4d5e-a69f-6d2511e866e7", "value": "lnbcl8p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b49885b-269d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1774259217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259217, "uuid": "2541c4a5-e2b3-4b1b-9c9b-762abd80b0f9", "comment": "Malware payload (a310Logger)", "value": "0c3e97a7ca55727c57213eacf098ae11", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259217, "uuid": "957ec45f-2508-41bf-87bf-695075395e44", "comment": "Malware payload (a310Logger)", "value": "df6ae424e1eae01012b3777d26a83e768dad65b2866ad14fcaadcda12185411d", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259217, "uuid": "a2649ee6-2929-4af2-8a05-616a683187f3", "comment": "Malware payload (a310Logger)", "value": "1f4e6221ec1f37f3e9f01c6b08b204a299e9e245", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259217, "uuid": "e630355e-9447-48f0-9557-4a04b389cd5e", "comment": "Malware payload (a310Logger)", "value": "24ad056a3e5ce3e34b84d9642ffb6a7552aa27510b5504f3e006512c4921096770a1acdc00ac4d728fc56745196fe577", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259217, "uuid": "eeecb445-142b-4fb6-aad6-9f30ff05b88b", "value": "T19FB5B04335E91B8F4ACD2A12D0FB35F751D2CCF449B9796B7BE59C8888A80C4E4EE194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259217, "uuid": "ebb19d9d-99e6-40fa-906d-089425b8e3bf", "value": "49152:5Ls0WVe+/7AIdkEYvHJ47+BR6wDXqJLp8qYAT/UsZX:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259217, "uuid": "01652eea-c089-4bfb-85a0-c9abd17de3cb", "value": 2458646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259217, "uuid": "dae74113-b7ef-4c67-9026-ea7d763356ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259217, "uuid": "10fb409d-90e8-4fd9-aced-c64c8b5e1a1a", "value": "0c3e97a7ca55727c57213eacf098ae11.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b70e431-26f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774297603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297603, "uuid": "745ef68b-05b8-4220-ae86-d52ef2f880d4", "comment": "Malware payload (Mirai)", "value": "96977840306b7e1c0e28e7184e416532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297603, "uuid": "f3614193-ac5c-4d06-8605-c9a589c5b554", "comment": "Malware payload (Mirai)", "value": "e0579990cd6a7586888a7df83ed27ae9f271deeccb7b876d8ceb7691f5372263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297603, "uuid": "acadc0cc-0e52-4f9e-966c-c7d19a176a8c", "comment": "Malware payload (Mirai)", "value": "b69aa61c5e4c4ed4ebb5c5568a35301e97999a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297603, "uuid": "670c3bb0-b794-49ba-9656-476802f5d3a2", "comment": "Malware payload (Mirai)", "value": "03e62844a9860cce51bc24c7deca2e817a24799bbd36b17d3a7e886dee996deb22bf88bc8f91257fc19a4369e1cab9bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297603, "uuid": "01f6cde9-c8d5-4dbb-9459-a62aa56facce", "value": "T181633B41BC819A17C6D4127BFB6E428D372713A8E2DB3207DD256F21778B82B0E7B645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297603, "uuid": "799fd696-a477-4922-9cc4-de963683a986", "value": "1536:a6aDcQj9D+6jhUgyONlsCBSeSSWOPbpmsxo7vr:a6axxnVAylsCBGeOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297603, "uuid": "502eca9e-6c77-46a6-bd56-5121197f9fe4", "value": 66876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297603, "uuid": "13f7c670-31fc-4143-968d-a0e8d43d7635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297603, "uuid": "73164e0d-4ad9-429a-b92b-9187ae4ef19d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a0313b-2710-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774308648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308648, "uuid": "65bb266f-6f62-44b5-9cd9-5e966d752736", "comment": "Malware payload", "value": "8b9397ee00faa2a76d3db15080440028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308648, "uuid": "4b4021d6-8011-4a5a-90dc-4e91cc98ea6c", "comment": "Malware payload", "value": "e078e5e55d8239d7d07bede334cb404d463735e93cb946dbe9cf8f0fc04f2d24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308648, "uuid": "782eab3c-a2f8-42a8-89cf-7aa61bad4284", "comment": "Malware payload", "value": "e8598e2b1115b91eff35b5c60038666054748e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774308648, "uuid": "f692355d-fbaa-413d-802e-952de8d777cc", "comment": "Malware payload", "value": "865105b5242201a90d266dca7bc28902d4d4fd11e37ccbb9c8da708603a623f5a42690e8b56580758a0d666726bce733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308648, "uuid": "65f9ad4c-cd66-40e9-a749-bb52cd881f7b", "value": "T1E4060157E95D90EAE436D03CD2524126F6A13C984361D7EB838447972E733F8BE3AB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308648, "uuid": "87d643f6-81f0-4d17-a4ae-60e49dea7f83", "value": "1ee075b1d1ed328a7f5178978c941635", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308648, "uuid": "dbec92cb-5649-4f4d-86c7-d355b3f209ef", "value": "49152:K/OnYgQNOHBSYl1Vy6fl7uRcCuVYGF1tjre6x5Sd3VIr2KNV40Faw+ytD:K/OvHBSYlO60RzurFjrJYe2KHaw+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774308648, "uuid": "5d704681-30c9-4c66-a50e-3709009f986b", "value": 3670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774308648, "uuid": "92ceb736-fc37-40d6-919b-12f8cf4738e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774308648, "uuid": "d2e0e4d8-ab7b-4e50-9dd7-eb2f0f388811", "value": "rwz7v4xos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ff4027-2696-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774256280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256280, "uuid": "74454870-b597-4084-af2b-67a9c6b31800", "comment": "Malware payload", "value": "4ff87860b8bc5919e448b4632d45c84c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256280, "uuid": "268d992a-3692-4c23-8066-3f6607874771", "comment": "Malware payload", "value": "e1807de83ae2a00c2f641cfa2a8ba781e16a6d5a2fa496c2ba6975abf9bd2631", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256280, "uuid": "a3ba4fc8-5eee-4f9a-965d-6ecdb3852a8d", "comment": "Malware payload", "value": "4aa97d14455bdcc1504dd4a35906a7f29e67ffef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774256280, "uuid": "162db8d2-a55f-46b7-a59e-0b24f093b787", "comment": "Malware payload", "value": "c2c826e16989f94f5bd1a3779c9dabe41f4ef8a1aa6ca9d4bfd5dd37dfd254a937b8f25c9213836ef06e656df314274f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256280, "uuid": "a02de47f-da6d-4ec7-b306-27b102a0338c", "value": "T145925CB512896C79FBD0CE39AF3C6F4DADE8C2C42124E3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256280, "uuid": "c2d9ae50-db11-43cb-b4b3-c884cf8ee4ed", "value": "384:3FcuQpWx+BL0SWL0gCzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:3F8i+BL0SI0NzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774256280, "uuid": "dd5a3e66-ad69-4ffe-a9f0-47458878c4ff", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774256280, "uuid": "f069dee6-7ead-41e5-8364-eeb81ab92a3b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774256280, "uuid": "a22e6ac9-02f7-4088-8ff9-ab0c8c3c7765", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef972c14-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283141, "uuid": "efe3520e-b24b-4929-99e5-38559755a238", "comment": "Malware payload (Mirai)", "value": "27e68b4b5fa04ce1e1d5ec005014782e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283141, "uuid": "15dc1cec-8feb-471e-bd3f-defc99380589", "comment": "Malware payload (Mirai)", "value": "e1a08a1912aa39a4866980590be9e8b3c44d09efa5481e4a92672ef7f5be3f26", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283141, "uuid": "00c994e6-1573-46e8-9b91-c236dc0c2aa5", "comment": "Malware payload (Mirai)", "value": "677e1d8ecd66b8ff21376705c264ccdb04a8c640", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283141, "uuid": "fe9c74c4-36c4-4238-987f-28e9a61612d5", "comment": "Malware payload (Mirai)", "value": "6c1ad36fcd0fd58050c99ac42d7309cd4d60b28e6d8bbd88d11b87f3d322de6c3bec5ef35cf8b4c274e70eb89823182f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "jackskid", "colour": "#7F308F", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "rctea", "colour": "#E79BDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283141, "uuid": "07cf3881-5ce9-409f-8de6-947d5b0da016", "value": "T194C44A59A8419795D1C02BBBFF1D934873131B38E2EFB1069D196B246BEBC1B0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283141, "uuid": "3645b248-1392-44b4-9fad-47163fb53f90", "value": "12288:ZrtEk8vkd8OqnX/HCdq+uEPKdRUMtgLCescYvhF5na5E32g7jDdHmRWl:ZXd8OE/HCJdMtAYFc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283141, "uuid": "f783b580-6039-48a8-bc91-3c6298def8a9", "value": 581016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283141, "uuid": "4c4385b2-74ab-4314-b125-be3e23cdc6b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283141, "uuid": "900a83c8-79bf-4ad9-a8a6-68ea182db69a", "value": "5_187_35_166_443_feb22_2026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b4a595-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283148, "uuid": "08c50ec3-3b7c-4457-bd01-3dc71c4aa8a5", "comment": "Malware payload", "value": "26315e986866337a6425a062e94ffabe", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283148, "uuid": "cbf49cff-232c-45a4-9042-568eac5150dd", "comment": "Malware payload", "value": "e1adf204d8d2c96885a7cdfc1befad23e6f1bee15940f2702cee34071822e197", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283148, "uuid": "3d83f830-879f-4443-b7a6-6115524b9fab", "comment": "Malware payload", "value": "40a98ec7ac532cf40a0cb12217ef3de6ba13d34b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283148, "uuid": "d3efc252-ae0f-4037-abea-95ea92f99d13", "comment": "Malware payload", "value": "e8b8476c59344d2a8d7b7873d434084808be90caf5e1a0a200d74ae61c73688996503c06d9a449187baa1829c3b7978f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283148, "uuid": "096a476a-c37b-4442-bd7f-9a50bd38d449", "value": "T152A55B66F801A961C4D4667AF65EC2C8331313B8D3EA7106AE05C73469DFACA0F3E756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283148, "uuid": "97d27d82-45f9-4089-b270-363352b8be09", "value": "24576:SFMU0hdx9Y2s2gx0SKQoVraeCQfTfFktUn42CtAgm9OdPhHzVa3Yt2znFT:sx0hpj/waYdzV6td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283148, "uuid": "5e9aaa3f-dc4b-43bf-88fe-71a55e19635d", "value": 2080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283148, "uuid": "bdae2662-f353-4d93-84df-60af44336c35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283148, "uuid": "5de9c915-e15b-49d9-ba7d-dad09c65bb92", "value": "libandroid_runtime.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ade0f2-2684-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774248577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248577, "uuid": "17fbb36c-f68d-4b2d-b584-3dac458d0b70", "comment": "Malware payload", "value": "72896c408797f0e9374e057e02303b1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248577, "uuid": "4020d446-0ab4-4fa6-bb2f-f3bb6842b890", "comment": "Malware payload", "value": "e1bc2702899765390bd006b186a4c1fdcda1fdce643d04c76cc3db4e680e9e83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248577, "uuid": "9a7f66ea-630c-465a-a905-379167268657", "comment": "Malware payload", "value": "b23772c0d5f11d8631b72b3faee2b13f04ed6415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248577, "uuid": "cabbe05f-a381-41e4-ab97-63bb3fd17622", "comment": "Malware payload", "value": "80c86df71e71dd6d2fddbeb5c26be6c41d7070a8689cd214f6c7ac2148580d47db16ff9aceed62d353a05fe0533ee5bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248577, "uuid": "22fdd925-7abd-4278-a355-ccbeaf0c176d", "value": "T19D15336755860FFAD7A1AA39D00814CBF3B8EB751A7D934921F893710683AE3D57DC20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248577, "uuid": "6fd83424-577e-4aa0-a7f6-04169cf043e6", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swQ:EpCKabVQ+9qlNlpjN8HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774248577, "uuid": "8d93d6f2-5e65-4a02-bb65-a0242bb2187c", "value": 933628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774248577, "uuid": "d3181084-1889-4b20-be76-467c8d3b0dca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248577, "uuid": "0d02415a-db66-468c-b4b3-a58af1c87c13", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb739e0f-26e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774290382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290382, "uuid": "0e9619f0-0d73-4c3b-8ece-09feb5bfa663", "comment": "Malware payload", "value": "ed1fbaee795b01a7df6a777d8e31b53b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290382, "uuid": "423f7a2a-0899-40da-969e-96cd2683fbe1", "comment": "Malware payload", "value": "e292d45072e4c2569785cbe4ea66daa355af74295bb8b266d5bfcf18d816b26b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290382, "uuid": "cd618109-a69a-4588-9d94-5ddf50d903db", "comment": "Malware payload", "value": "e003555b0e27cb92e2391ba72207bc6303614408", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774290382, "uuid": "5269f8d2-460b-431e-8656-cdd709ae1ec5", "comment": "Malware payload", "value": "867610ac2e79df983daf52802b5241482d354a887e421a1d363139f0db124feb45336d2d81731b1d2073cf6cdd8d6b8e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290382, "uuid": "e724d253-2071-439c-b63e-99fd7f7014dd", "value": "T18E94E0067F44E29AF716CA7C1947C2AEE3F1DAC1C689DD2FA1151A06B135C92087F8F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290382, "uuid": "14415740-b8a6-4885-83dd-40337ff07a1a", "value": "6144:JtXF48ICqLR+Fl75hpuOLY99MZqG0zvlqrCVTjvSkluKdb6fd2AkfuKk/TjsUugC:n148IC6snAQqcm1zuOSwu3slzCJcsmRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774290382, "uuid": "21b64039-fdbf-47e4-b85f-0bd3a137eb84", "value": 423732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774290382, "uuid": "dea15c08-ca0f-4b47-b258-a39e082b530c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774290382, "uuid": "806ed769-d148-482b-9b19-48bb147eaf5d", "value": "Idiot.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa847fa9-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259537, "uuid": "33999bd0-7a01-4031-a515-43bc3b2e7f3b", "comment": "Malware payload", "value": "0e54628ea332bec9a12705b76a729a0c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259537, "uuid": "6bfe6660-7d29-4303-b68a-783b38f8f3e9", "comment": "Malware payload", "value": "e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259537, "uuid": "a0200bd1-9f44-4406-b94b-d5e44366e29d", "comment": "Malware payload", "value": "0909303dbd19c30aa066bfc98204731df4e12a85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259537, "uuid": "d0abcc29-de31-42ba-bb06-578cf9d34a39", "comment": "Malware payload", "value": "1b308f30b95500cb76c0898b0a9bd93e11e431d2bbc10f51c8eee54c653583afae846fae947edf0992eddcc4ae87b5d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259537, "uuid": "b97c0324-ce97-4c38-982e-c8d843f3fd88", "value": "T10641139E60F45069E6CCCF05F4F54DC863079EA861DA4A3AEEC10E6B8D8AD54B019F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259537, "uuid": "78b25368-cfca-4940-8edb-27bb0887813c", "value": "48:pkeQWbg72F1+XzSJOLIugeR6y3o7ZpO7gqXm+c:2g1i9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259537, "uuid": "8dd23024-c390-4dc1-8a86-fc66488b99ff", "value": 1929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259537, "uuid": "338485a3-28f3-44d1-8312-c45e18b516a8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259537, "uuid": "e6c276ac-744d-4c76-885a-a9b72be6984a", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ed7f62-2675-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774242315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242315, "uuid": "bbaf36b0-b900-44c4-bef8-72a628292667", "comment": "Malware payload (Mirai)", "value": "77d6cc5ae25052613256f1321e494da5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242315, "uuid": "f8584d8c-a17a-48cb-a42a-847929dd2c9d", "comment": "Malware payload (Mirai)", "value": "e52c35dc555f10fdb05261299532e8b08c8748de314730bd5e4cd00129f3d917", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242315, "uuid": "b8a46e5f-3733-404f-8d57-20763c518ebf", "comment": "Malware payload (Mirai)", "value": "236b880c003504bdc328946912d5ce4eae49c66f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774242315, "uuid": "44910d57-23f2-435f-b3a5-10689c0c2f34", "comment": "Malware payload (Mirai)", "value": "e23e0497f5fc36a48460c93a846b1740d90c9931212314a74f0553edcb1e0a937816edbf5950337417de5d2d4a267141", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242315, "uuid": "ad1cfda4-93c9-43a1-8881-341b04a5f2af", "value": "T10E93F749FD406B10D8D635FAFF4F024973934B6CE3FA7201AA245B2523CAA6B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242315, "uuid": "06c92298-edfc-4f7b-b813-0fea4626f9f8", "value": "1536:wqnZy8D4zgUdtS0tFbvacgzafVAweBuqKlUI9HiWNRIbT2gZ1Y8n:68NUv5nTacgzafVAwe4BNRIbT2gX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774242315, "uuid": "ae5f4018-7bfb-4c53-ae91-c98199fdfcd2", "value": 93252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774242315, "uuid": "9d03fb06-85e1-47ba-82c9-44a5f5d3e124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774242315, "uuid": "3dc9d1d2-9716-49f2-aeab-f88ad9df0a0d", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60536b47-26ae-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774266580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266580, "uuid": "cddfaf0f-921b-4488-ab44-404b7ae63a44", "comment": "Malware payload (RemcosRAT)", "value": "70d341ba9382ebb640815ba751bff3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266580, "uuid": "bdf36e75-fc8b-4cc3-a5da-159858a1b803", "comment": "Malware payload (RemcosRAT)", "value": "e54e5dc4c2ff74bae064224b14beddf4b5199c1f06fb7344ec788735a0e378d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266580, "uuid": "6f62db7c-e28d-4df5-a4d1-eaaccb5c82d1", "comment": "Malware payload (RemcosRAT)", "value": "27ab3977fc2900c89c21c1685c9a2b7380b6fe51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774266580, "uuid": "1c71c4c8-31da-43f7-9ae4-7619709ad7e9", "comment": "Malware payload (RemcosRAT)", "value": "6c7d3bcec3270409f11782ff7714c03bb6e88fe7d4f51e80cb6cc1c938179ee50132d4ef5d7ee079bc44387963dd74ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266580, "uuid": "edc26884-1fbc-45fc-990f-9bbdd58e17ef", "value": "T142451229B39CEB02D4EB57F52B21E07907B81D9EDC95E62A4FDD6CD73962B442804383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266580, "uuid": "a80dcda6-e7b5-43b6-89d5-8b720e068099", "value": "24576:uRBx+MJ4b31vikZlLeaLuk98L5ZWkMPczt7RDEQI:uRBx+MJUbXi1EX2TgQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774266580, "uuid": "bc24aa38-b8c6-4871-b7ad-4df6571dc158", "value": 1225728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774266580, "uuid": "53055acc-70b1-44e1-b269-d2b37f2273f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774266580, "uuid": "b841de32-5e61-48a9-84be-a3a945825e4c", "value": "Teklif Alma-Elekt Malz. sip. 23032026 AMP282104-2 D\u0130\u015e\u0130 2P() 2000 adet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486f35df-2685-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774248931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248931, "uuid": "12f415ad-7c4a-4fcf-af87-01d2490484ca", "comment": "Malware payload (RemcosRAT)", "value": "9cd351d4e80c721e732860ee4668436b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248931, "uuid": "6ff19c63-a7f2-4490-82d5-b777b58eb1cf", "comment": "Malware payload (RemcosRAT)", "value": "e5b001a496a22bda7440d24285e8b90aebdd3c95362cf428b2686a01b56ae885", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248931, "uuid": "14b2be63-cfef-4357-9c62-6eb59c0be31e", "comment": "Malware payload (RemcosRAT)", "value": "bdf25efca0e40fce348eeff63fddfc0ae329358f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248931, "uuid": "117ac19b-ddba-4325-bf82-6dcb1774d551", "comment": "Malware payload (RemcosRAT)", "value": "23e928bbeb3b43e0d6d505801989a6755be994e46dd73fa65c3dcd8b8acb801c801e3a634c6ad74b92bcc4c046968e05", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248931, "uuid": "9174e957-5366-4144-add5-2235ace3fa82", "value": "T1BB4481BC91A846EB1F02E58EDF0FC3AEB245C8F2062E7754153A3341CA3516AF5A7C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248931, "uuid": "e8507e23-069d-40fb-8207-d66183a83ce6", "value": "768:0lFEcwG6eQU6pNyelLgGpwG6eQU6pNygFE0J2lURoJdonSzMlLgG7RbzB/7/FC4o:0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774248931, "uuid": "685b873c-98f5-4852-a0ed-cbdb565fe04e", "value": 254501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774248931, "uuid": "4f9ec300-8d25-4872-886c-f9564ea18aa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248931, "uuid": "cced380a-49bd-4203-bc19-dd6f5aee9bb6", "value": "goodgirlforbestgirlherefor.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba79200-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (FlyAgent)", "timestamp": 1774258009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258009, "uuid": "32424367-e4e1-489e-a4cb-96609b27ca18", "comment": "Malware payload (FlyAgent)", "value": "2776df27828b5fdb481b31a1b5e0cc1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258009, "uuid": "370ec873-0fe0-4390-9ed9-6019ab56689c", "comment": "Malware payload (FlyAgent)", "value": "e76255644ad405934bc076a0051059420918102e69a62b32ba1d5afaa5d693fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258009, "uuid": "225046ad-82d5-4d86-a561-b92118ff576f", "comment": "Malware payload (FlyAgent)", "value": "788a71c509ebaab3cf681f1e9920372a910802d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258009, "uuid": "faf35a07-dfcd-4d16-a72a-84afb3da9eb9", "comment": "Malware payload (FlyAgent)", "value": "63cc19f7e7b10d96744ecd1c9e4d58ba81282cd60927b1a6e5eb229bea292543b3dbe5afb32e1c38c742c7d81f81e110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FlyAgent", "colour": "#B7D0AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258009, "uuid": "7b2a3306-a17f-47e5-8e59-a3a8691854ae", "value": "T14A658D13F292C0F1E61C227124FB6339BE749B450A71CAC7EB95DD791C32691AB6720E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258009, "uuid": "a9bfc2b6-08f1-4755-bd69-2592cff09911", "value": "96168daaea09d47f72ce3d8f6c24312d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258009, "uuid": "041cb44b-c582-4bfd-9208-9de379ab2c4d", "value": "24576:GH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5QL:GcallSllG4ZM7QzMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258009, "uuid": "27508355-eaa3-4ce3-9785-3b61bafece3c", "value": 1437844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258009, "uuid": "3e47be1a-0ab2-4688-980c-e9fc22db7b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258009, "uuid": "c4e83c1a-08f7-4a06-84b3-77b46ffe0272", "value": "e76255644ad405934bc076a0051059420918102e69a62b32ba1d5afaa5d693fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cde150-26c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774276057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276057, "uuid": "a324552c-d363-4d05-ba0b-306e8ab062d2", "comment": "Malware payload", "value": "1e6b601f733bc40eaa58916986bfc5b9", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276057, "uuid": "22c57397-5074-46a5-aceb-b0bc91dcf5ef", "comment": "Malware payload", "value": "e8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276057, "uuid": "961f3b51-b4b6-4090-9693-e624941e71a9", "comment": "Malware payload", "value": "704119320f7ed10dc7707833218468d455d3c5fd", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276057, "uuid": "b51663b2-9934-4465-8176-9344c9c7ed40", "comment": "Malware payload", "value": "2c9f964b52cd42146b49711c595de1745062ce59ec1eae1a928976b9887727d56e31ef88a552b67a791c4cfd27a6d75b", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7933504038", "colour": "#A335E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276057, "uuid": "1da51580-4eb0-4099-a258-3cdfce502c46", "value": "T1BAB7AE12FB24EEF0C4AD0639565F5B208332086D9F83774113D4B57AAEC66B03EA765E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276057, "uuid": "e0597da5-f8b4-4d0e-8acb-8a5fe59b7c7f", "value": "b616aff629f4e795cbcc28bc3965146b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276057, "uuid": "6b7a29d2-8d39-4a12-8959-2a353a897c0b", "value": "98304:Kf7OhRY3fJ2oUBR0YHYyw/9nVIY1gBb7PFxV/x5CiV5wpDDNkfwhQbalZLCwpoku:gqsUBR0Jywl+Tb7PFxVpYiGDyIhF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276057, "uuid": "a3891a63-13ea-463c-97f8-9b5825efeae7", "value": 48626361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276057, "uuid": "29606f8a-ad21-4be8-a5aa-74873a8f7a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276057, "uuid": "769e8b7b-a94f-4468-885f-157494a4cad3", "value": "e8b633dcad173eb41ef02686b46779a4a0e53df7f6c63039a798f2db5eb83afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b28901a-266a-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774237232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237232, "uuid": "2a7f2bf8-a70c-4cda-94f8-7b022888a822", "comment": "Malware payload (Chisel)", "value": "30046d420676ada78c3376e6100880ef", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237232, "uuid": "09aa6dee-30b0-4505-88a2-695ee240a9e4", "comment": "Malware payload (Chisel)", "value": "e8b64acacdce1f67649690b93a8228ca90b51661e8f094a2468a9c86be2b0620", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237232, "uuid": "bb273829-c18e-4173-8d41-f0fa3a3e3986", "comment": "Malware payload (Chisel)", "value": "419b7ccb9be66bb27a1dccdde6eade4d123d1643", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774237232, "uuid": "f6be1e2d-c6a7-4123-a390-1ea826d25d26", "comment": "Malware payload (Chisel)", "value": "5fde08d06604d3e6c73411c4aac15c4857aa0597a910bf7dcf35da3adac208173e1249edaedf8542dba4c8645ae00f81", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237232, "uuid": "0fbdf6ef-3840-464d-af7d-0f0db4732c92", "value": "T18D2633A8D66BA012BAD23A2C409740A475B50CB4F8FF97CD738754B1543B4188BBF63B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237232, "uuid": "7b6ac229-7b22-4957-89c4-0a025225b120", "value": "98304:VUNNa0bz/t/zHQP27+50HBVcEs0wZAGPfrOCyZu9e8k:VUN80btzHQPq+50hVcEaKa9xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774237232, "uuid": "b67c0993-4ba6-44fa-a0f3-c05310c5a63d", "value": 4465476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774237232, "uuid": "e6f4b5b4-4e4a-4778-a513-77d2251d792c", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774237232, "uuid": "a792b519-18be-4a5d-b3d2-d89f7df692da", "value": "chisel_1.11.5_linux_amd64.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c06fd5-26f5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774296998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296998, "uuid": "007a0dbc-e295-4036-9bca-e08c352e32eb", "comment": "Malware payload (Mirai)", "value": "99b5020d3bfd30aa57460ae4978386ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296998, "uuid": "62f886dd-0785-4179-8322-6a1f50fd1b2a", "comment": "Malware payload (Mirai)", "value": "e901a9eaf5d76b184407ebd67385e2a8d082aba71d7b3bf2ac3d8578b1421d7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296998, "uuid": "2c4f4145-37ef-4307-818f-38240f4d8198", "comment": "Malware payload (Mirai)", "value": "0409e8de9ed8d0d78f60c686172baf321f59d4d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774296998, "uuid": "cd0d4da4-0191-4809-b118-5fffaae1ceaa", "comment": "Malware payload (Mirai)", "value": "50acc17e6f30889464d41c08d1fda18f7210a778ca2e126fc6ea69c69fc990f4d2001ee9281cdd699fcd844ae1ba39f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296998, "uuid": "6f84dc0e-560e-449a-9955-37dd4f530014", "value": "T1CEC31859F982AB12D5C625BAFF4E418933531B6CE3EA7202DD308B3533CAA5B0F76511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296998, "uuid": "c4e2ae64-5208-4e00-adcd-a995190f3d1b", "value": "3072:czOk9LHhq9x3VAraISaKUrcNFHtbf8c34mL6jWe:+U9x3mraISaKUgNFHmcomL6Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774296998, "uuid": "936ef564-3530-46e5-9150-13da412d426e", "value": 120292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774296998, "uuid": "63ca7351-8937-4eb9-afba-53884ae6a2fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774296998, "uuid": "2445eb2e-b09b-4e5a-8fd8-9feb8a8e52db", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e80afd4-269d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774259168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259168, "uuid": "a5daad43-a96c-46de-8912-bb94c93a9035", "comment": "Malware payload", "value": "1e6053092f0d3cfd9bc087f15c04a9ef", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259168, "uuid": "bc2dc19c-27b5-4973-a917-b5b4a0d9cc87", "comment": "Malware payload", "value": "e93eeaa551c7f8fe813fbc699b82ad738e2d6a38c42e0e80a092c45c20f7f133", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259168, "uuid": "ae4d765f-d7e7-402a-8fdb-d5bc9411c65f", "comment": "Malware payload", "value": "425b9283c0a9b3a7a3bc1278510d1d975b2e9541", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774259168, "uuid": "bf842ba0-d364-4909-abf1-bf45019ec21e", "comment": "Malware payload", "value": "63154d9751b03118176f2a60e6fafc94254979ffb4c3e38fe4054c24b1cd94e2640e19d866bec7aa691244df9af1ef0b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259168, "uuid": "ac04d167-fbb1-4e19-9a80-ccae3b998557", "value": "T1FD7596A72B43C4248D3F525B65863707C6161B8578E256E8533389D3CF6B04BEB0EE6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259168, "uuid": "df807c99-6b69-41cc-8c59-63f1bf75d7fe", "value": "768:Hllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllx:qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774259168, "uuid": "b4f4daed-c351-4d96-94b3-b80e9852737b", "value": 1701342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774259168, "uuid": "6e9b58c8-acd7-4870-be24-ca5f54f93b95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774259168, "uuid": "7b77f2f1-1911-4934-8aa3-d627a8627744", "value": "1e6053092f0d3cfd9bc087f15c04a9ef.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a253778-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774257980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "81ab9976-9e4f-4014-aee7-d87bbacfc184", "comment": "Malware payload (WallStealer)", "value": "a0aeadba1585a733032792862bbef517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "de10e8b4-c2d7-4628-91b9-0dc9c4e2948c", "comment": "Malware payload (WallStealer)", "value": "e98960c9ae301c24a5b6d14719f09d9e9e5fedc9719004cfc8817da8ef603bff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "ecbcd8e8-5420-4d38-800a-64a1bd2371ec", "comment": "Malware payload (WallStealer)", "value": "5489b60f0959540ae2024aedccfad401ae964c27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257980, "uuid": "8a5bdd4a-6e87-4ab8-9d57-fcbdda1510ba", "comment": "Malware payload (WallStealer)", "value": "c2e8bed30e41f4fff8a6dad8e03e8e3e0825c9dab6484638f6471c5ec0fbe93f9c957e18eea846c99a5479edf5f1d280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "ed8590b8-597c-4d37-88bc-626584d232c0", "value": "T11596528FB2748613C8A263B5B2063572BE2BD435479983777CEDE435319F0BE4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "af6f8302-f91a-4db4-88b1-4eec6325974d", "value": "2c1853915d316a65d08a8dc489aff101", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "662aead8-667c-4a99-ad7e-119acbd57ae8", "value": "49152:4B04LlmO0g2YjOjROxXe0oAlhgTHx6ZDLvT28C7PxAEyFVpP6le921UWoEagZ41K:4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257980, "uuid": "66cf855b-e868-45eb-9ae9-6c7b1ab97bc6", "value": 9176064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257980, "uuid": "03f68b51-2fce-46a5-aafd-06339d046c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257980, "uuid": "259c89ce-f842-48eb-bf43-4a97f3af21aa", "value": "e98960c9ae301c24a5b6d14719f09d9e9e5fedc9719004cfc8817da8ef603bff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b333b673-265e-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1774232360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232360, "uuid": "69101612-6435-4655-aaa9-2c539515be5e", "comment": "Malware payload (RustyStealer)", "value": "8c217797ba8802124dadf6c2e1f4a499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232360, "uuid": "2e0f2999-4880-46e1-b219-8c425486aa3d", "comment": "Malware payload (RustyStealer)", "value": "ea26d6a614701b039394bf7cf50b7cf63ad98fb90c0328e5ffd87ccdb9816be8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232360, "uuid": "c84011f8-f979-413d-a71b-1288c3c97dff", "comment": "Malware payload (RustyStealer)", "value": "d592460e4ef64946b4c8f673b778b8740ce3e4c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774232360, "uuid": "7cf65979-3c41-4890-9cba-57af245215e5", "comment": "Malware payload (RustyStealer)", "value": "0ac20fc47120ec5d7cda5cf3ed1254664dd1bef7e8e044adb01ab9ffd5ad0cce3773a45fa053b720bfec1f1a3e887e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232360, "uuid": "0bb29080-9dff-4779-b682-0fcd6c1c165c", "value": "T1BC842B25FAA594ADD06BC07582968F71793270DE0B356AFB118153383F28EFA6E3C354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232360, "uuid": "5cc6ee36-8a33-4441-a090-ea121d813bb2", "value": "b20318f9abf3c4cce8e970caedfae58a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232360, "uuid": "be7d1f34-1ff3-4427-a858-3b3d4567b037", "value": "6144:V1AB5gp7+ZJD2FyoL6sFyQlyEHECoQGNfEjk:V1e5gleWemZRxGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774232360, "uuid": "08739072-f173-4960-a465-386f724daa1e", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774232360, "uuid": "3c1de70d-d6ae-4ee8-8f2f-e18978bad242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774232360, "uuid": "45eb61af-9818-4bff-8aa8-814f6c6992c6", "value": "ea26d6a614701b03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a6c356-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239959, "uuid": "19bab5b3-19c1-4f6a-a061-6772eb3fff6b", "comment": "Malware payload (Chisel)", "value": "e12f9385bd4167776581bc270f14e76e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239959, "uuid": "0e80cb2d-64ff-4243-95dd-ca3e74799a18", "comment": "Malware payload (Chisel)", "value": "ea29e9c24380765aa6374c22e9ef0e0e8740eb54d4f0606403aaec4a42f6705d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239959, "uuid": "1c41a07b-f9d7-4a66-9135-87d2eb7289d8", "comment": "Malware payload (Chisel)", "value": "8892669e22b9476998332f14fb9b8b24df48e29d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239959, "uuid": "8cbcce77-5cc7-42b1-90d4-30cb8eb41741", "comment": "Malware payload (Chisel)", "value": "6e9bb08a773220171d2a66a8d86a4f03141a5128192f221cf450075ca41c27562dab0e440cb4626919bb934ba3c1a3c7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64", "colour": "#E2E088", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239959, "uuid": "d6179d26-e07b-48dc-b86a-979283fc81fb", "value": "T13606337BF292E058FF7BD28C4738015856C56C78E19AB16EC38A571160890FE3E7A8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239959, "uuid": "32db93b8-8ba0-41df-9d8b-526a7537150f", "value": "98304:j5zxDzrxYtSC6mfxQ/ET9FKjB7tS6wTU7R99L98jEaZ+7:9zxDBcSC6mfxQ/EJF/U7naA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239959, "uuid": "bacfcf33-cd27-43f3-a9c6-f1e678aabde3", "value": 3946843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239959, "uuid": "bbd9f6ad-840d-48f8-810d-40b052515b21", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239959, "uuid": "437dac81-5ad7-41aa-b389-656075639984", "value": "chisel_1.11.5_linux_mips64_hardfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d537f14-26b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774270816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270816, "uuid": "f449f112-7687-4db0-bb71-c5b5843701f6", "comment": "Malware payload", "value": "c8433f7a2cf5966887f11b2be7883a40", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270816, "uuid": "36f73f72-05f7-4bcf-8e2e-5fc905e9f7e5", "comment": "Malware payload", "value": "eb0904076b9f73f58259d0ccef59d84ff4db5cff2f3b7adfa2009ed6c9ca57ee", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270816, "uuid": "4ad308ef-e7cd-491c-a068-ea5b14d8bd9b", "comment": "Malware payload", "value": "dd456520ad7f8f63199f615e176b3319223e3d26", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774270816, "uuid": "41cdb6e8-e7d9-467b-90f7-9f016a138e26", "comment": "Malware payload", "value": "b954aaf139055b17cb8a84740887874ece98477a2a5c58b74c34b02dab6bbf0f5b3c11c22b04e7ea0dcef7d51518c8aa", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270816, "uuid": "7e3d4730-72a3-49ee-aed1-9d18c3afe70e", "value": "T1465503CAFDE80B08D67867B567C149CE0E8A8014934A0E6A07E4D51899CF9FDDB3DB31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270816, "uuid": "18788291-8d55-4016-af34-effe7a0ae691", "value": "48:ag/6haOZZIZJZIZ7/TZblAZqQMgjlr8TMIeJ4PKsMXF9WH7w5qiY+cS1R+cL6Ayn:N/6p7bZbaKTM/J4s9l5uSZo93/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774270816, "uuid": "f5438179-069e-4e00-b460-38ac109e3edc", "value": 1398708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774270816, "uuid": "9164ce25-997d-4e90-aaab-8c937b7a3119", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774270816, "uuid": "7e9ec0fc-18a6-4c91-afc1-76c936b7448c", "value": "Argomenti_PO_2026-03-13_7492358.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b57f025-2694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774255298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255298, "uuid": "c1df7212-1707-4a4a-9f24-c39b6f2d6ddd", "comment": "Malware payload", "value": "17785c1a198ebab154a149bb2ff32a82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255298, "uuid": "476f089e-61bd-4410-a9fb-32e9fa4ffba3", "comment": "Malware payload", "value": "eb5a895770672dde6e8d477c5388063e87f632bca6130bd35649d4608424afd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255298, "uuid": "5a6a7e0c-1ca0-41e7-b29e-26952d4f5685", "comment": "Malware payload", "value": "c61593f9a6696b071f749b2869283cba7bc16d8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255298, "uuid": "618845da-2aee-4479-a45c-f31add295a02", "comment": "Malware payload", "value": "1bf07a8875fa9c4d11b26c36cf14386213d84386f56f7a5928e0195bad1d49d33185bc8bcb0b9abb037539b4093e052e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255298, "uuid": "e126aa07-c563-41c3-9c48-cc1ae5a49195", "value": "T1F1157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255298, "uuid": "98cff662-1b87-4bdf-a263-539302987882", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255298, "uuid": "80dc382f-41c4-4118-8979-5d968beb0b8c", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd6hG:d/QMnl5YL7WzZyQRdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255298, "uuid": "3a13787b-b2be-421c-bd79-b47f4a8deb7c", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255298, "uuid": "c3d37986-5b9e-4fe2-a966-cb8e52a27d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255298, "uuid": "4cc199ce-e1ad-4757-9a3f-c7ab0fa8da91", "value": "Y942749135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baca6834-2695-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774255995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255995, "uuid": "5e20fc22-c7b2-4a95-b71f-81b85f4ee76f", "comment": "Malware payload (Gh0stRAT)", "value": "21c8036acf9ff5ef2e302efc5e449a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255995, "uuid": "435e4b7b-2ad1-4832-8891-01eac140a3d8", "comment": "Malware payload (Gh0stRAT)", "value": "eb7482944d01160800fc36b30b03816a6099f93f64fa1e9b04beefac2f49a7e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255995, "uuid": "091bb410-97dc-4cf3-9072-fb8cc911c28b", "comment": "Malware payload (Gh0stRAT)", "value": "ddae904d229e3b04f0f150fd595c1a9740a9f1b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255995, "uuid": "5bbf4910-1f8d-4fb6-b82a-3c363be97622", "comment": "Malware payload (Gh0stRAT)", "value": "7fb33c2be7bb8c5200086fff3edf16210307c52af671fa318c5bd6a71a70bca56a6f58449a4cc0f4126af41db0b33372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Venik", "colour": "#BA5EF9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255995, "uuid": "0459cb96-e286-4b77-9205-ab9cd85e7a48", "value": "T172D422F12968D42FE09841B2E75DE83276E0DCC278A50B3296E57A1DB3C540BFA39635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255995, "uuid": "ebde7538-cf01-4528-a37a-41acc7b927da", "value": "8d06ff0f301182c5ba233d45a52ee9ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255995, "uuid": "a5728b4b-80a5-4fbd-81b6-6feb729676c2", "value": "6144:PQJf3uMxrbLgEN6S7KzA5x3S5+y3D82oC0UdkgxgfOq:4J130ENL7kArI+y3XipfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255995, "uuid": "b96575b8-bd7f-4508-93b5-225e1301f3aa", "value": 656888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255995, "uuid": "248fd39c-26b6-4031-96b7-271449899af9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255995, "uuid": "6f1d52f8-d842-448e-b299-450405af1406", "value": "eb7482944d01160800fc36b30b03816a6099f93f64fa1e9b04beefac2f49a7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69e5440-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283153, "uuid": "22ee232a-d305-4e88-969e-ad31c2f6ead9", "comment": "Malware payload (Mirai)", "value": "268f2ad37ea243bbb792cdea35cfa3ea", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283153, "uuid": "4596961d-74aa-491d-ba1a-51ae88f1390a", "comment": "Malware payload (Mirai)", "value": "eb875810f18f42781f2958a038713156194842b5b54e9e9f57f782bd3a33b2ab", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283153, "uuid": "513628de-6c82-4992-a33e-88584c6ae71a", "comment": "Malware payload (Mirai)", "value": "649b86491b862bdfe554ac88d4e61c927cc51e5b", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283153, "uuid": "b98a63ee-262a-4356-b666-e3e54f2a414a", "comment": "Malware payload (Mirai)", "value": "46f99da1c838697f96f04a84ec4e8035acb0d0f3f6042456caffd964fbaed4236dbfb86ad4837f691eabc07797aba183", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Katana", "colour": "#29EE4B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283153, "uuid": "9b94ee42-e187-41a7-9427-754752616a69", "value": "T15DD33A95FC81DA12CAD661B7FB5E468D372703B8D3EA32039D225F31378A56A0E7B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283153, "uuid": "e0fb9c85-410d-4c05-8f5d-89837d119e4e", "value": "3072:PgJIO6rr/wihhPz/lRUlST65qCUOJs1s:4Jx6r7hzNRUlp5RJs1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283153, "uuid": "c0a0bd11-9e2e-4d90-955b-fc689645f06c", "value": 132992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283153, "uuid": "ad19b684-39a7-424f-b649-9038feeba56f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283153, "uuid": "97baefd2-d0ea-45c7-84c5-371ea213a3f1", "value": "arm5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e365f1-26fa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774299069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299069, "uuid": "ff6c9bc5-e37d-44c9-8a69-b18b0fa32bc0", "comment": "Malware payload (Mirai)", "value": "18aa6928602b8baa5e633e6aa846b016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299069, "uuid": "2183ae1e-3856-49cd-a9b8-b9a355473e0d", "comment": "Malware payload (Mirai)", "value": "ec1b4a9cf4b4a58f7f23bd68c093eb3c45166ac7a687d020041bab79efb363ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299069, "uuid": "33852318-2c79-4502-a947-abab4e875d94", "comment": "Malware payload (Mirai)", "value": "8682fbf419d065c74e07896e7081ea1d0d3a5f06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774299069, "uuid": "6514ea22-6cb5-4fd1-b87e-f1d58bdd8b39", "comment": "Malware payload (Mirai)", "value": "dd2607e291f571747ed11942f74d37df39b201c26cc2fe3ea3851fc6ceb09069098c52651fc94462f13cd3f702905a6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299069, "uuid": "7e1146de-b9b5-4d47-80a6-8d6a37d94107", "value": "T1C4C3D85E6E329F6DF16CC3314BB78A20D35923C623E1D685E2ACD6151E6038E581FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299069, "uuid": "fbd8fdc5-8519-4bdd-b103-5460d51fab73", "value": "1536:M1IDWev/v087Y9Ariripjrgeg/SZJhmZNNzEFVe5prBpB+IOVqBtTYeENvdfsvlL:wEW8f7oAVgeqzr0IOVO9Qfsve+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774299069, "uuid": "8dbceb3e-e189-4f69-97e9-9d47aadfd5d2", "value": 119204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774299069, "uuid": "947d71a8-275d-4f9f-950e-88c4f2cc5f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774299069, "uuid": "96e8ec59-b625-470a-ab3c-a1a3c0904034", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400cd8bc-2688-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774250205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250205, "uuid": "c39a4b8e-93a8-4aa3-b78d-d3eaa17f39a8", "comment": "Malware payload (RemcosRAT)", "value": "195a3db4f0c15e941a7e915014b3d34b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250205, "uuid": "d039e581-5bf3-4244-9129-51c4acb3f980", "comment": "Malware payload (RemcosRAT)", "value": "ed1717a4d27a0eb0c1e1ec157a7a6a8355bfd12649ea02540c6111396c8d4720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250205, "uuid": "69c1a380-5981-4955-bda8-f43f4efd1ec3", "comment": "Malware payload (RemcosRAT)", "value": "8226986269f05bd7edd8de176b3c343779e2481e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250205, "uuid": "e9701b2d-4a6e-4f04-a223-044bd5837d93", "comment": "Malware payload (RemcosRAT)", "value": "fba69abffcf3d6833320d288419b1534f0c133037974f94c71082e5f291c26a39ce3726b94e080b96d1b6c8885cfc102", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250205, "uuid": "1d645dae-921e-4fc6-aace-85fbbdee6f30", "value": "T159A4E043F6409262C4750331A8B75B3C27376E646BB15B0F234CFF383AB72E25A5665A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250205, "uuid": "9fa9a118-38bb-43e8-8c62-e5cfd12eb527", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250205, "uuid": "2c61a7ab-944d-4a6b-ac3a-b7368d3f76b8", "value": "12288:7AAwYJoriESLHku4qGJRoIwVHKgvCovlP:7AAEOEmkXRJ4Hdv55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250205, "uuid": "299f423c-cf96-41eb-a4a2-f6d3d1d7a354", "value": 480200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250205, "uuid": "bf1b8637-1739-4c6d-a3a1-3696c9f0e4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250205, "uuid": "67c958c0-9b62-4de8-9b1a-5e1811dfb576", "value": "STS_Bunker_Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5652c0d7-26d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774285032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285032, "uuid": "9ca7188f-a12a-46dd-94e5-edbabe7c122f", "comment": "Malware payload", "value": "04b6e5dedf87749f4e1998962759acac", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285032, "uuid": "8266c9a7-ba4f-4b26-a396-f348cde81f77", "comment": "Malware payload", "value": "ed727c376c60d130f78c946aa980e34fd6a41de93a03774d5f5462eac5510ed8", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285032, "uuid": "244bff40-2e36-4843-a79e-48cafa14fd15", "comment": "Malware payload", "value": "418ede7587c102fb94fe625699a4aa027d4596c7", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774285032, "uuid": "c3514616-980b-4527-b525-75ed08107d8d", "comment": "Malware payload", "value": "7e3b93b781527058e733872040d34a364295261ad9d525f9961ccc1687260f0071a5442cb3405ee44b028c94941a63e0", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot6534734442", "colour": "#968B75", "exportable": true, "hide_tag": false }, { "name": "rantom", "colour": "#3D811D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285032, "uuid": "83b7b53b-b7b1-46eb-929a-c82684ad5e71", "value": "T10647BFA9F54FA82FC88AE27B44D47993E9E3741BFE41F051B0AA74C75A8D6105FD03A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285032, "uuid": "e502edcb-d47e-43d9-8277-a674be882074", "value": "393216:hyINVBOOcL8GRctiTsrt0p4z5P2DPodr1GxTyPj/ZBq3O9xNKdEItE:hyIvBOO8NrTXyzw0AZyPkgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774285032, "uuid": "efaefcdd-5b99-4a56-b1b6-5d56362e52ab", "value": 26018399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774285032, "uuid": "24bb0fd0-d5e9-4eb3-a6cb-5b327a83ebee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774285032, "uuid": "5c2923c5-9aac-4cda-84b9-8c11f2e503de", "value": "HostService.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a384f1-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774283158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283158, "uuid": "b539ec47-4fe7-4795-a5ff-258dd35b94ed", "comment": "Malware payload", "value": "5eb0cc66c652fbb438d50fea643b18d5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283158, "uuid": "39434ac4-1ced-4c51-a746-dee20e3b23cd", "comment": "Malware payload", "value": "edebf1271f40e36efc0ca237611ceb2b071e8eed1a46344912abe78936f5b2c3", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283158, "uuid": "533e9429-b68d-4623-8457-9cc9bf4b5811", "comment": "Malware payload", "value": "67eea814da62a55b2b42e80e475d83cd0072b699", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283158, "uuid": "4353172b-296e-4ee7-b0ae-edc255652245", "comment": "Malware payload", "value": "3f18fadfed6af3cdfe9141db8b085c4c45adbb3ee6266eec20fb8def960b660038fae9818eaf5e0053e8fc1f7c371ee1", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283158, "uuid": "1111f9aa-146a-42c9-9ce8-7189fb73a530", "value": "T13B015998228B0E43CE600975AC460B522233C45762A6A3CF1599D97AAC4B6BE2CFC348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283158, "uuid": "316754fd-a498-479b-8b31-7685de3e2d4b", "value": "12:BNdAnI+NygR3ywTuLS/fgrJwRsPdiK6AhcQKW7iQ/j+8Pn:tzZgURIWas1iEGQJ7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283158, "uuid": "6e4454de-4cbc-4a20-9bb4-3cd524816472", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283158, "uuid": "fb8fb2a5-4489-4265-b3ab-10df91c161b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283158, "uuid": "f9b8e3c3-7f7b-454d-bb0f-989d2fe13936", "value": "mossad_102_8082.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c29cb0-2689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250624, "uuid": "f0a19c20-482c-4199-8a2a-d6d90cd33139", "comment": "Malware payload", "value": "df1d67cadaca6c5e0d7f17e942a08c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250624, "uuid": "f8e8a509-5231-4dbc-b632-3e83c5c3fcd4", "comment": "Malware payload", "value": "eeacfe7657190722fb6a127936e7f14d0b48ff76800b7c4a335c31dc5ac7fa88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250624, "uuid": "bb305f63-b577-4858-a96b-d94f5ddffc39", "comment": "Malware payload", "value": "936be9fedc6283f5e243558f7c63c66f94c8f09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250624, "uuid": "95ae4414-b1fa-42fc-b936-cfd6e35f3c23", "comment": "Malware payload", "value": "f19929e18c516d8b11d76b2400bb5ff8084feee32fde1ca8204525bb095e2f910f3e9d07208bee76505374dcd9b88304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250624, "uuid": "9ad58a75-002c-45c9-80d4-1d669a778860", "value": "T1B8B68C43EC9149E9C1AAA230C9B69253BB717C495B3263D72B50F7382F73BC06A79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250624, "uuid": "d5c7c54e-c198-4017-a013-4bd6d446c762", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250624, "uuid": "c7658bc3-5fa8-45fc-b67e-a337b9565bca", "value": "98304:pKDkfNtJRewE5zumj45q7sQBErhN9oQHbccwiYqla0AN0x0YKPwXohK+6X:pKDkf7Jy5CX5q8rh5brTs0A+x0h6kK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250624, "uuid": "3b9022fb-4e63-4c88-aea0-97958417f20f", "value": 10453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250624, "uuid": "974243eb-0fe2-43c2-b52f-344be53ea713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250624, "uuid": "f1eaac7d-71db-4b49-9fc9-29172fb38ce4", "value": "osamabinratting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be5ec31-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239944, "uuid": "e54ae8bb-6c69-4c48-a4ce-fea4d12a789a", "comment": "Malware payload (Chisel)", "value": "12864a24355d6bfb4b8a84fb5506dce2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239944, "uuid": "d06e072e-8952-4c0e-8e76-ce55eb296799", "comment": "Malware payload (Chisel)", "value": "eeca170dca7ea9aec9883f5600c41bc75bb64ecac91bcf5d65f2132e59e6a9ba", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239944, "uuid": "b53cb23d-4780-4ee6-af03-01902cfe1fa3", "comment": "Malware payload (Chisel)", "value": "b34f42303e9a70002b8c1c3f530949da034c99a4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239944, "uuid": "cd72d778-002f-4741-b9d2-f0edd8957e9f", "comment": "Malware payload (Chisel)", "value": "7773ce92140a72e6dc36fea77c16d2a22013d379382acfdaac3777dace87cd9f7e0de5d01be66471f41ee06c5276096a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips64le", "colour": "#4B3F03", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239944, "uuid": "d070fcfb-937d-45f7-9194-2e9a227cc727", "value": "T1AF0633CE9CA3C063A2E8C6BDE486815F7C27974AB6F436844CAF86D46C488E5D7C7C45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239944, "uuid": "d99dacc8-e521-4c7b-8cf4-91fda9386c74", "value": "98304:LP6nXqtqUgI6EAlWuclyp5bNGpVu0PAEW:U6qURAlRclyp5MXDP5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239944, "uuid": "bb1854c0-50bf-4c41-9fb1-283982095e5e", "value": 3880748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239944, "uuid": "f5a892eb-a09c-4ff3-ae04-a57ce0ed03ab", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239944, "uuid": "63fdbd34-e400-490b-baab-7f47522820be", "value": "chisel_1.11.5_linux_mips64le_hardfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3e6104-2686-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774249665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249665, "uuid": "7b688f99-1a8f-481e-8d26-76b031232722", "comment": "Malware payload", "value": "b6564a53dd6f8b5d7e96da870b61f4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249665, "uuid": "bdac8f18-86a5-4421-b208-2ed31205ad95", "comment": "Malware payload", "value": "eef944c51c6ccb97719aad1b855cbfa545fed8c6d5151b51cdea4d30e18da93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249665, "uuid": "6810b093-8dce-4512-aafd-12ead0ba001a", "comment": "Malware payload", "value": "f1840f763e29ccdaa1450431ee899ffd0d32d48e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774249665, "uuid": "af64beb6-4ad8-49d1-8a0b-28306b3757a5", "comment": "Malware payload", "value": "dcb8c2be0345ffa79e64ca61ee99c0d90560ddf5cc61722c92e08caaf43bddade371cf755827df8f6608481bca4076f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249665, "uuid": "db1f4d53-2752-429f-a37e-23499a5ac9c8", "value": "T1B2D6336E2DDB40D6D9C02070AB2FBBF723B357D509C50D75AAC53449B4A2E3B703A986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249665, "uuid": "3455b48c-ddf8-4f6f-b4b9-2a9f0884ddb0", "value": "bd2653a5e1c03e32a534eb49b630e8ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249665, "uuid": "21e07ba7-ed95-41e6-bc41-3e300f4359a0", "value": "196608:5izAp9tEniAWaoNX+87hC5MrXXdhAM1T4MOENgi8f9Kg+/Xjh2:5jtEniAWaU+wEMDX3LvU9Kg+/jM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774249665, "uuid": "26261a28-16fc-473a-98ac-c87c095d036f", "value": 12684800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774249665, "uuid": "c2b70718-5ec6-49d5-95a9-23db09d7f180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774249665, "uuid": "d0db224b-3c57-47db-bc71-6bc9c1c52765", "value": "b6564a53dd6f8b5d7e96da870b61f4e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5fc28e1-2687-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250000, "uuid": "f89d8bc3-b899-489c-b104-c97764349c80", "comment": "Malware payload", "value": "f217c15183fab93812701be36c3befb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250000, "uuid": "e1b3a74d-24fd-4f9c-a377-30bb3ba3f718", "comment": "Malware payload", "value": "ef2e4709accbe3d62d8784596ab04e397fe815b6222c09a3fb002cee67f719bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250000, "uuid": "4500f25f-ceb1-4f02-b5aa-e582ae8751e4", "comment": "Malware payload", "value": "4e38e4a7dffcea5f8806e4b4c4070f0b9def0d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250000, "uuid": "08687aa1-7909-4dc1-a82e-b02946171e1e", "comment": "Malware payload", "value": "3f9244588eaef77d9251c752a0f6bfbbdbc90dd89ac0e5ed1aa5e99078aa651925c0f5ace4fbf9afc7da7c999b87c16e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250000, "uuid": "6da60c22-4476-4da1-aa19-9d97c844efc4", "value": "T1BC545D4A776040F4D8679139C9A78A46E7B2B8550771A3CF13A443BD5F2B7E09E3E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250000, "uuid": "b52118f9-707a-40e2-8134-05904d064694", "value": "7c7c51c33ee21dccb68077e47572762c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250000, "uuid": "c93a31c2-c6db-4b94-adf4-c3c1e42973f9", "value": "6144:BXhHTJd/s30SoYIpAob4WDHRY4T5H2vQ8hb0YYpG1e+95gzenrz:ZpSIiWDZ8dzk+5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250000, "uuid": "8103506d-24bd-4ea2-9590-e46c4a9caf54", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250000, "uuid": "d2ecdab7-edb2-4b85-acd7-be90145cad9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250000, "uuid": "8be6f001-31f0-4fdb-bc73-411d25effab9", "value": "f217c15183fab93812701be36c3befb1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1164da83-2694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774255281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255281, "uuid": "02caa696-359f-4d5c-bf9c-444467db5685", "comment": "Malware payload", "value": "6de171d18d0e772f9a1a6b5c293df6e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255281, "uuid": "59387072-4467-442a-b4dd-eab516df0bdc", "comment": "Malware payload", "value": "ef58f31e36679e3c2f1ef272f09b855241e82fca426046e30ff4a81ee679dc69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255281, "uuid": "b3ad56e0-a70c-4f01-8329-6cb8706cb2d9", "comment": "Malware payload", "value": "d210b8f135e08753edf91efe0300709d8b914415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255281, "uuid": "aabbf758-7f4c-498b-a1b2-6b29c3b01003", "comment": "Malware payload", "value": "4b2fcaf73a4aaa9d3018ebbbd6c16b0d5656a21719135e35e4267ce4b29faf11aa479e2955e794cffe88f7cfff378712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255281, "uuid": "8e30dcc5-68fd-4277-be3c-dfcc99a8f261", "value": "T10A763385A26009EDE937813DD562A02AD67738AF4B61D2C707B4C3921F077F06D7AFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255281, "uuid": "182e2c70-9952-4199-a243-14d3135b8e41", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255281, "uuid": "d6153488-68f9-4ac4-9884-2f777b52cc70", "value": "196608:BaNTwhLN/YoeNH+L2V76+DXLZy7YM30LzajTk0ax8wpSefpMm:BnLgeL2V76m70GzajZaxbwefim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255281, "uuid": "cfb20c02-2595-4305-ba58-1dec4d7e9d27", "value": 7526003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255281, "uuid": "8faf031d-2dae-4f24-be52-b33561a20d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255281, "uuid": "9e2d108a-d4ca-4de7-b886-e3dbd4609379", "value": "ef58f31e36679e3c2f1ef272f09b855241e82fca426046e30ff4a81ee679dc69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155c0dd4-2685-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774248845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248845, "uuid": "68edf783-5ff2-4f24-9bd4-8725085fcb2b", "comment": "Malware payload (Mirai)", "value": "ec2217137cd1fdf81df5564c41a7638d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248845, "uuid": "76615216-be88-4543-84e0-287dade9ac76", "comment": "Malware payload (Mirai)", "value": "f0e1cf0931162529d8ae1ede1e260824d58a04ae0a8bd44cb226c68eab91bc90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248845, "uuid": "0b6c2a40-6cf7-4bcc-9b43-bf536c6a5b90", "comment": "Malware payload (Mirai)", "value": "2b103f452e7aa9eba8438620716cd58b0aebeb4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774248845, "uuid": "be9d43f1-e321-4526-bacf-583cd6bc1a53", "comment": "Malware payload (Mirai)", "value": "6ba963f84e0e1f07c9a32f0d33be5a9d9707167d794057e624fb0fc7a80226db22cde4e31387ebe6bdf7e75ceecfb674", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248845, "uuid": "26cbdfa9-713b-4093-b68f-a82755aa8b72", "value": "T1C5F32713B88480FDC0C6C2788FEEA626DA66F85CA135B52F27D17B16795CF20AB1D705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248845, "uuid": "fdbcd38d-ae9e-49d1-a5e9-8a45119b6a10", "value": "3072:B9Wkwmul6Bd42lT5Zz+IEJHEhC/FTenbzVavqX7RquvOEop:B0kwumm5Zz+IECUU8v6q3Ew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774248845, "uuid": "5be33119-897a-49d8-9378-6231c6ace0ff", "value": 163872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774248845, "uuid": "22175627-5c34-4f0e-a853-9b2e3bcbb46a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774248845, "uuid": "0eb93539-aaaf-4031-a310-7498d081e487", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa232acb-268c-11f1-a769-42010a9c0008", "comment": "Malware payload (ZombieBoy)", "timestamp": 1774252101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "d74ead2c-5e6f-4de6-a95a-59cdbc1b0bf6", "comment": "Malware payload (ZombieBoy)", "value": "a1c10e31b2ec1fbe0343e5c17b2c2975", "object_relation": "md5", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "ZombieBoy", "colour": "#F28AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "bda1cf04-9f09-4bbb-9751-366d81d4b940", "comment": "Malware payload (ZombieBoy)", "value": "f2fcd07300af21753f21c2ed86fd40335eba2c6beb49b2d63dbab370e5463559", "object_relation": "sha256", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "ZombieBoy", "colour": "#F28AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "2871aa11-fb40-44e5-b252-c8db861c8b4f", "comment": "Malware payload (ZombieBoy)", "value": "104745958dc01ffa0720e12b69c53df750ae5faf", "object_relation": "sha1", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "ZombieBoy", "colour": "#F28AB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774252101, "uuid": "6ef6f2cd-57a5-46dc-a028-1f4e9b9dd0e6", "comment": "Malware payload (ZombieBoy)", "value": "b341cf6d4f3667536b9f8a45ab5d6b301c94dbf39351e37fa73a8140e66948cb1ef85a67f4a86e5696a7035c3b839408", "object_relation": "sha3-384", "Tag": [ { "name": "a6a4b63", "colour": "#EBC153", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rat-winos4.0-gh0st", "colour": "#BB1A7D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false }, { "name": "ZombieBoy", "colour": "#F28AB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "ab1b9e1f-5e0f-46ad-9aed-9c5e4c7f2092", "value": "T107567C42B662C5A1C7894630CE3AFBFCCB31BD059B96526761D0FEEB3A314E17D19218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "a089a366-f0ac-4511-a466-703e598e6d93", "value": "7a895d337ba5d664eecf920568af2ab3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "248d66d8-a4bd-47b8-aeab-fd64486d3e23", "value": "98304:D02trRq2chaXqF4LOVu7F9CwtDVK8lZyQBJW:nnq/aaih97tDrlZyQBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774252101, "uuid": "7b90f26c-3615-4d65-9200-b78c04e22870", "value": 6287360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774252101, "uuid": "e0b5f73f-e2ef-455f-ba9e-098783bd51d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774252101, "uuid": "23a9329d-dff4-4ae9-83ee-74e70e7abcd2", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d3ae3b-2667-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774236261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236261, "uuid": "416d20a9-d237-4939-841f-e5de2eed9883", "comment": "Malware payload (Mirai)", "value": "dcab052b9b3849b2e66e7dccc73c899c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236261, "uuid": "91a3fe41-84be-4cdd-bf2f-744e5c5007d2", "comment": "Malware payload (Mirai)", "value": "f46e99f9bec35d6d786720f237875a339cdf7fb087cfd9e12126fcedd1dfd2b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236261, "uuid": "e2ad0ff0-3930-414e-8655-f95de76728f7", "comment": "Malware payload (Mirai)", "value": "cdfcee39ae66e9b4abdfa742adefb45d1c51ba59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236261, "uuid": "3c18d457-a058-44a5-af0e-a09e8543e3ad", "comment": "Malware payload (Mirai)", "value": "927e7de7d45908fbae58f0e987ee18ccf5a4f1433c812d082213a58e69a856473cb0ab438d55fc8560f8642b825447f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236261, "uuid": "1b1b47ba-919c-4b95-9a67-9048f226c772", "value": "T143830985B881AB21C6C512BBFE1F018E3313576CE2DE73129D245F6477CB96B0D6BA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236261, "uuid": "cfcaba5d-21fc-47c2-abe0-bdb475c8911b", "value": "1536:ponmHQq1krsiXbUAD5pJjLJyAMf1ZSUxVP3PMIin/s5TcYa7SBFze56YZ:vlkDrUW5phoXfjI/s5TcYa7sheIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774236261, "uuid": "58abc989-14c8-4494-a5ba-844f868001cb", "value": 84348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774236261, "uuid": "c081c010-b241-420f-867e-414cb8b08d28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236261, "uuid": "f4c38e6e-c348-46fb-8f5d-dc4180575be1", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0866cc-2694-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774255357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255357, "uuid": "dc965103-5c5a-4199-82e8-2290886fe7bc", "comment": "Malware payload", "value": "6f302c10c41dec205e518f7b26444091", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255357, "uuid": "6b86631d-fa04-4790-b2fb-176d8bdc1b30", "comment": "Malware payload", "value": "f52f5028f7db43c271e94d0a41f7a637869334fe138192dab2cf267f6f29b606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255357, "uuid": "b00a760d-9f7a-4dc1-b56a-b814aa74d154", "comment": "Malware payload", "value": "b986d23b64f304e10443e0f0a71d47f0f30cf244", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774255357, "uuid": "9d553f61-6544-4537-8fab-0435efea11c0", "comment": "Malware payload", "value": "a6d64986200bc984817ead68592eb1662d5539b2aef164103fa7f2d96e0364740881574f97c17562a43308494f982ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255357, "uuid": "12ec7bb2-b5a2-424f-8711-523df59d6b30", "value": "T1C6157D52B3C3C1B2EFA215F3D9B557360939BC78133889C7B7D8282DC9A26C06A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255357, "uuid": "38c21f83-63c1-4b6f-b9fe-d655b478157b", "value": "471485476459c716374c5ae96580f71f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255357, "uuid": "5cf48b6c-b609-4ffc-90af-0939c4d8bc7a", "value": "24576:ybi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMd65G:d/QMnl5YL7WzZyQRdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774255357, "uuid": "33e447f7-753e-484a-b13b-21d081d39b98", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774255357, "uuid": "07816b77-a1b6-400f-b50b-c85dc5e7ead8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774255357, "uuid": "2eae9ac5-e347-4c8a-a962-6eae6279b739", "value": "Y831245852.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e09991-26c5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774276310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276310, "uuid": "ffcc5d25-1fc4-4421-a469-2882c699d5c6", "comment": "Malware payload (RemcosRAT)", "value": "cf2bf81047c2fcfec93ed5f162dccabb", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276310, "uuid": "c525fb3f-6d9a-41ef-8fda-9da01e27d4f7", "comment": "Malware payload (RemcosRAT)", "value": "f5ae2f36267c25f76cd414e712fac3d8d6266cb457ce600e446de2cc9415f218", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276310, "uuid": "4fdc37f2-a5b2-4527-90a4-a769eec3fa40", "comment": "Malware payload (RemcosRAT)", "value": "af4c3b18cea8dc7e6c2ae5f170836129b35ba1cb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774276310, "uuid": "d0bbdc87-31e8-42c3-af53-b16f02fa38c2", "comment": "Malware payload (RemcosRAT)", "value": "990e56d3e945e8643146cea67ea5dca751a3f1249c82ba093d7541cfbe0f60208faca5c91a2c189eb1020056543b7f87", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vhdx", "colour": "#99F7E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276310, "uuid": "d89b0c1f-89fc-410c-929f-52715c8ac4ef", "value": "T153E62976484830F3DB59A17A044CCC3EF24C9E5C5B525C48E756B63ADDFA0E1A3CEAA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276310, "uuid": "b19a06ac-4765-4b2b-b8a5-99d76399ad4f", "value": "3072:k/pcGnh3vs/InbrTIHvPnHmC5irCuMo/+ncoZZihnhLQtZ0otZFMiHO:crZn7y/EGuH/cpiTtLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774276310, "uuid": "7155e801-e2c6-4563-ae92-dfa40262327d", "value": 14680064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774276310, "uuid": "13b8b101-4446-4b35-a91a-5b18d7a78249", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774276310, "uuid": "c5bedf96-f4ad-42fd-8575-af420527b574", "value": "NA-LOG GmbH-Best-Nr_0004226_pdf.vhdx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76424984-2670-11f1-a769-42010a9c0008", "comment": "Malware payload (Chisel)", "timestamp": 1774239988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239988, "uuid": "ed12aa83-abdf-4a4e-95f3-9e1bf94baf2f", "comment": "Malware payload (Chisel)", "value": "7a4aeb8b28273c8a3bf2308b026ae857", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239988, "uuid": "4f41c242-bcb4-4ab1-a86e-2407964fe9ef", "comment": "Malware payload (Chisel)", "value": "f5d502fb9606d17c97d87503b8706121dc76eb3b70cf58a63da86c804dc88f4d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239988, "uuid": "c3746d41-55e8-4451-be89-825e991570dc", "comment": "Malware payload (Chisel)", "value": "109e22c04b6daffaef9b220d9034ac2fc4c246cb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774239988, "uuid": "7569b306-7739-4640-9ba1-010eaea29e55", "comment": "Malware payload (Chisel)", "value": "1509f9e7cc1a1fa50d25fd0940ef5d8ae318315df01db74ceda793831aa039862bd5f9db8747af3e0d18c5715e4222d1", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "Chisel", "colour": "#7C353D", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "v1.11.5", "colour": "#EBC590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239988, "uuid": "54464cff-d675-4e85-bb0d-66bdb8a6e9ff", "value": "T1C5163359A4A79025D46F903627F78A7DF3AC1D0458A8CDDF70CBF8826EE68B330490E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239988, "uuid": "d6d01119-3042-469f-b1ba-9bb5820c24ff", "value": "98304:i9rXg30teiwHdGnkTx1IdzUip3zmzq8M6Rek/ZctpTWnEI2QEq:i1C9Gnax1IpmzqXKuyn32pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774239988, "uuid": "994ecde9-283b-408c-b09a-464cdf8dd27f", "value": 4108592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774239988, "uuid": "c41f3c6c-c7dc-48d2-ab4d-660771ee5ff5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774239988, "uuid": "ede9b006-1dca-449d-b9aa-7725c022bbb5", "value": "chisel_1.11.5_linux_mips_hardfloat.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac3ff6a-2689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250572, "uuid": "da2447ff-8a76-4016-a8b2-d47649be2081", "comment": "Malware payload", "value": "542d12bb8eec524f6b9f83acf2b5bd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250572, "uuid": "e23114a8-33bd-49f2-a652-fe0be3af61bc", "comment": "Malware payload", "value": "f68f80548f2891033cea595f290b00a3b1f588f3b7da267ef85bbe883abc84c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250572, "uuid": "e1559c40-2903-44b2-9cd4-3674d7751544", "comment": "Malware payload", "value": "f1dc9db94118231e764295ea6943e2d5fe9c6e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250572, "uuid": "45fe388f-3b49-4984-b6e9-d06028d786b6", "comment": "Malware payload", "value": "8cc60451d403686d8de64b61014ceda3a7e55244dc18d5a45ef86ce5b7c8375962b6572688851d29b8cb37e4e4e5f8bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250572, "uuid": "0407c151-662a-4808-93ff-01a4d08e901d", "value": "T13EA68D43E89215AAC1EAE631C9B292537B717C495B3267D72B50F7382F73BC06AB5340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250572, "uuid": "bcb45b6f-c0e0-4fa8-a87b-b5473f6356cf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250572, "uuid": "59beaaa2-e940-4779-9b76-7a19b864f8f1", "value": "98304:9GBsypxAT9HvBeX1sBEoVrf59oLeUTgp5BJwZGS14eyDBo:9GCy7AT9PBeVoVrxGzgjoZFueyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250572, "uuid": "72f18345-d571-4ba5-ba33-fe9c8b89e1f6", "value": 10400768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250572, "uuid": "d8440baa-410d-4e86-a613-25a1c2a1b5a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250572, "uuid": "fbc4f6af-0b1d-4372-8bfa-1864871b6933", "value": "osamabinratting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b188267-26a5-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1774262706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262706, "uuid": "999a4cc4-86f9-404d-8776-b0c0ca8035ce", "comment": "Malware payload (SliverFox)", "value": "a7957d592624a377d2fdd47f1f0e11cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262706, "uuid": "052e5331-0067-4427-b81e-f8b5fe8b0c87", "comment": "Malware payload (SliverFox)", "value": "f6c99db6a66da81b103dbcbc984c8ad4f2878b0a3e561bd8a1a38c7578db48ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262706, "uuid": "52b2a796-3082-45ae-9ca8-aa3fc279418f", "comment": "Malware payload (SliverFox)", "value": "08ea7f9fb2f6b33c88ea006c7b8e72e79735abcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774262706, "uuid": "e7c8b922-dd96-4da2-ba3e-6fecb8b35c8a", "comment": "Malware payload (SliverFox)", "value": "056f232edf2e3c812125458a87e67f0690cd81ebe72dde791f8b396f6e57b821fcd859c96c24a85eea622ed39f11457a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262706, "uuid": "b201f624-c340-4e9d-a9bb-9b33498e054a", "value": "T1487501D2E5508D57E09384399D209C66C72B781A1AB00156A9E7FE4FC5FB6B20FE390F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262706, "uuid": "7e1fa543-8f1b-4992-b3c3-4aaef5e11aa9", "value": "10d3919aac94b86d75e2e20360c1eab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262706, "uuid": "8376a35b-4291-4fba-8520-44ab890a7214", "value": "49152:fVXWFUmRPgY7eu5p5Pspk0IVCUVllDMWUDakLO:uUGgE5zsCRVFlyWhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774262706, "uuid": "bf5131b5-8a69-4601-a077-11a3fdecf22b", "value": 1671168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774262706, "uuid": "bf4421d4-7f31-43fe-b33f-79a8b7825f4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774262706, "uuid": "e20fbd1e-3749-4f69-a5de-898ef98bde68", "value": "2026.03.23......\u6700 \u65b0 \u4eba \u5458 \u4fe1 \u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1cfd4f6-2667-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774236223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236223, "uuid": "80ee20e2-5beb-4ef8-b778-513f6242e289", "comment": "Malware payload (Mirai)", "value": "2f1ed5b7b6b709bcd28aaeeebc35ddbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236223, "uuid": "cda83990-aec6-4596-8c34-8a3f0f77f24d", "comment": "Malware payload (Mirai)", "value": "f71e5a364c9804b348db8d5e10dae737aff9ffe512a7d0f0c99c6604bc70d81e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236223, "uuid": "fb79f422-8b92-4431-baf1-4944a6a11fdd", "comment": "Malware payload (Mirai)", "value": "826479c74877872dcf44df1d141b3b271d921e21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774236223, "uuid": "f6b4c4e4-b8c2-4e4f-b66e-7c1268a0359b", "comment": "Malware payload (Mirai)", "value": "737d817c92bfcd2baebfc5d17d7abc09e16b200ac0a31221aaa550ef411d6fb462d35b3ec217ad849556def3b8def053", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236223, "uuid": "949be855-bccf-475f-bb6a-b63a49f2c008", "value": "T16303F1F19617AE43C4301E7A9C7C45A22B5D4BF5E0BA249321A0226549CE487BEB94F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236223, "uuid": "625d9c55-51ba-4d1b-87ae-5f856f8f2e33", "value": "768:/q2AaNfBVZ7JkOtTgaiBEV3oRSbpXevf8bgJTU/pB/57/I9q3UELfZ:/q32r3kOtTgTBgoRwXpisB/DLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774236223, "uuid": "126c3eaf-dd03-48e0-a4df-d4ee7e192a73", "value": 38072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774236223, "uuid": "8ab9e008-7e1d-4e0c-a2ad-1bfd8d3fbf62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774236223, "uuid": "5104b853-890c-435e-a26d-6e2991bfc312", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d6953d-2699-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774257466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257466, "uuid": "cc6f6d95-1896-4c9a-9e67-cb03fc66c9b8", "comment": "Malware payload (WallStealer)", "value": "befd84a29522d4350ae2f674f2ffcd8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257466, "uuid": "88db7347-2d08-4e2a-85a6-d440194520c5", "comment": "Malware payload (WallStealer)", "value": "f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257466, "uuid": "b5e2111c-8b5f-4897-9ae3-1adcf9010ff5", "comment": "Malware payload (WallStealer)", "value": "86cb3e6750f76c5d2d7eaeb176f5a5b92a2fbf7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774257466, "uuid": "bad54c4b-395e-4896-b69b-3c566f659613", "comment": "Malware payload (WallStealer)", "value": "f2fa492b435929ffb55f0a9c8bb0cfa1480693184f0263e91ecb61e32243db5efc9a46322316671adc5cfe07bf662c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257466, "uuid": "18835433-def6-4e0c-8a22-01b86d3bb431", "value": "T16685AE05E6964BEAC0BBD1F4C9116B6BF5BEB82107296E3F6AC00B947F1272017BD705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257466, "uuid": "d8d3780a-cf6b-49dc-ad5e-fd7067975d37", "value": "2084ee74037f705e76983780bca05b8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257466, "uuid": "85ab7257-5c64-49dd-8c6e-bfc34880ab19", "value": "24576:lbFTGIponkrtYHiiKP2c1hyc9xTdWufJGYiCp5/WFEFVMOsSQJ+p+d:WxnNLq1R9xRlGhCp5EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774257466, "uuid": "ff95cb48-daf1-4541-9791-5e5517695e9b", "value": 1764352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774257466, "uuid": "0fd04240-69ba-454d-939f-e81d39b9cefe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774257466, "uuid": "ff858ccf-f9ff-408b-b1c2-f59e4638a725", "value": "f783fde5cf7930e4b3054393efadd3675b505cbef8e9d7ae58aa35b435adeea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe9a308-26d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283169, "uuid": "23ab4dc2-9aa8-4a39-ae50-412ac5180459", "comment": "Malware payload (Mirai)", "value": "0e73edd583b3bbd097300adfc777da29", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283169, "uuid": "030deec5-f2cc-472d-bec4-f05015f61441", "comment": "Malware payload (Mirai)", "value": "f7b381b9afd31c3aa518668ce50e73988a15150b3ee7bc48e12106942df2738c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283169, "uuid": "082843af-b088-40cf-8ade-0162d930534c", "comment": "Malware payload (Mirai)", "value": "3ad0a6a5b16e394610a1c3da9e17f98d774069c2", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283169, "uuid": "dd176bce-cb8f-4fd2-a981-b4ca29209942", "comment": "Malware payload (Mirai)", "value": "c35d6a755262e2a3683b5d29e54c773ec901da25a76d552d86482e1dfa325aba94725dc4c537fb900b0b57bcab4470a4", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "mossadproxy", "colour": "#D4D64B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283169, "uuid": "46b55591-97d0-43bd-977a-27da616d5d32", "value": "T10E831999B962C566C1E421BAA94A81DC331313ACC3EB7352CF11CB3639EE55D0E3EB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283169, "uuid": "39c1e65b-9665-4d8a-b45e-a5ca95e94315", "value": "1536:QOUfSv71fMBuM7Kojz6IeBbneYoNM8o4WY9UZRfikmvPUTWemO9F:u6h0BuQXeJBbneYUM8H9eRHmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283169, "uuid": "7d614e83-05b0-40b0-aafd-a3a71fbb0ebf", "value": 83580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283169, "uuid": "50b4f734-6d81-4468-bc3a-5f330b606cc9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283169, "uuid": "26c35bd0-f68b-4f9f-8745-ae3c885f33dd", "value": "mossad_9090.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee859bc-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774229131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229131, "uuid": "ecf8d3ad-89c7-4d14-89ac-7c08134bab30", "comment": "Malware payload (LummaStealer)", "value": "5c56920cf96ee0501e07e7a4619c18cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229131, "uuid": "47e911c4-87af-4fc2-a1f5-b918f5e594d3", "comment": "Malware payload (LummaStealer)", "value": "f956a040568f3b59ea00f4de4dd1578573c7b8477f75c6b0dfc0da0fd316738a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229131, "uuid": "c12e1c87-61cd-44ed-bb16-18efa517dccc", "comment": "Malware payload (LummaStealer)", "value": "19b8c2b743a51329811fa92649c3b98d48eefa6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229131, "uuid": "a77255b6-4fe2-4a5b-9f90-5428cb64ed08", "comment": "Malware payload (LummaStealer)", "value": "fb849119c33392d0c2fff3ccdab9a779d2ccbabd7616274df221e620a4aa349954641851b174a5dca9fcc1a5b828f08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229131, "uuid": "49234d94-de52-408e-8536-259470bc8d59", "value": "T13E954B40FEC758F5E907173255AB62AB2735AC090B329BD7EB543A7DBA7B7D00822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229131, "uuid": "a303c47c-e98b-4f7a-af38-63dabff68d14", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229131, "uuid": "8892075c-96fd-4607-b1cf-46a3677b231c", "value": "49152:R1OOZmB7LEneVSbN3Y50ym9q4swCtRbQboyt:zTZm6neVSbN3Y50yqq4swCteboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229131, "uuid": "5c73135d-ef74-45d5-906d-8aa4a2a369be", "value": 1881808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229131, "uuid": "11425826-2a10-4383-a9e3-1f395e6a511e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229131, "uuid": "a190e0dd-377b-4f67-adef-627b0f15b049", "value": "f956a040568f3b59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7225641a-269a-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1774258020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258020, "uuid": "79577fbd-477b-406c-be40-c2824529501c", "comment": "Malware payload (WallStealer)", "value": "8c44371c27fe62cb07177ad0772fd464", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258020, "uuid": "c272aa81-ec70-4b8e-a316-6b6d079ed0fd", "comment": "Malware payload (WallStealer)", "value": "f9ada6f82b13173d6da86b84c6e08b044d1d627c6d02d4854bf1777381ea0d44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258020, "uuid": "68cb0992-e0c8-42d6-811e-e8c953cb292f", "comment": "Malware payload (WallStealer)", "value": "637a04e5a950acf6c9c734eea8f56578f14fd024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774258020, "uuid": "ce0be18d-949f-41d6-938f-1cb57d79f0cc", "comment": "Malware payload (WallStealer)", "value": "0364db22c66f65fe2b55bc730051a84e30e22d16594b45f1dcd4d5cecfe870f4a672ded73e8f4e9219656d509995fb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "steamcommunity-com-profiles-76561199691513242", "colour": "#524D5F", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258020, "uuid": "2e22006a-591a-487a-9e3f-e1081443de9a", "value": "T19B96758FB674861388E263B5B2063573BE2BD43547998336BCEDE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258020, "uuid": "84b8c69b-c362-473f-b205-b584be07e207", "value": "5b41e0c5185f5ed2d915b87c0b3615c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258020, "uuid": "1576d0be-38af-4a60-8b4e-92281e6009ec", "value": "49152:xFANv2qfPvfmqLORFAVgCm6SjRqna3P5/qQC31MP7k6WRCkhEay6Q2faYPQwMVDT:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774258020, "uuid": "41aa87ac-c3f8-45f9-8bba-fa32fc266609", "value": 8868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774258020, "uuid": "89f87b85-089b-414f-9329-67f9a87c66f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774258020, "uuid": "917473ed-baad-4b43-8c0e-8fa16c9cb672", "value": "f9ada6f82b13173d6da86b84c6e08b044d1d627c6d02d4854bf1777381ea0d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e41eb85-26f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774297608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297608, "uuid": "fda09820-cf27-47c4-bf43-e20806352b05", "comment": "Malware payload (Mirai)", "value": "ae1f6e6d5e773a616e1baaf24074beb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297608, "uuid": "83ad1f48-3afb-444a-b214-d56fcdf718ec", "comment": "Malware payload (Mirai)", "value": "fb748f01edf3fc082671d237b70125743342f06317101fb8af4b22266d2604d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297608, "uuid": "547a68c3-c249-4c45-b5e2-9daac73fbc23", "comment": "Malware payload (Mirai)", "value": "445b61c3f8e88ce21b084c39a707b263e5421886", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297608, "uuid": "48e398b5-09b7-4210-8511-03c232d3985f", "comment": "Malware payload (Mirai)", "value": "182eb0d821a2559f1863c14d0570cee2723db2b65355fa45bee2680da329b6f2ad854b393f9a9fd2d8b7cd0988c9e8df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297608, "uuid": "b28a73fa-6aaa-47c7-b203-76720563b56f", "value": "T1DC534B51BD815A12C6D4127BFB5E42CD372A13A8E2DE3207DD266F21778B82B0F7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297608, "uuid": "57ad360f-49ce-4087-b5e5-7ff4f2ecbad4", "value": "1536:F6A/z+KXavdAJ7vhXHQ8nH1aSwOdSK1kXpSio:IA/MsblHQ8ngOuXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297608, "uuid": "a288b0d0-04ae-4cae-881f-0397bfd63c36", "value": 63608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297608, "uuid": "d88ded19-1047-4d4d-adf4-beb67fd4e5a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297608, "uuid": "9170afe3-55ee-4662-aff2-ba1c000b0f3e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe90b63-26f6-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1774297611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297611, "uuid": "2d8c5cad-24b4-46b8-84f9-a920da342c02", "comment": "Malware payload (Gafgyt)", "value": "f4a581f33e9c542b9ecf6824ec9d19e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297611, "uuid": "97051232-2a1d-411e-8d2e-c34897828769", "comment": "Malware payload (Gafgyt)", "value": "fb8d32cf60ffe401f131332f3efbe2bad5195df1147cf365bf87b31f30eaab3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297611, "uuid": "3b06c1aa-a6a2-47f0-9011-abd003fe7333", "comment": "Malware payload (Gafgyt)", "value": "f3cdd1000a757d45bcd81a44628b90b8ff13fc1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774297611, "uuid": "0f6a668f-cb71-46fb-9b77-3c9abf0218ee", "comment": "Malware payload (Gafgyt)", "value": "16888b1543108108a6796ca8930271f783e792f2cdadbe892158d8597f2074e5ae5f43c4852920c0d589707e15cf6abf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297611, "uuid": "097d99ed-0eb9-4a93-ad50-1fde2816d561", "value": "T15383B61E6E21DFADF659C33547B34E31A39833D626E1D685E26CD2001E6034E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297611, "uuid": "6317bc1e-1778-4123-902b-311679d69ef4", "value": "1536:vtpmDoTXY3/kEWJuXJuXhu05HOEQgSEgxSTn+e+SiX:1pmIYvkEx7gS6TnBiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774297611, "uuid": "18a49e01-78aa-4029-bffe-fa9054dbddee", "value": 84960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774297611, "uuid": "d39ea217-2e0e-426b-a4e7-bc28cf5a3492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774297611, "uuid": "48ad691c-4049-4a0d-a46d-23eb28a93248", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0708ace4-26d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774283181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283181, "uuid": "84c0f372-e073-4896-ac9e-416df297a163", "comment": "Malware payload (Mirai)", "value": "12855d0bec9491a570637baace115373", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283181, "uuid": "2a031308-4434-4dcd-9d64-5dcd74582e33", "comment": "Malware payload (Mirai)", "value": "fb967e4daa07ff3777fd4495133bef6544676a315409990f68057506d706c1e4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283181, "uuid": "5a9b2ef6-92fe-461d-801c-cbe0bd5131a0", "comment": "Malware payload (Mirai)", "value": "66ea649973e3423809b7e228d410e5e9027df9cd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774283181, "uuid": "f8bb028a-58df-4483-9ca4-09047a45ea51", "comment": "Malware payload (Mirai)", "value": "1e73096dce74f5fc4500da456b37b8f2f0a4ace4046c6e063fae963a5a00464cd27c994f328c4c36dac848b29392e238", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283181, "uuid": "cc902fd4-133f-4c81-991e-67e751f5710b", "value": "T19B4633957725BA3FC97346324E2AC37423259E21876A570BA550333CA87B3E84F89FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283181, "uuid": "7ace98aa-75ba-4fbc-acb0-72fe26bd139c", "value": "98304:xVs4soh8AgIOX9c9qURcrFSKTXThcIZt5EWQwP3ZS7E4NA25K:xVs9NskMqsIPhcIZzEDwPpaN5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774283181, "uuid": "64e1c459-f1fe-4e8b-b627-37a86bb9c893", "value": 5401317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774283181, "uuid": "08a56bb3-f2e6-4788-843b-bd4115869a6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774283181, "uuid": "277f4a74-0788-414b-8f40-2c404d59c6a9", "value": "app0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c690e2-26fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774300484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300484, "uuid": "76dc3250-945d-4b2d-852d-139561ff9d19", "comment": "Malware payload", "value": "cf5c680f2a4d44a44474991b0d2b947a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300484, "uuid": "d4c8fb1d-fbf8-4889-8b37-ce1fcd25d09d", "comment": "Malware payload", "value": "fba1b120e67783ed5cb789c94b331e52031dcaf181553535c35018114cfee14b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300484, "uuid": "c81fffd8-20d3-4eb9-9628-aa532d40ab92", "comment": "Malware payload", "value": "e9d38daae1186ba689c674affd9e3e4c5380f484", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774300484, "uuid": "85199535-6bbd-4ec1-b316-7fede1632322", "comment": "Malware payload", "value": "833683fb5764bf0a58f4ff769f700932302a7cac2a074e7a68872fb2313dbaccb5d918a53ebf80b06ffe33f8e8714445", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300484, "uuid": "e8168b4f-d535-4196-b4bb-820a21d97144", "value": "T138925BA912496C79BBC0CE7D9F3C7F0CADE881C02118A39CBE4F39714A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300484, "uuid": "1d435226-0d97-44cb-b44c-9c4f4cba7569", "value": "384:jfI0M3vgRjGlsaq7TzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:jfqmjfHzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774300484, "uuid": "de6dccad-7bd7-48c0-ad9d-94ed2ea48f58", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774300484, "uuid": "9f557a45-77b0-4058-9137-ba22cb0c4e8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774300484, "uuid": "04243415-ea29-43ce-b55a-01a5e38f0fba", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b959ffd7-2689-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774250838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250838, "uuid": "46a44fbe-3387-418a-bf96-efbdb37e735d", "comment": "Malware payload", "value": "029b8fa8754ae9cc0cf108a461925730", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250838, "uuid": "1a61f0fd-d7eb-46a4-9993-e20dd14a398b", "comment": "Malware payload", "value": "fd60803e682633e684bb2446ba4dd8a036211e13672088547020ca48af48a5d4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250838, "uuid": "5a87fa05-031d-423a-ade7-b2609aec628b", "comment": "Malware payload", "value": "19efc0f307ff682cc69940bdcdb14377d2c5ef44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774250838, "uuid": "365d7efb-80f6-4eb0-b601-6d21f7c1d77d", "comment": "Malware payload", "value": "f534ba41f7a7ba9dc2ca6339c6e62fe4debdf88a44b46cd4abbd86f5b676885476f44b4882316d63aad823076c67c0ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "verification-google", "colour": "#FEB24A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250838, "uuid": "8a2b2cb2-5a8e-4e06-9675-8e630368f2c5", "value": "T10B8422F079953CE30A5B12A24283FFD8BFA09733499F32A1B0A6149765537505BB78F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250838, "uuid": "282b2874-f5e2-41f6-ae67-2db9b58a47e0", "value": "6144:63TuAHL6s8AQRY77cDyeHKNvkNePpgobcK5REkMINRhC1ZUoqjQrEE5zZaNS:quq6DY7yyrxhx9gn2JUMQrEizZaNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774250838, "uuid": "efb0f924-e31f-4ca1-8fc1-f792668093cd", "value": 400445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774250838, "uuid": "cc29e092-e211-4794-9f28-63ef888e1b11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774250838, "uuid": "d725d02f-1f48-49a3-9cfa-f05a870e4d39", "value": "node_modules.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87206263-26fe-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774301005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301005, "uuid": "5c88ec4f-0bfe-4558-ad68-da0129d99989", "comment": "Malware payload (Mirai)", "value": "df8f2bf316fcc148724ca74f01e73612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301005, "uuid": "98c6ae38-1958-4592-a4e5-b93a1ffd8beb", "comment": "Malware payload (Mirai)", "value": "fdb896d2e421b552526f06a0adac88f0cb7c5e74ebf4a4d57f2a0c2279ca0c58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301005, "uuid": "0b1f0708-66d3-4092-97b2-d928afb16889", "comment": "Malware payload (Mirai)", "value": "fa2fd832a321b5962086329dbb83499d6c9d12f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774301005, "uuid": "8ed1292b-68e5-4fc5-8cba-6f2c0c6d6f96", "comment": "Malware payload (Mirai)", "value": "ce35cad54152da36b5a7de21e8c0b4a98be055f2c6b22b6609f9d1f0cacb8bac709728b786695fcaf53f5cf99d1a34b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301005, "uuid": "fad0a236-0990-4e85-bd73-c4800a55f25b", "value": "T1C5936B42B30D0647E6571FF03D3F63D9939EE6E011E0A58A361FAB858271B32158BED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301005, "uuid": "ead37a4e-25f1-449c-ac3c-ff6d6183fd0c", "value": "1536:EnuJ3iOn+rIBppBecDMih1z7R7/OzVGwViuwNuGH3ukpU8iiAWe7TX:E2GIBppBso1z75mxGhuwNv381X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774301005, "uuid": "6fde947b-01fe-4408-923d-ea03c48c574f", "value": 93532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774301005, "uuid": "dc248664-f9ff-4c70-ae12-302361a66c28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774301005, "uuid": "bad8b4a6-f528-48bb-9164-656820fd5628", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41982cc2-2657-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774229162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229162, "uuid": "1e542a8c-b6b6-49b8-8c67-83cb962d4249", "comment": "Malware payload (Vidar)", "value": "80067ebf03a2b58e0545c1abd1022624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229162, "uuid": "dd9962d1-0cf3-4c16-8334-c640a9e16bd3", "comment": "Malware payload (Vidar)", "value": "fdea7c3832a87b08fc88835b621ff6028d18a211b52f8720b455d36f6e35b16a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229162, "uuid": "813c99d5-21e7-41a2-bb9a-7bddae375bce", "comment": "Malware payload (Vidar)", "value": "4eaff002a81f92f7f1d7aa9603bb3c559efd0767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774229162, "uuid": "950ddda5-6ea9-4156-a8e8-bdfb4ec99422", "comment": "Malware payload (Vidar)", "value": "bf99f3d2aeefcd8ff339673c6e9cf8053d1cdf646aa319f46fb632a812fd4e96d4b0ec94edbcef80439ada8171875f0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229162, "uuid": "f225c68c-6356-4d69-a0bd-f47de09e8b5c", "value": "T19B546B1A73A40CF8E9B7923DC9564A42E772BC160761EBDF03A046572F236D19E3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229162, "uuid": "5462e3df-3ae2-4763-9325-a853becf001e", "value": "64fabd9655e120dbee63eb5f3910b2d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229162, "uuid": "9e846482-4b44-4e7e-8c4a-377b5fdbfb2d", "value": "6144:oL0/8IAiofFh13oMnIWB28mnEBlUq3nuAjv6krdYviMB8ld:owYFh13oMnIWBNLBlUqdjvPrdYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774229162, "uuid": "598563ec-5cb3-493b-8aa4-f7baa6f2e46e", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774229162, "uuid": "e49da4ca-c888-488b-b404-c9fd65a0279c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774229162, "uuid": "724e2abd-793d-4a7d-9979-b13c8da5f79c", "value": "fdea7c3832a87b08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88799aac-2704-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774303584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303584, "uuid": "24b51909-4bf0-48ee-ab4e-cbd34f5828b5", "comment": "Malware payload", "value": "75adf746405a5472377792246dc80c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303584, "uuid": "e6a28035-755a-4c9f-aedf-7d7ee67bcfa3", "comment": "Malware payload", "value": "ff11758fd7d4a4a5529b2b6b963a42abc51f6225628ea492aefe1cfe842c5301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303584, "uuid": "a7a7cced-2e72-464b-a4f7-38159c9779c3", "comment": "Malware payload", "value": "eafed5d2f9e658253bc1678f435da6f7f484f0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774303584, "uuid": "28a3b030-b947-492c-88e2-d25c7c0cccf8", "comment": "Malware payload", "value": "c0154b8bf6fbe922c3c240e9e1845feceb22badd8a3b233ce9853c8f90221055f1fea75ecb7b3e9932c838b03fdb0930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303584, "uuid": "d0d61d4c-16e9-415b-b4d5-90e59b5070f4", "value": "T1C39618FB72A58228C15E813EC0A28F85D8F37D7D1733C9D702990F696AD68C55E7E620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303584, "uuid": "ca108912-62c2-4e4e-995a-02226bdba51a", "value": "3ddebb65c2eb980f7e40797e62c34d3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303584, "uuid": "979f4039-cb51-4f05-85ba-36eb7f1dd643", "value": "49152:8Ipabd5kc+rOhiMj7g5Fh+uuddlS4hwo+MVhRBPO3j8Q0KHAGCGkIATOE8h:IH3Oz81KHZvE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774303584, "uuid": "3beca5b7-d8b9-45d1-9aa8-9eebf0d9967f", "value": 8973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774303584, "uuid": "6dad7785-ea59-4596-b010-754b7d94bf3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774303584, "uuid": "02c6ced1-1d2b-49d9-8bec-9de2e341b7fc", "value": "dglfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54261c1-26c7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277460, "uuid": "ff53afb1-abf5-413d-86aa-c8ef8ceb3741", "comment": "Malware payload", "value": "dc682498bf6d976a644caf614b326fe7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277460, "uuid": "64d17892-4d9e-4d2c-8bc9-625dec364427", "comment": "Malware payload", "value": "ff5184770688e373c853be06075dd925ff8492201a838d4a58e2e5be74b4a88b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277460, "uuid": "89e73031-37e2-4ea3-892d-1a9e19e75cf1", "comment": "Malware payload", "value": "c6389ebcf7e55199be145790d3c68c072bf75177", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277460, "uuid": "ac02e54f-7f31-4ab9-9564-b1cf9f0196e1", "comment": "Malware payload", "value": "caf3f3d40f424892a6d9948bed7f62b4508971756a5e8f3f36a931f792b5a26e260246e70dfbd8caeafcf1ee625c2975", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277460, "uuid": "f3548e15-eb39-400e-9db2-2465137dbab6", "value": "T1756733CEB8E28677E43B5431CA75558981A17CD20F630E3DB99C37969EFBB69123240C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277460, "uuid": "002ee9cc-20ad-436a-ad04-36eafeb24ce5", "value": "786432:9HbLIkgEWe2XpELLzhTZg2vTz758GSvMTFJoiJ:FLIbEAqhTZgYTz758GUMDoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277460, "uuid": "2c612df5-2586-4b54-a00e-495357c23df0", "value": 30019584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277460, "uuid": "58a3bf91-48b1-4e45-baf7-7a497fd7b6b6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277460, "uuid": "718d6db1-f4d5-48d0-9648-5d6cdce1d75e", "value": "RivalMods.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eeca92-26aa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774264981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264981, "uuid": "2ed5ca0f-6a1b-4428-958e-3b77a95418ed", "comment": "Malware payload (AgentTesla)", "value": "63c597f52819feb094ae8db9b9d453d3", "object_relation": "md5", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264981, "uuid": "9d71a7da-7bd0-4a1f-bdb5-48cbb44c816e", "comment": "Malware payload (AgentTesla)", "value": "ff9056ec9f65c9607e8d3ff1179062ebf14d185a5510884766ec06c962e14158", "object_relation": "sha256", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264981, "uuid": "82786619-95ad-435b-8b63-22bbe4126856", "comment": "Malware payload (AgentTesla)", "value": "5e35a2532d77a0a20d47ae0d7e9a790bca415254", "object_relation": "sha1", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774264981, "uuid": "ff3e1be3-ddbf-46ee-9adb-b6f0a2b67b80", "comment": "Malware payload (AgentTesla)", "value": "37ecfbc14388e929ba88acbe9ee0e21385e93c9cface0ec9f909c2caa1feee85c38085e98c5f754ade315afaad425377", "object_relation": "sha3-384", "Tag": [ { "name": "4x4--hydro-niche-com", "colour": "#4B2E44", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264981, "uuid": "006962f5-4376-419d-b0a2-fde9b8708c07", "value": "T12882C01857B5F3B73A96D731832A3F64230F02258DCFD1D95A1B232F526AD884662BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264981, "uuid": "8f51b1ac-05cb-41d8-9f7b-b21ce1805960", "value": "384:43TGP7DU/7dM2I0u3GSjiTrFONKNlVZzByXFf09t//7ckryV+ge3D0V:c6DU/72YRcrQNDtByXFf095/7FrysgeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774264981, "uuid": "bff24785-15b9-4497-a5c5-4828dd09e396", "value": 19220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774264981, "uuid": "410b509d-66a0-43d4-b5fa-21b1de76942c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774264981, "uuid": "6ae3ba26-8582-4315-ad3c-5119e931c49a", "value": "23-03-2026-002812.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99733f1-26c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774277038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277038, "uuid": "97159868-16c9-4e60-9578-a52c111e6d44", "comment": "Malware payload", "value": "1d947084fdf25e07ec8bcdaf0cec508a", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277038, "uuid": "b5ef0ad7-8775-488c-beda-6fc97dbf330a", "comment": "Malware payload", "value": "ffceb438127725a6a664aba5021f7625bd8c22b3f76447de91b728839136c9c3", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277038, "uuid": "23a4c05f-45b5-40ec-87f1-9143fd18d354", "comment": "Malware payload", "value": "7ee579a1fa697f66d80103a867cf706f67bba32b", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774277038, "uuid": "b6eaf587-e270-471d-bf35-8511e418aade", "comment": "Malware payload", "value": "5a91c12dfc4c900edca2af2d21ffb7bb6883c925d5bf472d66cbb7fd819812a1592ea501ed1d184e349cda8c7a8a221d", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org-bot7379415729", "colour": "#A98459", "exportable": true, "hide_tag": false }, { "name": "Iran-Linked-Telegram-C2", "colour": "#5C1F82", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277038, "uuid": "3933f3fd-46d3-4321-b8e8-a588feae80ff", "value": "T174046D2D8F2BE0D0433EF490C2D99D6673504A56CB7C8B98FF21AFA61D14765E79A20C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277038, "uuid": "e6cf0af9-1791-40ea-b992-14b44db0a4be", "value": "768:s7mxa96MH7rOokUORcpFoa4bOYOd7O36nHKZljXRnSr9nMMzyBQbU5ovOr4kqUXc:q1bNkSoa4mjnHilTRSrjb/XlnB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774277038, "uuid": "55800428-3250-42e9-ab21-19f7f0c564d5", "value": 183919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774277038, "uuid": "9cbf6f43-9c93-45ee-88a9-6b2579cb2f8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774277038, "uuid": "dd01593c-b233-4dbd-9faf-fd3ac6599dcc", "value": "ffceb438127725a6a664aba5021f7625bd8c22b3f76447de91b728839136c9c3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }